{"type": "bundle", "id": "bundle--2ba7e144-8b51-4800-a464-0619a9dac00f", "objects": [{"type": "identity", "spec_version": "2.1", "id": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "name": "James Brine", "identity_class": "individual", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "location", "spec_version": "2.1", "id": "location--9954538f-a3cf-4ef8-995a-3546ca26d271", "name": "DigitalOcean London", "latitude": 51.5177, "longitude": -0.6215, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "GB"}, {"type": "location", "spec_version": "2.1", "id": "location--d32673b0-3320-4c44-8036-01ff8dc92922", "name": "DigitalOcean Toronto", "latitude": 43.6547, "longitude": -79.3623, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "CA"}, {"type": "location", "spec_version": "2.1", "id": "location--971a7e46-31bd-4660-aa30-3d7ba1e547a4", "name": "Vultr Melbourne", "latitude": -37.8136, "longitude": 144.9631, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "AU"}, {"type": "location", "spec_version": "2.1", "id": "location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98", "name": "Vultr Paris", "latitude": 48.8566, "longitude": 2.3522, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "FR"}, {"type": "location", "spec_version": "2.1", "id": "location--42737d5e-a4ef-4603-bb2f-8145b63c785e", "name": "Vultr Tokyo", "latitude": 35.6762, "longitude": 139.6503, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "JP"}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--c073622e-2a7b-47ac-835e-d0af097abf36", "name": "Cloudflare Global Edge", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--a9a47473-74c9-4301-b094-333152e652ff", "name": "DigitalOcean London", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f287d83e-e7c7-4f63-a9cc-1493bf8e117e", "relationship_type": "located-at", "source_ref": "infrastructure--a9a47473-74c9-4301-b094-333152e652ff", "target_ref": "location--9954538f-a3cf-4ef8-995a-3546ca26d271", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--1a847c3e-be27-420b-ba1a-137be3986120", "name": "DigitalOcean Toronto", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bb519c7b-abfa-4639-a4f3-bc879f36569f", "relationship_type": "located-at", "source_ref": "infrastructure--1a847c3e-be27-420b-ba1a-137be3986120", "target_ref": "location--d32673b0-3320-4c44-8036-01ff8dc92922", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--ff1eba30-a336-4d64-a63d-585e6970284c", "name": "OpenCLAW Dashboard Decoy", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--6a11e054-e409-4cc1-86ee-a6dc3cc91c31", "name": "Vultr Melbourne", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bd2616d0-2777-4955-898f-14a7e53c6a35", "relationship_type": "located-at", "source_ref": "infrastructure--6a11e054-e409-4cc1-86ee-a6dc3cc91c31", "target_ref": "location--971a7e46-31bd-4660-aa30-3d7ba1e547a4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--14b2169e-26c9-4d97-8826-1efc81f57011", "name": "Vultr Paris", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--eddf462e-da71-4495-adf8-199122ec51a5", "relationship_type": "located-at", "source_ref": "infrastructure--14b2169e-26c9-4d97-8826-1efc81f57011", "target_ref": "location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--e9544fb2-f188-4bd7-b8a3-814ad28a2234", "name": "Vultr Tokyo", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2c96a10f-6b09-4abd-9e7e-a9fa8bd9cd97", "relationship_type": "located-at", "source_ref": "infrastructure--e9544fb2-f188-4bd7-b8a3-814ad28a2234", "target_ref": "location--42737d5e-a4ef-4603-bb2f-8145b63c785e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--0658f8c7-3aad-4b1a-a6a9-1721ccbde1ea", "name": "CVE-2019-5418", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--c49bc997-a777-4d72-a03d-4f7af0e75fd6", "name": "CVE-2021-26855", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--530d0aee-6039-42fc-9da7-d36f84529692", "name": "CVE-2021-31207", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31207", "external_id": "CVE-2021-31207"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--63210108-760c-4b1e-81b9-da8400b84cfa", "name": "CVE-2021-41773", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41773", "external_id": "CVE-2021-41773"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--271a0d64-6d2c-431f-a3ef-aef8b38ee0ed", "name": "CVE-2021-42013", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42013", "external_id": "CVE-2021-42013"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--c526e552-61fd-4157-bd2a-33ee42d7f0a2", "name": "CVE-2023-1389", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1389", "external_id": "CVE-2023-1389"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd1d81dc-b04a-4116-a458-28c0c88ec0bc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.214.214.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a668263-6430-4ef3-96ed-fdc92474b02f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.24.16.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcc099ef-8b77-4b9c-a7be-c308d1a50a44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.31.120.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2949edc1-a59d-47af-b293-0b88314fb303", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.83.125.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96e193c7-b63a-4dfa-8546-5f26ea9ac232", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.83.125.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f6df09d-6153-42e8-b87b-fecd3dd1737a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.28.153.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c9be048-3ad3-4672-8808-2300fd4d9aba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--601445fd-5141-4c91-a096-a837b0b84745", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c17242e3-3721-4b0a-8c8c-ca8438d40123", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff2ddbae-d0e6-4290-b31d-fe0a8743ae12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40f03bd1-69b0-4ad2-9a6d-63eeaf837b16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fc6b229-92ba-41ad-ab46-6d8264027816", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03a3d38b-38a2-4240-a057-188be2ddece6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb7b22f0-61e8-4276-a5cf-d072e33dd701", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a0865b4-6334-489b-b75e-1311639d0ab5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe42ac7a-1940-42bf-9255-86a978c75f1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de12f650-db02-4a48-b988-9d4685fe0bbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--673af9a6-2786-4dc8-82a0-85ac05d0fd8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--035a529c-9cac-45d3-b0c6-6ef9467964bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a1f1e45-2fa8-4c2d-94b0-641f47482a96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77307512-f6d5-4241-9aaf-1a70111b35b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a987ca0-8be9-4943-9568-3824cce3c1f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6a262c4-97c2-4537-bb6c-1aadfafd2a55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e4d7d45-99b0-4c64-b50f-6f26c4d968de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71d21fc6-97eb-4d75-9c3d-749de1d9d7ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8e642dc-0868-45b2-be4e-1b9a92bec321", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eaf1021-0dae-41f8-b4fa-88f139f07df0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2578127e-8215-4c02-b710-d1a8e9bafcae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e28a2651-a783-42dd-88c0-7b9854e8e2f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22a77a61-d860-4030-bff6-7586dc2ad930", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e74d319b-64ad-4d66-8252-604794ef0eac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d64a7be0-7708-46b0-9b0f-a200ab3dc5cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--423d36e0-6222-42b0-9b42-7353683f6a5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03760a35-e850-45de-bf72-08b457c64e6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26e24bac-8f1f-4310-82f6-d7d4f9b9b8b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c588ed4-a97c-4e62-aa79-f67b70b65888", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18e58771-8d82-48bc-8651-cb9d6f76d785", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47b94e2c-97c9-4613-a385-8bef1e2fb857", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a23590a2-aee4-47f2-a0cf-0acd737d8020", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--deb1f0cb-2c7c-46d9-92bd-15970e841678", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.36.187.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd2372a6-70fe-410c-9383-d6ee8d385465", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.48.87.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5662590-e172-4f6b-91f8-9d445777cf09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.49.117.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d04e17b-1686-4b19-a9a9-08f64db752dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.50.17.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81e8315e-49b2-48cd-ad83-4fe2a315bb57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.53.171.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c15f0fe0-20ac-4d92-a8e3-a7d518a2acbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.53.78.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cff97bf3-ca52-471d-b12d-829c9a4983ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.55.31.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d961493-8aec-40a0-9ccd-5173eedc7aec", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.157.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91de531d-deba-4b4e-bbdd-e8218bd519ee", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.55.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--930b5405-148d-4b37-b601-225b7bb0c069", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.89.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c54f0b0-46b4-4022-9f68-66cf1d4bbde3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.200.243.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f68e7c6c-5852-4219-b795-c0fad57a5532", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.201.104.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2ba24af-0752-4f97-a4b5-955c74a0eb8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.249.60.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fda8889-b2c1-484a-bbea-a7a536c93131", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.104.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--763e3939-addc-4ffb-b119-4d17a9c58f6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.105.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ac80931-cc99-4f7e-a43e-acd3d08eeb39", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.106.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7c5639f-5b09-4475-a3e2-b6e570280b49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.106.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29b9f82b-7a28-4585-b551-b457821c4d38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.106.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ea0e5e5-1da0-417e-8fa3-2ddbba9a413f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.107.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42e674f3-9770-4fd7-a58b-6ed997b5aac3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.108.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cae7ff2-1ec2-4396-841b-3b5ff13532bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.108.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79adc963-772a-4f9f-bf77-00ff02f6a7a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.108.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--665a7781-3708-41f6-a34e-0230e5de9bb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.110.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73c0302f-c634-4f3f-a5f6-d9be3cff77f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.114.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8c4b1fa-14cf-4d23-9c54-9945ffa78a7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.116.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da63f796-62e6-4dfe-8b1a-3213be686ec3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.117.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84e435af-9bc1-46e0-bc6a-5157a791b1f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.118.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5206525d-5519-4467-9075-f27442c68232", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.119.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8da1cf30-1b3e-473a-995a-fc56bddc5286", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.121.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99bfc58f-f594-489c-a678-8c6c6480898d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.122.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--060ab6e5-8edf-48ca-9b24-d3bba6d376a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.123.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b36b6a1-23f0-43cf-9766-77a46ddfcc69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.127.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4d99c5a-5779-48ce-91ce-c93c75ba00b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff9c97a0-0e3f-44c4-831d-3e26b3ffe209", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff663a53-1890-475f-b3c6-4dcc68dd5a6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47e35ad9-ae09-4c77-be17-66b4e4d3aac1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a0596f5-5ddb-40aa-ac2d-3a6941353416", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--447eb5ca-9ee7-4f1e-a65e-5ffb39224846", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.42.46.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74429804-bbfb-45b6-b4e5-5ce3e5f48771", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.43.6.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e341d10-ad21-4ec6-8688-41d7897eb4dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.66.165.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5c7176a-23db-4a63-a59c-e4b3ce9ca2e3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.79.23.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--352e0be3-a0e6-4ce9-9ec1-734d7a808b8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.87.200.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ca90fc8-c06c-484b-b18e-21808cab9bd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.0.17.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e11d721d-a3fb-4fce-86d5-59a05208f00f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.0.26.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b2da704-e88f-4d4f-9fbe-e2cf1bc36ef4", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.0.27.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64853283-e49a-4f9c-b32b-9b498241a6b9", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.134.22.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28a81b1c-6dd8-468f-a1e7-936087f0ebbb", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.141.40.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12ec7ecf-9d3a-44e1-8f7d-279b7596599e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.178.175.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea2bf0fa-7c25-45b3-ba18-b432fedd6929", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.178.88.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a46a43a9-bd97-48a7-b5cc-ec711dd1dfb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.179.117.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acdaed5a-12e9-4cca-829c-7ef87308e248", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.179.23.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1002b6c2-50f4-41c9-8472-84971abd4bd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.180.201.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0af69f67-b3bd-4987-9394-c747eef611e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.180.227.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--909aa7cf-3dc1-4719-9763-cc0aaccb83ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.180.93.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e268074-ee09-4edb-9a63-b03d51f23d7c", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.204.156.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--762a50fe-4701-4e47-866a-0869c7d0d740", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.206.240.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75642237-ac3a-4846-a99d-ddd9b68e414e", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.209.254.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51bef104-1634-4095-9ba2-e3893d5b8c96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.209.254.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f21c6465-384c-4d1e-b4b4-4149263ffc0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.209.254.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--820ecd18-ef94-4214-ab26-6e9af5455b57", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.209.254.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1b461c0-63a0-4a58-81ca-45cf19fada05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.209.254.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dce25de5-46db-4663-8875-68266f775eda", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.209.254.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de305e26-1cb4-449c-99cc-7cc4a42acb74", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.210.149.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49a43ed5-f345-4e66-8252-0e39fc1b8d82", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.214.117.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e962cf7d-60c7-48e6-af4b-2f77da14b910", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.214.145.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42375d65-faa7-434e-aa22-30e9722ec1e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.222.0.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cd6387e-59cf-4337-b774-064292dd6cf1", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.222.222.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a686fef-f136-4728-befc-3bb02339d6fb", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.23.38.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c4e01c0-91e3-40a7-b24e-bd28948a6ebe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.38.104.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f60c446-5e20-4e9f-8d7f-d0c726157e3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.38.11.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f400370-f194-4310-8c3b-d3bcd67720bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.39.240.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad298266-addc-4fce-ab1d-9b69dbc5b136", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.39.38.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81795fd5-62d4-477f-9763-4a1d2c3e5c55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.68.120.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39dd25cd-9723-4044-8c5e-2c856e88456f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.88.137.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b9c2031-9990-48dd-ba07-5728a7281383", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.88.137.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2afffd9c-dce0-4c0a-bbeb-14ded431fb1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.88.21.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5230633-3828-4348-9230-637074fcf99a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.90.79.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46e52017-e87b-446d-9d7b-12a8c610b66a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.90.79.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fb196ea-1b1f-46bb-97cc-b0282053945f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.90.79.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--748b3ea1-8417-4458-9283-cd7cdecec765", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.1.210.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ece0927a-b04c-46c8-a8af-6392776da05b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.100.234.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c88dc95-dfa7-40b4-bd46-73ab116d6c2f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.105.176.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3a91950-d536-4cdd-abb5-a09c32ce755d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.107.60.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5417281-4213-498c-b03a-8c82e27b6ed8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.107.95.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19b53619-463f-453e-a9bd-a79ff65bd989", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.11.81.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72fb2ece-b5aa-4d00-b2c1-e42d7f92063c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.110.81.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55a4bef1-a81c-4969-87d9-c70eba9babd6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.112.173.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfe62f3e-f1a2-448a-87a4-1e05b80860f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.115.199.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--767bc6ee-8476-4a1e-bca6-66535fe6e220", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.115.48.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c9a6e5d-1b8b-4721-9657-17eab7ac55c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.118.78.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18b552d0-8d2d-4a10-8d1c-342c9cff4403", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.119.94.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3300a66f-8424-4992-8847-3f80374fbd40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.121.151.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbe279b6-1362-4c53-b830-87ee126f14a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.123.226.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8204f04b-2c21-4599-8bdc-b68732cbb3c0", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.123.226.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52b42a84-e7b8-4d4d-9efb-d8be2d7b1cf2", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.126.117.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22c4bab8-101c-459c-abdd-e3485dc887be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.126.87.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fda7c9f-2dcf-44d0-bfd6-6ef667f5c447", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.127.3.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d62e0a42-4a3c-429a-b113-ab7bd625b7b3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.134.154.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--188e66e2-e431-448e-9cc3-d5d8ba9d3e35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.14.32.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51994511-e14c-4a66-83a5-72c8474bbfa9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.14.32.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac33d884-fba3-422b-9753-781edf7a7251", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.14.79.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf9ad39a-2088-47bc-ab2f-bf3d52dfdb0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.143.230.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68d33f3e-1e87-4f1e-add9-7000324a3b26", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.143.238.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4371e7ea-6a95-49f9-ad56-b24266dd10f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.146.110.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--418306d9-7ed1-4a78-8679-00d314839b97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.147.1.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb554435-991e-4e04-936f-a1527f218c6a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.148.100.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ced1407-8cf9-45f2-bcba-5bb7182aa7cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.149.101.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75868b4b-b4ec-48d0-80d3-fc355f7adca5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.149.26.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b89799c-70ef-4f9c-b164-76fbd09b4515", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.151.140.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a58b5637-e88b-443d-b09b-cb64d6427cb3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.153.110.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33f50308-625b-4cb6-9e5f-6027030a05c8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.154.158.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf81f9a3-91cd-444b-819b-ffba67748e91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.154.188.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fb20120-b51a-4431-9747-62a510fe6113", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.155.57.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31dfa805-6ade-4bdb-a2a3-5ff751768425", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.156.224.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee607c13-1e67-4ebc-9365-96abaf8d0d67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.162.112.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa6b9f17-46f4-4273-a5de-14438948d3cd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.164.107.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34104727-8fa0-4391-8567-178cde71cd06", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.166.103.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de896bec-62db-494a-a531-2ff2ea724234", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.168.190.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc31bac8-b083-449b-bacd-2023a87ff365", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.171.69.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe874526-20e2-4849-9246-c86e986a580d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.171.69.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d71c6bf4-6e98-4f15-99e9-49579c0d6a39", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.171.69.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab7e4377-51fe-487e-8cd9-004a16edead9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.171.69.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbd2fe01-473c-4f8e-b3c3-14fba6102274", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.173.139.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28c9dcb3-e362-4a38-9ab2-55b3c1a4fa8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.173.227.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcfc2481-abf4-495f-b887-cdc6bd1e0c74", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.178.95.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e06c5495-6f7b-4e77-b456-286653495079", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.180.240.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79e79db4-aeeb-4588-a041-6dd549fbd09e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.181.160.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90b90f29-ee48-4eff-9c9d-7d251645ca05", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.186.41.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56424f9f-5e30-4259-abb9-9db4fb35d3a1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.187.146.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5713d5d6-f784-407f-9d81-d77d5111396a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.187.147.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07bc338d-50b5-466d-be0d-74369ebb221b", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.192.174.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b147ac13-1950-4145-ab45-9dcacf7b9653", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.195.236.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db1f1fdc-7092-421e-9bc9-58676c525089", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.200.25.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed374c49-2c47-4e5e-a379-0837277fd76a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.203.57.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b881dc56-4c85-4159-b609-6b926750862f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.203.57.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3aaaa90-cc06-4385-a675-0f0511b8e210", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.203.58.1']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dc7456e-1c04-4192-8062-b1b0daf071ac", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.210.21.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f62d8d51-bcac-4773-81ef-7148123bc738", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.211.59.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b25af515-cb24-45af-82ff-996a6e24b523", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.214.5.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bf3c076-c543-4816-9d77-a84390321ac0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.218.241.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8455d48a-76ca-42a7-a7cd-60683be3c968", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.231.14.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6bdcd8d-034d-4c0d-a91c-16e948c6b4ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34b7a734-350b-4859-89cb-3ac66b1c9332", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98f252b7-d011-4702-bf7c-24610158f8a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dffc0b2-63cf-4562-a369-466f928dd9b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--720eacaa-5bf1-4058-a911-c422e47e37e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f88172f8-6303-4ba4-a92d-b0e26fdf6006", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d7bb128-02b2-48d5-8f6d-a1968181c234", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06b5b27d-6b96-430d-bb72-16d7fe7d1d82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab23d87c-972d-4e2d-a913-ec0d0425f2b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38fa71f2-f066-47c8-ae6d-de4b5dca5d67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eba8b8ce-630f-4dc2-8890-d05622076405", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50963d33-d47e-4034-8df3-f47d344f47b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3030405-0c43-4bfa-a3de-7236ccde3045", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ae9da6a-d8e4-4524-a7bd-d60274f6cb94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.236.92.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fee946f9-76c6-40bf-ba15-7193b88e632c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.248.120.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ce2dd78-7c4d-4d6f-b829-dce79f81a145", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.250.14.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5badfe29-de74-4606-ad47-38c7bba791ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.253.74.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--185506fb-2b78-4e87-b3f7-2951da5ba073", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.255.65.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28139f96-748a-4f4c-a741-94141e95aa70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.37.6.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7605a26a-ebe2-42b3-bb66-8e4ee09c66c7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.38.219.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c685c716-e928-4d44-b2a0-49295ec68a78", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.4.145.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52c7ea44-25d4-485a-9c5c-d31e21fb9b7f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.42.74.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f666891-a157-4794-98c0-aa0c0ae016c6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.48.192.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30305653-2141-4fd3-99bb-bd276322e98b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.54.101.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e59f0062-9dbc-4791-945b-cf090f2477d1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.56.115.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcb788a2-caa6-48b2-9799-619c7cc3d215", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.56.80.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0483e921-bf84-4a18-9d33-8dc1adb01cad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.61.122.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ca17ab5-2538-4425-ba1a-9497d7e3b377", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.62.152.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05195adc-08f2-4e18-bdcf-f9aefdf366e6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.65.237.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a7328c3-7ca2-4c38-906f-582a63f267fc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.65.240.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7418b799-afac-4578-be8f-55983b23908d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.67.80.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ca4c62a-9c8b-4c79-baef-800c70b1ce1e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.69.88.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27bc24ad-8b16-47d0-9e4c-b737e61d7a62", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.70.40.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cf2d48a-7209-4cdc-af36-841bf524b3b1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.75.183.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6459b2b2-4c50-4733-a648-06a5f038d2cc", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.76.91.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9cb30ce-69a1-48ae-8f52-dc6fbc0e5083", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.77.241.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ccee5db-1e74-41b1-abe2-4fded84c4373", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.77.246.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b2c930a-0507-4caa-8eaf-6b8a2b2ce99c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.9.204.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9ca19e3-1fc5-42f8-af8c-16dfe98a2e59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.93.42.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cf3705d-7528-4f5b-9b2c-5299084f978e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.96.42.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39cf7bda-912c-42d2-808e-8cbd72f63a7c", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.98.129.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50c927ed-4934-4100-af97-38153d51234f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.131.161.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9f11f09-a887-4653-905c-d23f93c8e791", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.131.69.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbcb9d87-8f02-4166-bfae-b492e4a30138", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.131.85.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0df982c-5578-4350-947b-45875f8adca5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f676926f-c23d-4b9e-bb4f-8570ac402003", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08f79ab6-10d9-41d6-b7ee-5f4913ad6aa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--117b57d2-9679-41f9-9894-a257aa1db662", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad9e0f2a-8c95-4e6b-b745-5cfedf3768ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8ac68e3-60e4-4c87-a41a-53c056036605", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2a61a7e-7490-4166-9174-6accab35e15e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd8eec3e-cd6b-4e46-8ff6-fe09a625a5d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--296f385b-7836-40d5-a0e2-7d8887457109", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--513dcdf6-a397-42d1-9018-f002984eb435", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa646906-547e-4758-b988-bc5e49e0030c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.155.104.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a8fdc5a-31d7-499a-963d-a7325196a0bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.155.55.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81e71599-f457-4940-9048-469ad56d84d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.194.10.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78645bbb-c026-4d5a-9aad-b60566ac7603", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.194.143.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddb8666a-4bec-49a7-8fc3-ab3f5c15bb8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.199.90.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95a2734c-f99b-44f4-ad3c-ed912fee0f37", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.210.140.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1695472-84bd-48ad-ae87-ac12c85953d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.236.75.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22738da6-a0e4-45d0-ace0-553f80cf5364", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.237.156.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf57ff47-fff0-45c3-91e2-eff59feb57e7", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.238.81.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5942452f-cc29-4fcd-b4d1-61de0a16bc1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.35.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7211b5c1-6433-4951-83bd-b9513df481e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.35.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52c21c7b-36e9-4d2f-914d-fbae8e58992d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.42.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0a5e5eb-f521-471e-84ad-a78928cc3e69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.112.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46ee3047-3807-4373-879d-dce17c057468", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.130.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70bfca34-1af9-4f38-a967-ad22b871232f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.218.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4431d0a1-fe09-4671-ad38-002897978739", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.32.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9b5acfd-81f0-42e1-8811-3d9f82e736bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.93.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa495da3-e10d-4ade-bd20-91d912c512a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.250.53.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7bd4610-29a4-4700-86a8-a4700f63d6a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.251.180.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e287a21f-6ed4-4af7-b848-b8343d2a4e28", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.28.153.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e5fbbdb-805f-4d30-b498-45616df384c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.28.195.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1feafa79-caaa-40de-b795-a2c872f5c1d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.155.63.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27befad4-a998-44fd-848a-11381e260f76", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.174.31.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb982cb1-30a7-436d-b26c-56582fd92d81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.184.161.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35c8c09d-d33a-4dea-a465-89ab49b3e769", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.186.142.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d4e9d44-1ee0-4dc0-b37b-d8b05aab0b90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.188.26.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35af8180-7309-4dea-9758-3e6e0d19c9a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.191.61.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e85e4c49-9805-4659-ad8c-2be6534ff0dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.214.75.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05af7da4-fd8a-42e4-a5a8-676892bbf0b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.225.179.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32ca782c-a1f1-4355-b0a9-ab1a63603b57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.235.255.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a6e725d-e7ee-47c8-b3b2-5acda8e12a56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.12.154.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c81a7882-8551-4d1b-9a88-c04008028336", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.12.173.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e509faae-17c8-4940-b6b2-1668e8e86b7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.12.182.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60d72cf2-974f-40fc-8313-dd70b785de09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.12.6.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ce82a42-019e-4964-8828-d8e16630d0b7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.13.98.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e02eebf-ead4-4eac-93fd-9616d4af690f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.221.236.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c7e43b3-6cfa-482c-a20e-9c57953d0e1c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.227.33.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c800ae32-eb21-4703-bfe7-2f0dd982ddf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.37.72.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c244d4ae-0ce1-4e42-b5ea-16d6dc72630b", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.40.243.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--362cff62-cfec-49c5-aea3-6422512c672f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.52.171.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5fc5d91-68b8-4228-9236-3f0c51e85635", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.59.3.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02e174f3-c9ff-4527-8bd0-8416c03fbf38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.139.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21472ba6-1a3b-42d3-a1c0-997153723208", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32d5d546-7ffd-4dcd-8183-cb6ce9398963", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--531360c0-c41b-466a-ad11-2a67d5684478", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc47544b-b02c-4bf7-a9dc-f3a834225c19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.176.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab8797fc-e39b-47da-9f45-732437b2b78e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.188.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fa03ee0-a4c0-4725-9dc8-0ac66623cae3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.189.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89f5d2ac-f031-4084-bf63-467a20de4f1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.189.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f51ad4a-d014-47cc-8c0c-703447eb2e62", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.190.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc7819bb-7151-4836-b1ee-c20bc5f57568", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.77.134.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2b0fa6a-87c2-4ace-a3f5-0d3bfe5c873f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.0.200.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72b98d29-67df-437a-8c95-1bb57176da4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eef22df7-b3a7-40a1-8f84-21547422dceb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aad7fb63-a331-4493-8554-73eae734026b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f981c474-4a75-456f-af8f-e9bc55bbec04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c578d80-1d94-4402-b79f-554ed8d31bf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f172c7a-6864-44b3-b1a9-e9c3848e37f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d074bfb-2b0c-4a52-8f7d-7091438126ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.102.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1933cf38-34df-47d3-97eb-ca2dc5d04ec1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e70a079e-3985-4a87-8d65-9bdc87d54465", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d5b85fa-9243-4571-8fc0-63eaba8c3a21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9020eca-11a2-4438-af27-c8b1a2194cb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--859462e3-3805-467d-bde4-69ca71ed533a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.104.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c4492a1-b4b4-45d4-8bc0-99a665d7894f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.105.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddce2ba4-a79b-42a7-90ca-8c5d4c328c3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.106.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f817fc4-8407-4e47-8424-1b985c76f6f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.106.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0426d4f-f0b7-4693-b018-f292e5d17815", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.109.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--321d04ab-be2c-42f1-bcaa-af5d9aa40476", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.110.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eda7cc2-9c80-403a-961d-1c8d2e94803a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.110.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e83b3695-b781-4695-88f4-2d4c809c3731", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.110.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0558d99-eecf-4c7a-b8c7-0d3409e24459", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.112.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--371a64f6-dbb1-420a-a032-062244583daa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.117.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f847200-fa4d-4761-97d1-f37be3889612", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.146.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2d2a9a7-423b-4c17-a582-e63edd79ca85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.96.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffc215af-fc3b-4471-8fbb-c300702ffcb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.97.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33f8ba20-7e03-43d9-a85d-47585b36f5e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.98.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bd210d4-662a-4bad-a8f1-7db54275c660", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.99.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b62b0639-4ff8-4a76-9eab-5f4e4c21ec6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.99.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c84c1797-801b-4f6f-9c13-8c8b7d5f4bc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.99.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73d988bc-e8d5-4877-937c-40b57a672178", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.155.56.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15dd2aed-1e0c-4b67-a78d-19d2c67d72c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.167.25.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f826c67d-0207-4706-9f21-a85d1d7f112d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.172.204.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47509896-b9c8-4942-b2bd-a60f92266026", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.172.219.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50d81869-89a4-4f4c-ae9e-874a21e10173", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.172.250.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5a024ec-ceb5-4313-b487-58d5181d46ec", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.189.24.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cdfbf83-06e3-457a-bc39-73c60d379c7f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.189.27.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c69f65c-05e6-47e9-9b58-58eeefdeb57c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.179.225.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b94cac8-35bf-49ee-8bba-eb7d130c6d60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.209.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa017a09-d6ff-4a10-947e-8e8e66f6e70f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.209.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c0c0bcd-5042-4b86-a5c2-22c6d5bd6f2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.209.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eab9d28c-bdc4-4087-ac9f-c128c5a62eba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d0523d5-8754-4a89-b837-9e214efdb63f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c3c5869-11d5-4f1f-923b-3e9094c4e0db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65d37871-532e-457b-8a7d-c6c960f09208", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f25e56d-c331-4953-a0a3-e1625ed9176c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aff2047-2d61-449f-8251-c1a3f51fb12d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa66a5f3-60a6-4090-af94-1fb427ca2497", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1821c0a9-8705-4224-b50c-d1063237cf7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39ef6f65-9f22-405e-8d7c-3ccd7706cdcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b8b41cc-3361-4a33-995c-5bd3cfb4e83c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d74d58a-7b23-46be-9f26-99cec53b7421", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76b57e32-5824-40bc-b005-1f2f71887a97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b05cf301-af0e-4188-bb37-5197a2625262", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.123.111.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c02e7f5-c695-42ff-a491-8e01b33205bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.123.250.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--631dbd63-5041-46e9-81c3-0638191db5b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.156.142.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36668931-f131-4007-b454-fa67f7ed1aa5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.199.101.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4da2a08-dfc9-4d3d-be9a-ba2001c63d27", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.199.103.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4783321b-9400-4f3f-86b9-260d18c8d795", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.205.211.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6000c6d-6b2c-4e0a-91ab-2af770b5ea6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.205.211.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7293988-7f5c-4525-bca9-969992a2b694", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.224.242.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dc488fe-6b23-461b-a68b-241d3c46b425", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.49.184.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac65eaea-7451-48a8-af30-9c9ccdf2859b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.67.169.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--551fff6c-ae8c-42f6-8630-0fec48d39550", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.94.172.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d56f2483-9f85-4dda-a0f0-4b9c25242eb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '11.1.1.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86558ef8-783e-4cc0-91b2-2b04f8162d70", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.10.176.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55c7cee2-5aab-4c58-bb19-fe3992543549", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.159.7.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e2cdc19-8b7c-45bb-bd9f-d158940d4a96", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.43.37.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28e8967e-3df4-4c37-a837-4f49b2ce2080", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.76.129.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--817dd39e-6d81-452d-a812-4bb5fab2d40d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.10.193.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--158cf9fa-b6fa-4d98-9fa7-b765947316bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.113.89.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35e578d9-40ad-4a5a-94ae-4edfb7748e43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.113.89.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d913cda3-69af-4526-845f-919f58925367", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.113.89.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--441e04ef-f95d-4df4-852c-d5dce7c84a84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.162.146.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15d8ea7f-410f-4e31-b012-c9ecd37efef7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.170.14.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37102bd9-648c-4eb5-92ca-7130ee6991a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.175.88.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c756824a-7e36-4488-ad8e-3e33a5975376", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.198.221.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74d125c4-17bf-4bf9-ab75-77cd066416d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.55.120.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc11eaf8-5c52-4b09-a6b1-7c92cee0ad20", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.68.107.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cea2e7c3-deba-41a0-abce-688771bdc5e3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.68.98.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6553611-9504-4ce2-b490-b4402c5a17ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.90.195.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59dd1237-8f79-4eac-8f4a-cdb2103a26d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.103.142.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f856967-514c-42e3-9cd2-23c1dd8105f2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.105.27.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a73e0282-27f7-4823-9c25-cf899634097b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.132.249.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51c0f7e2-6b8f-4b09-875d-452b61fd9975", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.141.40.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61aceb8f-58cd-4064-980e-4b9da630cb3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.164.37.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7bc875b-c478-479a-b1b2-20a07bcf5146", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.167.72.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28e8e102-ba7f-469e-a028-ad2d122d4584", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.18.182.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcdb6d9d-9858-4b46-9c1e-b984a507d175", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.200.30.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34a48ae4-e9e0-4051-b2d1-9d8f2a3b9580", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.201.180.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07194678-dc02-4f29-b251-948179d4726f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.203.169.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9641d888-4bce-4e50-af98-c1182f20f629", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.203.35.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34e7f42c-51e7-419b-b1ef-015a1c8a6b63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.209.167.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a266f66a-8ea0-402b-8c89-508c766d4629", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.213.111.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af8b631e-b653-4dd3-8910-195406aca659", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.217.188.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd8f65a6-a425-4f8e-bea2-69b4e54243c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.94.191.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae2a3943-b52c-49ef-ae27-13fb7b4011c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.125.55.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f989b3e9-be65-4dce-82da-11a85701a19a", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.128.205.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7324a806-b7fa-407b-bc50-87fd827db154", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.161.39.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7795645-fbea-4ad1-94b0-22d6c17d8f8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.206.131.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87fc4ab5-19e2-4417-ac42-58e336fce484", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.214.18.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b807886-d2e0-4b5e-b2c1-c1d14b1fbafd", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.221.79.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e86654f-e3e0-45b7-a5be-888cd5079ebd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.31.186.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce8e0b80-4caf-4c25-8e24-8c3ccdb3bdbf", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.53.97.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30fa0a19-f01b-4e65-83ca-fd6f286bc182", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.85.70.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b7775ff-8b10-4b93-af34-9994b381f475", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.10.40.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c116e19-7665-4229-927d-ef3b4309d28f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.116.234.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79824125-c13b-4706-921f-cbd1da461610", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.128.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73d964b7-4960-4504-a378-fd7a1208c617", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.129.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91522762-2295-4d61-aa14-5a1dbe6abd3b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.130.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93902353-f588-4cd6-8a81-3f6f13ec6716", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.132.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b700304-be22-4eec-abbe-2d06dfd8b721", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.134.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3ae9361-3e5a-425b-904d-05b5db5520e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.135.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e140bfa3-0836-4402-ab33-f10fa58a0bb7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.136.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de4d32ee-e56e-4e15-a95d-b88471ecc024", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3057d5e7-b8f7-4bc0-834d-d2e86be05129", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--029fe071-c51a-40ec-a2c6-3fb917674c55", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.139.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a490731-bfde-4c28-aa8d-226ca118a7c2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.139.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--577890c9-46cd-46a4-8121-7945103f13ef", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--688a08a4-6229-4db8-bf9c-b8ebbc9a7c3f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03119ed1-83f4-494a-bb5c-221a5651cd0c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.142.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a759267f-567d-40d2-9f80-e8c2e3c120ff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.142.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f09fa327-7dd3-4628-827f-beebd0822f37", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.144.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f671fc8-4ec4-4aeb-ac57-8a98e1396b2c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.144.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b218808b-6f15-4943-8e9d-5e3b1a69b5c0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.145.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f669c7e-eb4d-4497-b7b4-8323e879a99c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.145.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7f5dc91-ecd4-4e3b-842c-070db380bf6c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.145.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f05fc81-d2cb-4160-b675-35b407a65875", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.146.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d8d4086-f7f6-4834-98aa-6c61d7f5e380", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.147.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b9973ae-4ddd-44d6-b9e7-e26898659edc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.148.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--783f344b-7a51-4e0f-9762-9dec230d7686", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.148.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76a91a5f-b358-4bde-bc75-d538c25d26f2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.149.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ebcfce0-f289-46fd-b084-442cc5a0d553", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.149.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b01b1f5-de93-4e06-a304-5eb5468559a8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.150.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74f24e36-55dc-40d0-9fc4-a253a0a2f74b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.150.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92fe6683-d226-4e4b-b3e5-4ab844ff68c4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e63092c-67bd-4972-9cac-277e9770ea27", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--441588b6-0172-4447-93ff-9e22613d5714", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.154.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8691e6c-a3e5-436d-b291-f2dc58f8cd86", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.154.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7645641d-53e3-4e23-9e59-234d312f2a81", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6003d9f8-968b-4e7c-9d68-c14e9018da60", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1e9deeb-681a-4411-8865-6a897eaa3774", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.156.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--850bc9c4-541a-4cb0-b5ab-1c8bc8b37c53", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.157.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21e555f9-a067-4566-8f44-931c63081df3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.158.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8409103f-24e1-4d47-96b0-fa3481506fdd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--219ddd1d-9c55-4e19-b73c-71fb78977952", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60ee1895-647b-46eb-a1c6-7d3c8925a37e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.130.85.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b2e13f6-5ca3-4c89-b6cc-853461a4399e", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.138.105.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b1a1773-af7b-48b8-878b-a9e40a0229b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.216.145.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d202ae95-f201-4241-975a-063c475ffef4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.237.171.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f90c4edc-f5e7-422e-b38b-31ea779ce548", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.35.55.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b7eb04c-b9c4-4fb5-a17f-d279c8cc4536", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.159.151.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bf42ede-9aee-4fa8-a120-870b196c4462", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.179.102.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--121b7114-7e5a-45db-8d1f-cdb26fef66bd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.223.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6d153be-d77b-4814-9b1f-0b8ff2b3c391", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.197.201.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8fd8386-ad2b-46a0-9193-c2bd8ab750e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.203.215.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75317611-1b53-4c51-88f4-9806289a10ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.211.67.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fb9f9a8-b9ac-4606-8bdc-900487686a0c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.212.221.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05129843-2e12-4f82-bc04-a13c279fe7b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.231.78.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f925a1a1-3a54-4477-ae78-23be891f3fe3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.28.77.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8729388-2ddf-4f87-8ded-d1b27684e867", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.91.48.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3d889de-7829-4138-9e18-9d74a5fee6f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.101.68.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6af0d6e-9678-4d54-ac85-f14b80f5e8b0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.110.146.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d402f91a-af9e-4a1e-8c85-9deb2baca70e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.110.148.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2961a74-7664-4695-88c4-571e71b5b101", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.110.151.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--890abdc1-a48e-41a3-a761-3b55c8e771d0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.110.151.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24b66646-5cda-4bdf-bb9f-783c9c7ab844", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.110.217.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d10b41b9-2357-44d7-9792-f575285cb6d8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.120.157.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f855c789-5046-4350-8d7b-8359f43bb1ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.167.202.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b17e091a-4105-4ff4-b88d-a763000271fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.178.128.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00bc4040-ca75-43ef-ab43-706d2242c4de", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70375c9b-fe4f-4124-8c8e-54c838f4fc81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.68.65.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22352aef-3cc3-44c2-88a4-b5d3daf7fe8b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.99.173.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae541ba7-55e4-4b34-8676-61f6c6ac529e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.121.214.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b0febde-4782-4ee7-8641-065c5ece7ef3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.132.5.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--004d9077-d2ae-4b33-bb9d-20f92434a46a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.146.110.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77d3ea1d-a05e-42d8-ae62-8f323bd8faf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.164.191.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e71bdf2-9f5a-481a-ac05-2a4f7c6c2df6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.175.140.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--177e9ee6-3a49-411f-9c63-993c0f5fe614", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.3.63.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a70ed3a4-93d4-407b-9f11-9f95ecde136b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.33.242.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0410dad-ab5f-4747-82bb-530fb6ed727b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.41.181.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c78631d6-bb5e-4196-bde1-893d5474b89f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.50.175.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a2e21b5-dde3-4e3f-8a03-2137efe7e2a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.50.47.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd6a171a-3cc0-423c-88cf-ece7e5dc970e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.6.44.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b3604c2-4267-45c4-91bd-6f33edd8f99a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.72.63.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b055245-3b07-4f33-921b-d89f35572e8d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.80.226.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0abc0ef8-d87c-4b78-8438-bfbbcf43c7af", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.163.132.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14d0d449-e1ce-4a28-a1b9-f5414b5416cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.32.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76e66fdb-eb62-4969-b46d-1112c76b5b8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.33.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93053910-2b08-4482-b39c-5d1c9149e80c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.36.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28b3be78-3e7c-40ba-86ac-e9d4678c4aee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.36.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--879a8d9c-4e02-444a-a46e-0384ee2af743", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.36.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f75d19da-df6d-4d7a-ba96-18a3f46af8f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.38.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba3f0033-70a0-45ec-a5c5-b99bb66898bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.39.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a73c029-d45d-4e84-b196-6b0f261c7943", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.43.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f7b1cd1-ab3e-4f1c-9f1f-4b19c98f644c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.43.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--392ce689-324f-485b-a290-d06047ab39e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.44.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5beebfe-f56e-413b-bc15-25e32009f547", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.45.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ad15b89-e390-4e72-a797-491d9bfbe71f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.47.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75d3c2e1-e6a8-48d7-a21b-2ff5b1fc43f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dfd5ccd-c79c-46ef-9ab5-d4f4552f28be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--704dd470-8977-489e-85fe-d31940bb8575", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de98d8a4-1041-4efc-9458-6dd6b08684cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ae90e94-a34b-4a91-ac44-328359a59826", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--874e9866-3641-4e60-937e-421fa95d9560", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9609bc0b-d05a-44ae-bae0-292458ad3e98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5d84771-fec6-4f1f-b72c-b9e1cb7b83fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69171529-e13c-4544-bd91-3818c648d20c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.58.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0146d8c-d03b-4967-8249-7f3e4f085ffd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9e61cca-7a47-406a-93cc-627bab7cfcdc", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0ad94ba-b931-478b-a46b-9ff9290c08d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28d86f35-6f13-4bfb-94bf-dc305a3e1956", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.61.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d44f5ba4-07d1-4934-9aea-a619f0dc38ba", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.61.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c878a448-2938-481b-8612-bddc7a2e4d12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.64.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4db05c48-6e5f-4089-ac18-a8e52e2a48a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.64.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcf5f875-78df-4f85-9f6e-54889ecad427", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.65.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5baadbb-444a-473d-9025-fa22cf28b59c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.68.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eee04b2-c460-4ac0-b6b2-29c4c4d24e3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.69.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--005e246b-2385-4c6b-a20e-68f440c50683", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.72.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a2ac4d1-d02d-4078-9f8b-8b54f2f6dab7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.77.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b9e8c25-4125-44c6-ae62-46fa9233b8ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.233.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--292e2c46-5203-4dc3-9d77-4a722eb62fea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.234.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12b9bc09-2241-47db-8571-f113aefee0b0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.234.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b3710a8-3e03-4638-af0b-d8107dc6c91e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.235.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1805e6c8-09ab-441c-96f4-00a0f73a3b6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.236.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2461ab5-5244-4eb3-880d-5e9abef6b530", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.248.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a209e3e3-a0e2-4285-9174-870fb3d69164", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.249.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9aebc588-3398-44f9-8921-9e618be93775", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.249.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--277d9812-e547-4dcb-a004-0cc557530bd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb6f941d-f78b-49b6-8acb-d7f42061586e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bc21c10-0068-4cd7-8634-b6eed9ba29b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b808432-0787-4481-bdf4-cef33fd5c954", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1962c0ab-4707-419b-a036-114ba6dc3c63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--273a9653-baea-4ee7-836a-3021ab1e16d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65c240cd-3a47-4134-bd39-93ce38e25777", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c768aa9-fa6a-46af-b385-fa0e7113ac89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.196.103.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36190dc9-0b25-4a23-a6ab-3acc97912527", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.196.118.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3f3ef5e-42ae-4230-a78f-4a035b3be7a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.196.16.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2474b06f-efb2-4824-a3fd-f5ee2aa4dc09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.212.120.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--611222df-619f-4d86-b2eb-67cb0e457de4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.216.88.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ed1e324-b6af-42e0-b9e4-881c547a6b35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.243.92.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ffbfca1-1c3c-4806-8184-aa6f55743de7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.104.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a08b3beb-3cc6-4ff3-afe8-7b8f3f77dcb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf32dcfb-1a2c-4e33-8631-ba323a52f2cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16ca4510-0a58-4e64-bc4c-33b14667e9ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7ffb125-333d-4f98-bc57-c4819791b88b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.109.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83295ebd-366e-4e53-8ffb-ad349d6cbec4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.39.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c9bdd79-2364-4154-9fdc-0a897885164f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.31.222.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e65aa2c3-2de7-49b1-a0a3-42a9ae58affc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.36.136.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb03113f-bd71-442e-a7a4-a8aa0b437af2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.41.137.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f7569d5-1c74-4a37-9ead-29a337ffc925", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.89.49.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73b0a3db-9f93-4f0b-b940-008c6328d966", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.156.194.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbe1a823-897d-4228-a894-2fae9ae1029f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.17.222.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73410ba9-e5d6-4eea-9c6a-3392fff665ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.18.2.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73e1b378-0e0d-452d-963c-4791d19b39bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.204.233.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afc07d91-1478-404e-8513-d385198d6a41", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.246.15.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e548794d-8c96-4583-a2fa-34afce0d029b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.255.245.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36b59f80-a1bd-478c-b590-f55168d24bfc", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.45.248.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7b05a7f-31a3-4397-9258-8fb86b57fcac", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.91.36.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef16609a-0e80-4915-9e81-80f2402a4710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.94.116.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca7694b4-a5c1-4369-ac10-779bdfa99d0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.96.23.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f667906-5219-4ecd-95f1-794b86b06f28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.99.164.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c9882af-7217-4385-9dec-6e173b5cf72f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.99.249.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fd17c22-b6e3-47df-bc21-73c6864e99cd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.157.223.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6de7c0fc-628a-450d-8dfd-d136f57aa25d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.196.66.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abbb28fb-3552-4067-bb88-9477cab90499", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.24.230.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cb6f322-2c92-441b-baae-809d9529a3b1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.240.236.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df6674ce-cd4a-4b22-850e-b2dd1192296b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.241.79.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23ebecd1-717b-4877-ac38-68078c3f30e5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.28.200.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b7adfc1-db86-4a23-aa4b-cd1837cdb6c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.28.222.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ead3a18-a203-46ec-b99c-0ddf8fff5f68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.111.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--270a0db8-2700-4266-9c76-90c0c3d84f0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.14.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--605890bd-504d-4f7e-b9b2-933564489626", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.140.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24d2d175-002d-460c-9781-b9532458d1e0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.175.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94c1f9f8-7719-4164-910e-4de971fbeed5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.75.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b92e983-e5ea-4ddf-9065-b358ac525d33", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.52.12.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6309f2e-676a-40e3-ba4b-00df920321f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.77.224.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb022edc-7400-4614-a464-55b8b8d94d2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.101.130.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--235b829d-b6b7-4e04-a2cc-f954ad808d9a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.122.119.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e539114-3f31-4eab-ad90-bc299a43b68f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.144.36.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--188bc0b5-c7ea-425b-bd13-efd94260dbae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.167.15.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e23d86fd-d1c8-4575-8d3c-a8f4d50386e1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.168.139.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a34e9ce5-a6d1-4658-9019-3596ac1f8b62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.171.125.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9beaddb-c754-4e63-b154-c2e6221f638c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.204.171.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a23fd9d-d8bc-4aa8-ab05-449a89f7fbf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.227.31.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99171642-f254-498b-b7ff-52a062e1adc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.29.149.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1687e74-598a-4cca-81d7-2dfeb0c7d43f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.29.149.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05da7b37-a0ad-423c-9e0b-7eed3e2031d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.29.4.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--530bd894-8018-4914-ae44-ea6ad1f0cdb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.29.84.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--323b348e-2044-46a0-a5ea-bf042af4cddc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.40.50.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d26a208-1b36-4772-a630-24543445a031", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.52.147.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--123fc972-0559-4f22-9de2-e8dc5750eabd", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.61.163.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6efad58-eb43-4bc5-91f8-cd62b20ecf59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.114.12.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbb73a75-23e5-41b1-96c9-2f80bff18097", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.114.8.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b94a57a-fa4e-4e48-9d7c-2e7969a33873", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.116.23.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b66f6a0-6826-447c-b70b-1a423025772e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.2.124.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dc845f5-935a-4d1e-a362-5fbfe7103c83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.52.26.0']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d19e0b79-b4e6-4942-9217-07aa78f27aeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.96.28.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0377e1a-8821-4edb-b998-0e6f9fc2f4d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.96.28.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5065c92e-656d-44c0-a8af-fbdfba46777d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.96.28.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e83a720d-da33-4640-a0e4-bc724e96b576", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.138.72.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de17a8a2-6302-40f5-b88b-7b5ca83844f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.14.122.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4d3ae94-6574-4218-995f-a2f414123ab3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.145.17.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17c35054-2bb9-441f-baad-e05104238a03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.178.210.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f53b0ced-544b-4659-983b-f4a09d9cf57a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.180.182.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7142cee9-0f18-4f86-83cb-b3f870194935", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.191.138.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8f61fe3-c01b-4cf5-8fed-742090db882f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.204.25.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db6bf9d3-fc6d-4bf5-8b20-7481d52c108e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.245.84.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e859fee4-e68b-42d9-9ddc-cff478222063", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.253.162.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0016491e-0cb7-4cf0-b306-713af4ec1917", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.26.131.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c313e7df-5550-4919-a578-a9fe5709547c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.200.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54425465-585f-41e7-ba06-2a48bfc87c59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.205.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aa61620-1046-45c5-95b6-dcc34f115010", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.207.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d0ca7ca-016a-4d43-852b-8aa1ba599ff6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.207.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c51b942-ac6e-44e2-a960-0082ba1cac15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.207.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fc7d9dc-87dd-4064-b78d-92778d289964", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.207.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--135fde3d-dcfa-418a-ae13-642d5d3094c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.213.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a7bc3f5-c173-4455-84ec-58475a5d5c08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.213.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18e2505e-09c1-40c3-b085-e375c41c16b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.13.31.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5767e769-7a07-4c3f-939d-2bce6aeddc9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.198.131.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5faafcf7-bd2d-4da1-8c70-500ea7d80d06", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.217.123.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f57231c-62f6-4222-a7e9-ae4f61a61c2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.253.192.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc116c6b-ad3d-47d5-bf00-dcfa754c49bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.29.226.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db238649-e4bc-49b9-859f-1eb38d90aa9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.6.142.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b823d12-21e9-4578-aabd-eef3c07b71d8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.90.48.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb059f2f-0518-4aff-a1fc-a446d3937cef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.119.6.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e955ece9-e48f-49e1-a5cd-da9c61f07ed1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.124.21.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d607f1fe-f55a-4a4f-afed-ca3953779797", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.16.27.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c15c1a23-9306-407c-bc08-53c503ceb005", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.166.18.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce286532-258e-46a1-ab5c-affb5ad0e2ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.22.162.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--176462f8-c7f5-42e4-8680-845db0a0481a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.234.228.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff29db37-558f-41ac-ac5b-2a1bbdbcf157", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.247.116.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d6526e7-1a65-4061-91e5-2349b4129055", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.31.2.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b78a3ac-840e-4e0c-afd2-3ee8b6d004b1", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.34.86.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1837d5d-83a5-4b79-87d0-cc1b93342039", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '127.0.0.1']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30530551-fd4d-4b52-8368-538ff9be9317", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.1.34.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a8d4f29-fe3f-4280-b0cb-98cfa662daab", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.225.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8267ba4-637e-4db8-bcb9-08d04f828f89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.226.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ec6b33c-6f7d-41d8-908f-c70d438ce1b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.227.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68dcc4f0-bbe6-4ddc-ba33-aaa869a700a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.229.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e447463e-ed3d-48af-80af-cd0d3306fb84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.232.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa443227-92db-4c61-bc3b-6859b79e7480", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.233.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5de5fb19-a237-4ac3-93f5-e6180dba9782", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.237.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efcb7a75-54b6-4cf5-88a6-20518f231e67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.237.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b4a9356-5d1b-4dfd-8034-9c63e67b472a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.237.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7780a6b5-8659-492b-b3c8-67cdbfbe875b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.239.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b3717bd-7110-488e-9a4f-723806e1c19f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.239.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adc20e1f-1678-49d2-bf22-71253e88419a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.199.225.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fc121a8-d5f1-463b-a8e8-d2237b3ca7ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.199.255.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e0fe587-cee3-46c5-a041-f1d4afd36acc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.200.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fe28ce4-cb8b-4dd7-9eb8-6628d54119de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.200.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49a093c8-c2f4-4cd3-8294-4c86e42a4531", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.201.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64a1fc87-200b-44c0-be0d-d898ed026ac7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.203.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93c38c29-5960-49bd-8441-a8fd82d956bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.203.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--986360fe-27ba-48ee-9f99-d1dfd130b075", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.204.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cb988bf-f5ea-4eff-baca-0d4d1502fb2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.204.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af77817d-c45b-4603-a286-67f187ca7322", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.212.184.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--242f31ef-b41c-4bb6-9a9c-917acfdef316", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.213.117.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a94e8603-f660-4481-9349-66982db9e506", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.224.206.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ce641eb-9483-4531-91c0-8b90ce2178b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.226.174.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78a5f248-a2b3-4d9e-940c-88800672fb25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.218.22.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a751f452-7642-4722-b339-ce31184daa42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.220.49.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a616b904-11b4-424f-ad8b-79cd03da9e94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.221.95.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86a46123-5381-48d8-b19d-0d8b63ae6135", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.115.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fefd901-3f74-4d9e-9d73-4acba0d732f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.116.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b489b84-81a1-4709-9f18-dc2bdb96ddbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.124.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a858e9d-caaf-45dd-a928-aa19e113e329", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33f78a3a-3a43-40c7-802f-a782531d5c0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b578111-3f4b-4ad4-9c66-a2a3f50ef1d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.0.11.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b148cc1-ae8a-4d7d-ac52-37a32ef20307", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--722b29cc-9ffb-4a68-bb69-05b0381750ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4081938b-e183-43fd-9f13-9f08ce7b8bae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae390d28-3ac6-474a-bc5f-ac2e3c727184", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.131.162.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--271fbb85-b0f3-4d2e-8a2c-6ada7846129e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.131.162.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9432d218-3fcd-4f7f-aba0-4eefdd1cfd0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.131.163.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a959fb56-9217-46e9-ab8a-20ff9bafacc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.0.191.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3ef17f6-1435-4bb0-9218-0ede07c4324f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.108.143.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50e5b59d-e796-455e-bf7f-be3ce1daf484", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.108.143.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2e646cf-caaf-4867-a678-d7b426529c53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.108.143.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4870cf2e-bd54-4677-b175-a035c0d79719", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.159.24.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b5e883d-0e90-448f-8861-302eb48ef105", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.161.249.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39e2496f-822f-4735-a35d-6edd5fe52962", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.196.14.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a38be4c-5aa4-4310-9d17-d29bb1b369b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.196.246.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cfc7410-4ceb-47ea-ba3d-305b7f698aa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.221.162.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7ccf416-0ee0-40e7-ad2c-e233ec5e154e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.222.252.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fde379ac-baf4-40ea-a0ab-461f689b423e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.222.253.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac2d29d6-13ce-4198-b60f-60d5504bb710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.72.89.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63231864-fd8c-48c8-bb17-6a291a06765c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '132.255.24.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33118a62-ded4-437c-9ce6-5dddc157fbb3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '133.18.122.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--837f4bb7-e3c5-4497-89be-3559f0a20e4e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '133.18.161.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3ae6ffb-73bb-4274-bdcc-39e851a7b823", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '133.242.172.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b4ef746-fd06-4b0c-9f65-76b3cbc478b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.110.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2758060-7617-4680-ac8b-c65ffc2902eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.125.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfebb531-6e5f-4f69-8a7d-8ff7100e71a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.132.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daef13c3-c88e-4e28-91e1-298497768a4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.19.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b97194b2-b5b8-4df0-a7b4-b7a4aa00e160", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.28.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5578b04-9a2f-4a6e-8a05-c4be44f9f32a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.40.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc7434aa-41b3-4eb9-b1d4-dc0c685c5448", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.47.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59dfa133-6a77-4270-8b6f-36186ae19ecd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.74.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e55c018-cf98-4f26-8366-b350aed3fa78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.155.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fb5477c-25e9-4ed2-b6c4-8e5ef3734f75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.122.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0de103d-52ec-4020-9e7d-9fceb6186fb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.145.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9810eda-591f-4a64-9beb-ec89f2e7e609", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.155.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5cd8667-2f91-4b23-a57e-df0056af2d41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.164.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e39d276-6500-4a40-a282-b4f660b1ca07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.195.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29b3d3b7-07dc-40db-9b4e-1a8df3036cd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.200.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0233e5a8-bc82-4362-ae54-5bf742f95788", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.215.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd9fb550-2676-40dd-a5a8-c7a57228b51f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.220.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc2d0837-b489-4a31-8eac-805781c02c19", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.41.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaaedc76-38ae-49ea-87b4-db42cd5c0645", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.64.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fab5a2d-c456-45f6-b906-356b0296eaa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.97.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20d8c1b5-e8fc-4e19-9bd9-fe124ac36d98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.104.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a48236ea-8aad-4a30-9999-54af6b6d09a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.112.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dce28ac-421d-4084-858f-149af9f57161", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.112.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04e25f67-ac52-4863-b953-f4a9106b8cf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.112.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36396d20-8cfb-4d85-9501-a070ce83dd42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.88.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1e2e833-897f-4c83-b692-67dc0b21d592", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.89.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--806b0728-a927-4d11-b491-b8146087599a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.96.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf919c49-b867-4dee-9474-d6d2d49eebde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.97.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2072c9d-8afa-4606-8d61-4c0965cd36c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.222.40.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e10b809-10a9-4288-a1f8-d37780b91758", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.233.112.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40c9fc9c-4087-4a9e-8cd7-244b9b6d0fc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.233.112.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4101afac-cef6-4046-82f6-3354bb052007", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.235.138.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29f8179b-a7cd-422d-9977-9dbfc36f8253", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.121.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--088b923e-84f0-4b57-bbcb-1a318527e384", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.122.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f56ba66-42b7-4a3a-9e6d-f2d15e14f6f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.123.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf25062e-bf8b-499e-9015-e4db7114edf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.124.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58572f76-0064-45b3-bf81-70eba4906c50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.124.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cc03f51-68d4-488f-9a7d-c5b8d08830c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9943b363-d062-431f-b1a7-11d39faf58da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb59b242-2e24-40b5-9256-3d5f7993060c", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ad11965-02fd-4ac8-944d-005fe33f547a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca759a33-acfe-4504-b26f-553398f13247", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57d7eeb7-1ad1-4440-836c-259ad5995070", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68d08bba-10f8-437e-a20b-4cf92ce7f3a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d76749d-98ff-4d0f-a309-b6ae345a18ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff052259-cb25-4027-add6-08022c0b3f69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8b670ea-deeb-40b1-ac4d-151d76b7425e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5435f829-a12a-4969-a3c1-ae522b4b7229", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--750ec737-e559-4e11-a955-073110aac611", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7879c28e-6830-46b7-8faa-55c17cc458f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9c59d99-c5e6-4f03-8db0-1a1f51dc9bf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e76262ad-00fd-41af-ac23-ba39db287de8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52704714-3baa-46b1-bce0-37087d26e613", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70dec8d2-1fe6-4881-84e5-42fcbc15bcee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fc22889-d7fd-4a5a-86ec-d8f1e1151697", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c47c5f5e-8dc7-4013-8faf-6b2f617ee4d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71412eb9-ac8c-4bdc-b2b2-f94f610ec5ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.107.213.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86123186-7f16-4c7a-967f-95aa7a7d69a2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.143.250.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02b77c47-f4c6-4e9e-8890-538ccadccdac", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.144.206.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--607b40ad-46eb-42fd-9fa8-e76e06dba581", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.144.42.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cf78878-b9fc-4283-82d5-95620a132575", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.232.11.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9366731a-c8c0-4c98-9f5b-8cb6725799ae", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.248.247.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81b7dab7-1931-4547-8638-2de22052dc97", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.131.154.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d7e553b-dbbc-4e93-b43d-cbe6a4bd7485", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.135.210.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3584089-21e6-4b98-b242-2693eedb282d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.105.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad7d75c4-75ac-4aea-8044-e3cfb6adf276", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.172.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d49e6f0-afb5-4ffa-bd2d-1f46d5253404", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.197.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7639949b-d875-4815-a691-108aeeaced30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.226.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--258059d6-1cfc-4646-902e-833d44c3dc0f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.227.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ca05cef-f520-4e44-8624-73ae4e927396", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.36.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd3f0ce7-c810-4f8b-8267-b3289424faee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.50.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e222d7fa-84fb-4e5b-8fc8-9e44e05b16dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.85.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cd3be0a-e866-4043-a9e9-3e24b8b1c094", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.90.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdb7550a-59d5-4f16-82b3-75333c0c4d2f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.226.113.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07436092-640c-4cd0-b83e-2e313cf87b74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.59.230.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6467690-37b8-42c6-8aef-0384d3432767", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.117.7.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b25de97f-9a41-4faf-9f45-b09e06bb426f", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.121.105.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7fd21f2-0151-4098-b952-041283af516c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.121.105.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f053a89e-8465-4f34-a392-55e581579c2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.121.113.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff12e4f8-fb3d-4a98-943b-36aeb3c92d5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.121.253.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f534041b-ff91-4816-84bd-be9e491eeda9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.124.73.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86f2b6f0-cb95-4588-92c7-693a92c80063", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.124.85.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--feede521-faca-488a-be16-ba5c63127ce9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.124.99.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b03e1672-07f2-4fb7-b6cc-8ea8faf03a34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.111.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17810069-6e08-4bb5-9217-2ca219c3221b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.123.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--231d2a3e-150f-4310-8280-86dbdfd46700", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.143.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--844cf233-6060-4269-a548-63e0b4f7b117", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.144.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92e7c6a6-aa39-4079-819f-1f2dd2f15367", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.157.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d3bafd0-5736-4923-bbd8-715ee0d4da4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.16.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2aaa6ab8-cf94-41c6-b24d-fd75b0ca051d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.191.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17da28e1-d765-4f6d-8211-1645dbf59b13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.24.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0df3d54-c42e-4032-ae52-d439fb0095ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.31.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e3e9e6d-125c-4726-bc58-bb24e95e2cf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.201.138.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ad3d36e-c058-4e4d-8765-c0b0de82bf68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.204.140.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82927890-1e6e-462b-b967-9b9acda764af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.204.187.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ef88682-ea0e-43f8-839a-da8af346782e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.204.189.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27221075-d346-4bb2-bf7b-0518364b01f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.226.239.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7473413-8413-40b7-8d58-c5b894339630", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.226.239.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b130d0d-e4ca-4d9f-86e3-5d6259791175", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.226.239.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--779b252b-499a-4541-8439-07271ea4e64d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.226.239.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--565ac9ca-e308-4dbb-83c5-1bd9bd2a3034", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.226.239.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e839d95-805b-4e89-b8f0-18ecd89d75fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.252.100.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3b2ad9c-0e8a-49ad-a0dd-3d15a3698afe", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.36.215.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f11d842c-a0c2-47fc-b87a-0dd6b03d44c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.59.196.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2309b15-9bfd-4f0a-b826-83413decff26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.133.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14398503-69d9-4bf8-9ffc-b558be85a87a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.134.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb2dd0a8-df04-4f2c-8a22-c28f5ddd6ab9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.145.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5adce7a8-f809-4fc3-a8b2-93fbc6041007", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.16.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e82b754-0e80-4018-a379-1beb68acf6f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.182.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cbb6862-dc58-42de-afbd-46d306708c5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.65.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e18d48b1-ab57-463d-91b6-fb6d62a713be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.82.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63155e93-55ae-4902-9791-265c27cc923f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.9.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a0966ad-cd01-41f3-ab17-6981e97f5f9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.84.45.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be610e8d-e619-4826-a7d3-b786629fba25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.84.66.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab05c86d-a55d-47d9-9450-5360f82b8c03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.97.162.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--477da51e-61fe-44e9-810e-cc88f9a5e82f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.135.60.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8d92a85-4dfa-455b-b0a7-4d3e093efa49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.235.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--425fc872-8bc5-4b3c-8d90-18459b714a31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.239.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbeb7cbe-4be8-485c-9e57-29bad38c0ed4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.239.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91869dae-1ba4-4c61-91e2-d63c4d9b2e2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.239.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47a06901-c973-471f-8711-bf5de83adda1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.113.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e921b4b-ff7b-41a9-9de4-cc8542faee93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.70.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d2e4870-87c8-4613-be35-112f282dcd5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.96.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e4a1c5d-8db1-4819-a2f2-de07c7e0f337", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.255.62.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69b49cd1-8b57-4e11-940d-ff5b446ad467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.173.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff6b0918-c2d1-47da-b4e0-afaddfa77dbe", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.4.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4553c7d2-321d-4747-aaf0-2a34fec42714", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.58.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--395205c5-567a-487b-a1c3-b7612c49d657", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.6.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07f093b6-f145-443d-95c8-79fde0aec6b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.68.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fb6d965-70d7-4788-94c9-59783d03af4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.69.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a9403aa-2a8a-4b8a-95f2-f95f39eb7a00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.94.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--642d9fa7-e360-4db9-9c50-781be6fa403d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.1.107.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48fda2b4-2a69-479c-ad13-f535b81d0601", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.1.16.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--391203a6-45a1-4577-86a0-809b12896712", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.107.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3f767e4-6d9c-46fb-b8fd-722623b9570a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.108.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cea701f-0f72-4f09-b354-543b08212620", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.112.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f46f641e-d235-4a5e-838f-9f0b0749bf54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.112.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e038b15b-5d17-487e-a026-ce92bcbf1787", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.113.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f48c33c8-5c91-4635-9b40-e815616e7f05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.114.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b5732a1-fab4-428b-802f-9a596192d85f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.114.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--939b0b6e-500a-46c8-a10f-ad204f6d5921", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.117.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a09603c-3e9d-4ea9-958b-c0cbbf5d2438", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.118.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce5e7e91-10ab-4e2c-8039-81505a15e507", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.120.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec6bb508-cef3-4469-ad1a-5052e75906e9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.120.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36e6216a-5b14-479a-9a83-aae6555031a9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.122.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--354359cb-78fd-4492-baba-a8df317ca4e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.123.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d29177d8-8be9-44ea-be0d-f72e40aec28e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.127.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15e15dd3-2c3e-4d02-a8d6-b29ca69b45f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.127.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76579e5c-7391-4cc4-943a-0a5f74b448ab", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.127.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87040d64-e0e4-42be-adc2-39a6034f0fd2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.29.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad0dfef2-6a52-42c0-83b9-cf842ecda4d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.41.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2a34a5a-34d2-47e4-a0ab-eb54876bdf0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.55.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3545f75b-b07b-48fc-8d19-6239104d6d05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.98.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dadb42d-9e6f-4e77-a88b-551ee49db359", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.104.168.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a0260fb-abb0-4028-b48d-f7f7035d9369", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.174.81.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a9ad6ae-72eb-4545-b3e5-a253bf675c93", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.177.234.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--083e3f36-d688-4fa1-abf5-7565efe0c3f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.18.122.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e489fc2-d9f7-4a9e-b887-39bc6f4a9ac0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.29.214.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dc59bb8-4861-4b15-a111-5362bae8dbf4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.34.157.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47fd2f22-2f20-49d6-b435-277124aa50af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.52.46.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc0eef7b-7b63-4a8d-bc54-e08822be5f8a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.106.25.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--253c48e5-b88b-49b3-a61e-66adb556ae6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.233.190.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99546d43-c653-4a96-8da3-d7d19fc19c1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.233.190.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4731af7-ac5c-4153-9090-73d8a512c73e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.147.36.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39340307-7441-42e8-a574-5c0158a0b711", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.150.58.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e93e853-add7-4cbc-b054-8a160a103ec0", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.226.93.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2da2e46f-1d0d-4084-be82-becb6f114f09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.98.11.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1982165e-f3b7-4b91-b05b-bb6fbdcf6f26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.98.83.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f9bbcd8-b3d8-49cd-90b8-5732ae3e9282", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.126.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5d042ff-7ef0-4122-b0b9-beef596dafa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.160.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--332a392d-0160-4f8d-ad71-6f5cfa737f36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.192.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84d100dc-909d-48bd-88a4-3e24a05b5f16", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.200.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4befa197-6467-4550-9097-242849b652c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.225.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11c722cd-6044-4ab1-b35a-46466e8e559e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.251.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1549ceed-e8e9-4548-a3b5-bc88141ca4d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.255.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9c7db71-6bc3-46cb-bfc5-33885ada6ac3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.34.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9efc08ea-7b3e-400f-b595-87ec5526d6e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.57.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94d6b19a-8354-4759-aa10-c235db580c7b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.105.29.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2fbaa88-7706-471c-bb82-d46cc806dd31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.201.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--450a7938-59b1-4a73-8856-f75c2fc9afa0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.218.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a563df05-581f-4975-a883-04550832ce00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.218.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d13a9d3c-97cf-41c5-aeff-1e118ffd4f31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.108.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--471f859c-ed53-404f-b147-9977b3983242", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.110.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a1752c9-f447-4a0f-8754-04fd42c51d06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.59.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6694ca48-b5fc-4595-8527-cf82d740678c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.75.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--554f2618-7ccd-4d17-9855-bd30518cef20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.202.5.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0cd1dbe-2d2b-4578-a46f-b5b206a3fb36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.165.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85449344-fd10-4f87-8339-704ce47db08f", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.182.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62572f88-7aba-467c-898d-c75f03c62954", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.49.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e00a57d1-80d6-48fe-a67f-352d484e1715", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.0.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30b3218d-f6e5-4472-a67e-453a2a2e3bb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.0.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9556f830-e14d-49ce-a3e9-45e92070921a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f20555ea-330c-4df5-af1d-a4bda24772fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04b27191-3812-4564-8e50-c8d18883c251", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2656ba3b-820b-4c3c-ae11-ae7a5a7f20f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8deb57a1-999a-43e2-869c-173302de71e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d50849d3-9613-4cd0-bd99-3448ef5581d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1773dc9-667a-4fe2-a814-f17ebc5b07c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adafb658-b9ec-4d92-bd44-788ed3d3837c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1297b15-1f48-4d92-b0f2-25465b1a5a70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a5b3e16-d0a4-4f1c-819a-cfe2afa3fdb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35794398-6d7c-45e2-988b-40b9b3588001", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bd465ee-886b-474f-ab0b-2a49b0a1064c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7068eadc-069c-4d5f-8f90-a020c4f98776", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b335e1d6-9c59-4c72-9f2c-1d009be90dab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff4769f0-43c1-4a91-b415-14e54f163f8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f49f59a-f513-4dbf-b1f6-5b8f28a8731f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75605cd9-6244-4731-a3fb-cb8a97a4f7d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fda7a024-5667-4804-b0ca-5e708c2393a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.173.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96d64c6c-e360-4dea-8b83-58d40a5896cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.173.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6264d84e-e89d-4c13-905b-9321ff1a8a28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.123.76.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5af12952-66fe-4b67-9e7d-f75569d12fff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.124.196.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c2e2764-c4b2-4f53-add8-06b0235104e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.126.210.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaedac97-4ae1-4afa-8a07-de5f38e54c9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.172.112.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dea7b9e6-cdff-4f1f-9b93-c3cd676690c6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.2.91.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4654c003-6276-44b1-a8f6-c3491a8ec173", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.202.82.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5254d781-36ac-4347-9b71-2a701f25dd7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.48.132.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d322866-d09f-4aeb-97f0-b3bcebbc9d20", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.48.8.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f6b4005-18bc-42e1-8e53-7ca5da61c7f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.6.131.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f47704a-0732-45a8-8958-01c1e60fd537", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.91.106.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1cd4aed-a174-4641-9306-7a3b54686cb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.113.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f082e2c4-eac6-4d5c-ad7e-f9ac2f95c57f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.153.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beaf234a-2a93-4a2a-bd06-45e2a61be896", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.154.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4df355f-2090-4d11-ad4c-7fa92d7805cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.173.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7067aeb0-1ac3-4f4e-b12a-374450e6d557", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.21.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49286af3-3310-4c9a-b493-8ed164c718d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.222.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae451b66-717c-4f8c-b85b-d84c353f514f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.41.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cb05e18-74f5-4afa-afbb-d4b0596e2eeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.48.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32c6e48b-6612-4da1-8327-5cd0e2367794", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.76.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db7fafb9-1f56-465b-862e-e3e0ab3dbda6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.89.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0bb40cb-ee16-468f-805a-359faf1ce66f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.52.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed13b2a0-5377-46b2-9356-b1ccbdf171ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.52.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf5e0a80-0bc8-464e-8334-869d3dc8eb00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.52.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--177a2b44-6ab1-4c06-a947-29c9c73bcbf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.52.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20673f62-8a95-4eef-9fe3-e391092ab343", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7af0e35c-29fe-4951-bb6c-77338171dadc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1578ecb8-76cc-45eb-b597-2b1c0e561f2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8924e543-f701-43d6-8cce-5471f6e30656", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.241.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ef59a22-c616-4871-b550-ab8d2e4305a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.139.136.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--887360f1-24aa-47d9-be20-108f1463f64d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.134.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db511642-8da8-48dd-83da-a87f6259020d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.151.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c129be62-7d10-48e5-9837-72ea73ebe728", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.156.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bd1a58f-e882-4cfd-a163-fe5fb32fdf34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.174.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6880625a-23ad-45c5-bd29-6430d53b1adf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.186.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--179c8a66-f4e2-4959-9956-73ecae257c40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.186.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c4c0ebb-8ac0-4c05-baae-a66af29b9daa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.195.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80c343ed-ab33-4e74-af01-959a9f2dacb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.202.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca33fe82-89dc-4fd9-9f27-d8caa1f5ad27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cee2d16-dcdc-4ce1-a8fc-8c5a6e12d2f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09247c37-2ce5-4aac-baa3-572c78c93f58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bae62ecf-637d-45f3-81a3-a7d275d70a64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a5bc867-ec05-4dbb-8c47-c911f49a889a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1d85ab6-70c9-412e-82dc-cbe653999809", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a805931-2436-4c9c-a085-d1af26c626ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d947513d-7a3a-4e9a-b97b-294ad992f997", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63a400d0-1b1c-4009-bdd0-08bf1c9945fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7006bf2f-ce8d-435b-9ee9-f7342f906f03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a14dbad-9d82-4b4f-b6bf-142a9c1f6d03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6be89d6f-50e8-4679-84f8-1af43ffa48bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b5c69a2-a7c7-4834-a0aa-4b0ded966864", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a81387d9-5f01-48f5-9041-82f95a772f76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f0d2416-b242-49ee-83ab-78c70f3f12f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05ae92b6-1eb6-4059-9683-2a634448aa0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea8ddc57-b45a-4ed8-990b-750122b90d6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c812af26-19dd-4ab0-9a2d-8a9e7b243e14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--154a532c-8fc3-434e-8842-f72ae881271e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9da3be7c-19bb-44ac-a74a-0f6537afacb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f0f5c4b-cd86-41d0-b5c5-831192a6cbee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--852c7713-65d0-4543-bb8e-ae045d543308", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14718d85-4052-4afe-bc17-15e5421307fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8f2e346-bc0a-460f-9d59-8428e1cbd327", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dbd6f13-1a81-4ec6-9e0f-322d4a380be0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d58a32a3-e6a0-4b2d-993b-833a83b25c85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db797cb2-a679-4af5-94a9-3a356dbea2c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f14c5e0b-0325-4bf7-9ea5-1d45fc82363e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db53f824-ccda-42ac-ba81-ef442cab3bd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9431de44-6817-4737-a518-2f2746e0f18a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f1d479c-7f1e-4866-aaf4-83613b854d0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--956f317a-01e3-4eb5-aa76-bc473ab07d21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8926e103-028d-44c9-816a-39487545ba70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d94514e0-bfe9-4f74-a9b1-6cf31d696056", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d908f393-565b-405d-9460-ad76ab4514f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2303c25-f0bd-44c9-bfa0-94fae9901a91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42fb6f9e-bf14-42c4-8578-a6e230ace9ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65d77598-7ad6-45ad-8c64-a13e3d93d48f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b82ad27a-1a92-4352-8f0d-bdbfca75a23e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2c48f05-1014-4f71-a4a5-4b91b0f3203f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c848962f-2e2d-4a4a-b00a-af10bda9b3b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--536f73f6-0fa0-4e63-bb84-4e6a482fd0fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18b71d12-d61e-4f5e-b949-fc4114f0f823", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77970f57-c2ec-4b1f-8590-1e7be695d77c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be80599e-58b4-4136-9b86-cf43da32b06b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46bd1df1-1146-4778-9ad0-628656a8c56b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--641937fd-386d-4ac8-ac73-462257c07642", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--875fa659-d280-42fe-8ff4-b39020715b6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78cd4ec4-534f-4b01-8c89-027bb9405956", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--685f63be-a764-4b96-a072-494e89eb88ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbb3d077-f369-42a7-86ac-f1bd2d52452b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5e6bd91-cdd8-4243-b98c-f32b2445d3ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a858338b-712c-4d5e-bfb1-b1ad7b92683f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b22005d-1c56-4ca3-ab69-3fc0ed92a66c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28951174-51c7-4692-a733-b9e6e7e81710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7236ace-a994-4fba-948b-2c38b88c6f64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db79ff43-c87f-49b4-9ea6-8e4afc86731e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba023807-5dc3-46f0-863a-022a8a46457f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e907cbf0-2dc5-4b44-9a7d-b6d7a144ad19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--828af379-021d-42cc-9b74-e53bb0471822", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--713042b4-fa5a-4f54-a349-d53f06b6856c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cce7f63-dc14-4195-8792-52e53807c7e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d8a4da8-bbf2-4ac9-aad1-90eff69a1c19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd6a5ac1-84c7-4f29-ba2a-fb4776eaba2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b456d69b-a83b-42bd-90d5-efc328461c81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e0424ba-2a2b-444c-82b3-b43fc496eb0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d2a9ca2-a249-4082-b91b-91ea3b90a8a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d683df83-4dd2-41b2-b818-7116059e0388", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6541e408-4bd8-4075-af18-68fd35549d46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6fd602b-e129-457c-9e8a-0abbb127a3f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0db99872-883b-4d2e-810d-6146573a08d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16d599a4-6237-47cf-843e-6d250962fc86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2203c84-f0aa-4223-933f-dbcca626544e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f17db0e4-a62e-4480-8b11-c8b76e91713b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b9ace05-a013-4de3-b4d5-7e2bbf324e34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6d4fe14-9ce0-41ca-bd82-8388e6b702e2", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c8fe6d0-6df4-4889-9654-f25b33e1245b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--908be48f-e6f3-4690-9a32-32d9b48982e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3db8628-95b5-45ee-a510-d87cb8782a00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f09f8b87-0370-4b35-985b-7798b2383482", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f34637c3-fc7c-4fbe-bdcc-476bb8f3d670", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f57ea21-f7f9-44d2-ad98-95003d0b37bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cc82e6f-a2bd-4585-860d-079b8203b580", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b627f10-9d95-4077-8aa3-4c8fc935e9da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36f80329-ce11-435d-88b6-01ea220e58e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a7d4d5d-fc01-42fb-9d75-37fc21acd17d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ba6aa0c-f077-4e3e-b85c-e1a284477c5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc521fd9-cbb8-431d-815a-3945a82a3982", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d148439-c897-49f8-a93c-621795d3ab43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b492a09e-339b-4306-ac65-8c7011bfb35b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eba41636-af4a-40f3-a397-906fbef14883", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05fc3c1d-7077-47b1-a934-56405aee2305", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a20dd21d-8ea9-4181-8809-c32399e6636c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f42ba25-eb16-4f6b-83e6-ea70e7105033", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37fe5e6b-0a11-4321-beff-eb9c6ab53cad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--426d6ea7-5fab-4cfc-83d7-3d135000cd1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.255']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cf4828e-e076-4ca0-8aeb-29b0e2b9555b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cebf4681-c8ac-4682-a5cd-b01e726ea38a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33bc07e2-ef11-4628-b08f-aae0b88b91df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c86fc59-3f0f-42fa-9b5b-9ac1ec615835", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--190c5d15-7f5b-44fa-952a-0aa129f578db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06b4100e-bb65-471c-84e0-b4f4c6f54750", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd38d8f5-36cf-4cef-9077-d2e0f00abf21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--212c8ad2-d3a8-415b-a45e-93c2e82931de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--540f8faf-591e-40c8-9caa-1f66473ef08f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de097436-8fcd-46eb-bbb3-a71189be5db1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1b7b91f-37ee-4255-8048-65c3d8003a6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cedbc619-ef9d-4de1-bb31-fea989e19ea9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab170aed-e9c8-4413-bc4c-3ba4a8f99d3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc1030bb-2f6e-4207-85f9-d0089eabbc92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c427b872-d26e-438a-9cc5-c6fe76d11524", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e35ef310-cb5b-42d8-894f-b10bb8783b8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d91f91f3-3705-4a1e-b88c-3e142135e50e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--565bf3bb-e7fe-460b-b7bd-edd10bf0fbd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ec9139e-b6c5-4bf5-950d-3d3b2a3ed119", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53c4c874-b64b-48ef-8780-9d7d7699d1f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d35ba709-6eaf-4eda-823e-dbbf347656f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6edd96ed-967e-4456-bf82-5db525a90b5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--889914f2-66ad-4a62-ba6d-e2931e164535", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ece07b6-ca6d-40e9-a27f-ad21cdee95ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee4b1bcf-eb68-436e-9530-550c009c619e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--814a9f88-7cf1-4bfe-a501-52ae0c0aac89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5750aa7-dcef-4d61-9be8-eac65b89d3ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c91287b-5d55-417a-869f-551715a662a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72dc6484-d35e-4b0d-8814-f4db61aefede", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63ae377e-e4fc-4e4b-b051-7c35cfd67b07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4240bde7-7a80-4382-8f29-d4e7e0a7b4c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65ee08d6-4871-4116-be88-2de63e22f280", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4960b84-bf81-4f27-a4d6-91c127dceb37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be7852b1-ccd4-4aeb-b34d-6d662f709235", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d4b4786-3f13-4195-a6de-61957b10931c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9308178-3c60-4c4d-947f-49361e58a0b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8381aad8-853a-446f-932b-41385d00794d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42090a9f-d205-4a62-8e11-e85072a47cf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1641a9b8-8b15-4401-bf97-0a5b6157d1df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b978277a-8f6a-487e-8d26-d6a65abf0abf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f84499a6-0ae9-4c26-868a-61a2b7032d1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b20f795-a119-4803-9ccd-4c0d95802880", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53a76c64-ca5d-4d42-85a3-feb231b37466", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f9b018b-6319-4134-a64b-2ac549f83d4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--079c3543-fc53-461d-af68-36bedc01d530", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6239c46f-57c3-4e87-9cbb-c2ea75caf5eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f654adec-e7d0-4986-af8e-a21793c8ebe6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--788cc74f-fae7-4560-a5f1-b4fc38baf2b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.0']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9138095a-fc89-4555-a85b-c0141e8cdf53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.1']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4403177-447d-42d6-b506-79c541cf524a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f99a04a3-77c1-4c68-ac43-40ff0a0969e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf524f79-06eb-444d-ae6a-e68c530e5e07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46f66be9-84bb-4b8f-9537-89515bc106a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c8c83b4-4306-4366-9006-76df87773028", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fedff35a-ea79-4ccc-bb86-de3d9454f600", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad9c1980-be03-4bd2-93d2-858c4a5fb63f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b09aa26-26f2-46a7-b171-362e852849de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--163a5227-356b-4953-8f6f-76f4782c6418", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--832821e7-4788-4540-90e5-c65f32e7c862", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e39d796-3b9a-4a37-9243-f17533cfe1c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e35ff49-8f13-4cc3-b149-3ad061ab85ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e7d0dc5-0123-45da-b8e0-39139ddee04b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--868fe17d-e7a3-4b9c-a450-24ae748e2366", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec5875aa-0a0f-44dc-ac92-de219d6ac64f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57abd676-340f-4e3f-ac00-79b2f677aecc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b833cea-1ce7-4d34-9bd1-3ae404540559", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--776f9b5d-dc03-47ec-aab2-878601422358", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe34d4fb-3c76-4605-ae08-4f203bb32677", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d9fb330-efb6-4330-b5cc-e537c64f24c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6745d26-f721-45de-a2da-0e0bd2005630", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53c12650-d996-4e8d-8d93-19fa6e503a59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--198dd7ae-0089-483e-99a3-fde8008e29dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--732d46ca-69cd-4e71-b08e-76577e40d795", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50948efd-10c4-437b-9d40-4dbce5ec2483", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6668e647-1d8d-43d8-ab5f-ae52eec1c0e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf4065f3-e8db-432d-b7c4-674e51102daf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d4f1683-9820-4464-92e5-ed16c6ccd173", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88d52020-4c92-4214-bebe-d2371d1d55b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9371a06a-b441-41ec-9a2e-d4708f25556f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc171f07-b598-4fb7-bec1-8906128d4967", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4207950-6e3b-4328-8b33-0569617032df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb4c54ef-ca80-4aa5-bc67-937a3a70139d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01bf2e1b-493c-4e8f-a6b9-949498992577", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--935aafe6-974f-4df0-ba56-65c0ae10f7ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38c8cbb7-c6ff-428b-9252-e650b95ca008", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b45f1817-17cc-4bf5-af5b-6a9f9436e10a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--390b0f76-2ef8-460c-8ec0-6ce0f708d014", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5246d6ed-d598-4d73-8666-90b249dcbb3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0bbf872-c82d-4186-b187-0c4f49e9f6a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d91137c3-a3a7-4af5-86ba-54de0e7df720", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d9df4f0-b806-4da6-9d37-6d9f820c03a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20eedd39-a87f-4b43-8589-6fa72694b537", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--277d7ed9-280d-408f-9c41-dd3e982a9f04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ed8c5e4-727c-420b-8fef-fec91b67d068", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c18c1d26-61ad-4640-8dbe-6976e4bebe9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa643531-b35f-4022-8c13-ad460e09229a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c7dc32d-4a16-4181-a254-334df376fd5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2070f59-94e4-4893-99e2-a3c5ab3c5f86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c0f3d55-0c4e-4374-bd42-ced28ef55828", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b63bfef-31a9-4187-ab10-703209f19792", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de15c807-5f29-486d-9f0d-7acd7a5f7a71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b85bdac-5f21-47dc-9eea-c222289be8e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b78b454-6f2e-41cd-ab8a-3ecb3d89db4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1af58c98-15b4-46b7-a236-f88341ef4151", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e604702a-52b0-4c6c-8818-b0a1f174ae7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3b0310e-af78-492a-8d6a-e35854d3510f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95b972bb-5fa6-4d04-bad0-99829bfe11a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f99ba560-3cc5-47fd-8d5b-178771911c6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfd7e48c-5806-46b1-9606-a92c6d7b5c37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58809f44-8391-4f20-89bc-0129d34b0ea4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0908ec64-ab0c-42b3-a14a-4ed71a04b0c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb4833de-d3ee-49b7-8c67-9f732bf37dc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e00116dd-cef2-46f9-95eb-e2cb061ddacc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f3f1f84-92e0-4ede-93a2-899126e99d72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cb966c2-f653-47cf-bd7a-381b023da3c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc44f7a7-56a0-4d21-ba85-6735c5abab31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d984c76-9d47-4652-912f-452f599261ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41bf9b1b-dd3e-4aa3-bc63-6f1c4207730e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b47bf9a-4125-4502-96f2-c933c36a0d9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bc49d4d-5c05-42fd-8ca1-1533b90bd986", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e1f42da-3314-4f4b-a8e0-b9bdea3bb52d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--288d2263-5130-412e-9ce3-9a882262958b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd56dfbf-0371-4a00-abc9-79e0d5b1ced2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5602cb7b-26bc-446f-bcd6-b20d12e1d981", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65024626-ba00-411c-9d9d-4ceeb067510a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4570b7c6-27c3-45f9-abb2-6afac882b7bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--163d0742-c0ae-449c-a8de-bb0b5e4f8bc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84a74f67-33be-414a-b1a3-1681eac890e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f198c73-35b9-49ec-a71b-ccf981fd5d36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8ef7b8c-469e-44e5-b6bb-15c6180fbfad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d3be856-bb62-4669-9214-0874a77420fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec7b7d8e-eadd-409e-ab99-39d753169947", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3ef5bf0-c562-47c4-97e6-58e4a0334103", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6afd634-8208-417f-a225-7c7255d6f72b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bc64fcd-5ebf-4b9f-88da-9c914f4f4640", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27dcb13d-58a2-4756-afb2-0cfa7c80ba7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a7157be-6679-4c02-9516-4e074bd4b45b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2c22197-65bf-4f94-8ac7-7c78af8ca861", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8024b2c3-a320-43f1-be9c-de7b0bb08efa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5551f427-5e11-4d9a-9186-d5327fa20f84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6729464-2150-490c-91cc-1a9ed75e4c83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--357d4578-8ac3-47ad-a068-934cccf29c59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3d0d416-3da3-4fcc-9610-0b753cd38de7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d42e45a6-758c-4cdc-92ad-e375b78d912f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21a08fe4-4593-41c9-aa01-3e7d1d2f728b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acaf89b0-e474-493c-9569-0d81a1d976cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16c4bc36-aa4e-47d6-9809-dd29bd65442e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebf8bb0f-255b-49c3-ac4f-efd3de649705", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21b36f4c-7d5a-46ff-b55c-ae1554d3c135", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4ee669d-c55d-42cd-bb60-eaa97d35333c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f802666-a337-46dd-8192-4da2eef60792", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0206c423-61c8-41a6-81d2-0522ed5dfc58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbd48d66-deef-49d3-a481-5c373c97f900", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a873699-947b-4502-a3ba-6f2a2f0f7cc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79b033c5-7da8-4305-8ff7-58a7c7e6d438", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ee3e6e7-8cd7-45c6-bd47-c25dc7061033", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.255']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fb66cff-2948-4aa8-ad18-b341dd63a650", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb88e843-a845-4ab5-9a90-12f036a7db45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61b4ce6c-978e-47e3-afc2-d5080eb5e28e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eda3c6f1-f859-43d5-bfa0-b5f64deedd84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7c90f4c-91da-462c-b33a-b2ab78b6af0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c799869a-f006-4b45-a1dd-2507709efcde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f7c1a55-0c93-4273-90f9-41738d91866b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89785c6e-2d7a-4964-a53d-37e1f4fd48b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec5dd500-d161-43eb-970e-1975a7132566", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--367a74d7-28ab-4364-adbb-df7e9ab5d3ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca4d8604-bfaf-4b19-9237-1c9613dc156c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99196b57-bd7a-40bf-b369-adc188f9c6b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7adf976d-4da5-4258-ba11-e7ebc76ee361", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bca5564-c3f0-4c9f-8127-3e0cb24bf717", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--459581a8-d486-4f6f-b3d6-bfc7e8c2b891", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82192680-0ce5-4490-9533-9acad7ef5495", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--965dda86-e982-4ab0-a9db-f638e4d77a60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42ea7a1d-b353-4c46-a0b8-c92516200cdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dc3fe2e-3602-443c-a672-e12fee08521f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0742b67-f2f5-4bc2-9d21-6da67a2088ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc5cb631-3f3f-4a93-b490-56899719a0d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--613a0f60-c862-457e-8a8a-a17ce2910e0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f98ab71f-63d5-4960-8338-b2af5060254f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a916184-5918-4847-a545-7372ea5ee20f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99b64fe6-b182-4325-a1a9-43eddf2fa011", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf083a63-9204-492b-9119-fbb38081395a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ad4c2c2-f020-4935-bd8a-e8b1651bc211", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d06c2b8e-543e-4ec7-8ac2-371773cc747d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15861480-7e73-4570-bdda-f98fe2faa097", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed14bc92-1f74-4b39-b4b9-d243be391e0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53b9f5c4-dd85-4232-a5cf-a2cef5782b0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59030488-4778-4d88-b389-6d634f450903", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d75a82b1-d88b-40bd-8a97-885948d9513b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab9a8b77-711d-42fb-b786-caea24a9510d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad90c776-b11d-431f-a46d-64be502a70ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ecc5514-8baa-4ce4-959e-e0a4c9a1503e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--336a535a-7ed8-4107-b47b-b94f395bfced", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3006886-c574-429f-8e02-67caab60cbbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.236.215.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28f79ab1-9faa-4a13-aefa-4552b3b76e57", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.45.48.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f152d395-36e8-4291-bd53-839733264d41", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.45.50.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bece5ee-ebc7-4d94-8cb1-faffb77889ab", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.50.227.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5fbda37-6e32-4491-9d4c-00ea82a94a42", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.50.231.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c9f8e1c-eb33-4fd8-8fa0-4877f14345ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.56.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69394d46-f207-4dd3-b415-31a1307094e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.56.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d78193cf-1d5f-4a61-a7b6-58f287ecf998", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.227.121.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--966d85e0-52ea-478c-849e-c33b86cce1ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.233.37.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d03dbc4-7cdf-481e-a321-91d41a8c87ff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.251.168.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad9e7e59-17c9-4751-bc3b-e1c5accedfaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.253.35.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33e6ec48-b6c7-478b-9961-cda86dff525e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.255.183.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3ebbacb-da62-4f17-ade1-9cb29b1509a5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.104.26.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c8fa269-f002-4999-9cc7-5582cc11d9b3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.104.77.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c79bff25-5ac4-4223-b628-aada6bdea6d7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.104.77.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--440b1823-d73f-4a9b-9e4c-3751be66e78b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.165.147.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfacf24e-016e-4474-8343-02ecf239679e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.56.38.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccb251e3-b21d-4803-8035-a9ff43da575b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.156.110.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e0f5cb9-3d78-4add-bb0b-c64ca228daf3", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.204.133.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28a5b118-843a-4b25-9334-4b78a887de28", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.204.157.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eddb540-55c8-4db2-b626-639b906b0135", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--104f1e15-ae73-417b-999c-41b4b87b42fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a20cc7e6-795f-4946-bc4c-36c730f3e06a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d7de407-efaf-4043-889a-bbed4268df16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab2ad294-7873-4d15-839a-553d10564d7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89e0280f-2afb-44b6-a523-f67a53f0030a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6271be8-3c03-4d1f-b1dd-29460de66ea4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f764ecac-e154-4491-a49a-53a120a349b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f32138c-9814-49a6-98fe-345b9f292aa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db4f76d5-a8c0-4c7d-8cab-13dc77735dd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a708f1d-10ba-4079-a271-f43aebb9da68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20689cc8-566b-4cbe-87de-ff6e93af9766", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a37f31eb-5c81-4e47-8d80-734bb1e8a479", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d39426de-ccbf-4325-9808-c03ff431f3c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30ea6a53-6379-4638-847b-5dc4be934f84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baaab722-135e-4a1d-9622-07662ada13a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46687be7-ec51-4ad3-998a-21fcd1fdbd51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fff257f-4fb2-4618-91eb-5d86416ce69f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a2dd082-aec9-4d60-9fdb-4e790eb44a82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1911b9df-87cc-403b-8499-ed51bd0d32aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86b8e51a-aff8-4305-9025-96e143a5c44d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3fbaeae-fc96-4f67-9406-7d594d006320", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04ab7da4-ebb5-4bfd-a9bf-ec0cea70264e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42ee5e83-317b-4f2b-b002-7038990a08f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a42eb435-88f5-4fcd-907b-b7bdab397a86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83c6099b-61b2-414f-b058-effcfd0dd036", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--710ffc1f-aa67-40cb-adb9-6130f042879f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c40e58b0-5d2d-422c-8868-79efaa7f4c93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c528a80-b9e0-4c69-998f-956094774b8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66f56174-fe6c-45d5-90e1-5eab5b68eabf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--458a1bff-6f01-4953-af87-8193dfa1c6ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77a9bfb9-a456-4553-8a83-0e66528c6cba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--536b9f9f-e895-429e-b5da-3ba6dacd0122", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c597831-dc21-45c7-bd93-847cac9aafa3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce3ba2e6-8f5c-434a-9d7a-a8141c76da2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe23db11-eb56-4def-b568-33a1deed7ef0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1015b319-ad7c-4b96-b319-d4820c6ea421", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29db27d2-7ce5-49c9-9d88-833a5cbc5919", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.109.247.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a86ef742-0e07-495c-93b1-c5137a7df43b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.136.129.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da8fa878-ca59-46fd-b72d-8ac73e01f6b4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.136.214.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85db7889-de53-4071-912e-50f7b98a61e7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.136.227.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e3643d9-d225-4e6c-836e-d86322a7117b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.221.241.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f1a7fc3-744c-4922-a1bb-c260b7f6adbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.228.105.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--921fdb0c-6482-47c5-9ba7-38d8bca1df43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.228.105.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a51b986-4fbc-42af-9ebb-b878351e560a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.228.105.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0963dfc3-8630-4be1-a7d9-5bfc79d29373", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.141.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f2e1701-ff13-47d7-a24e-7369e269485c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.226.79.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c06cd41-1606-4a46-98a1-663b9d65298a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.240.254.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f31fa05d-d123-4b5c-8dfb-e75de7682c76", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.244.151.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b3549fc-4c71-4d74-84fc-c0c623d1a4aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.244.157.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d97f0cb2-b0d1-45f6-8951-632f1967f11c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.244.245.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--547c9bc7-b5fe-4063-993b-eb4c343b5a82", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.35.227.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99dc64ba-c207-4fa4-b5be-274d50ab1261", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.95.83.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f2d1fed-d675-48ac-affe-1c5a688f265a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.166.113.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14a3416d-63fa-46b6-9337-55efd98af442", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.166.159.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f70931c1-b159-4c25-a7ee-b4927409490d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.170.25.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67434d1f-8a06-4496-8e6c-66aa0f1c59cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.173.19.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab7013f4-a4e8-4bab-9cfa-0408a9f2112a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.173.204.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31014567-b2f5-455e-bcab-b3f59215d61b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.173.3.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9195cf30-dfd1-4811-a1ed-baca3f212bf6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.200.159.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef73aac8-1bfa-44b4-bc4c-565afc3f263d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.237.148.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca0eb70c-e231-4d74-a7a4-5c1a931e1eb0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.244.200.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efe1780a-dd0a-4f36-bf68-a4904e0103cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.245.26.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a80bc27-f8db-491b-9c2c-91f39d59f85a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.128.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5821082-c011-4dcc-9573-28ddd244fa94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.128.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b49a41d-ae9a-4a55-a40f-b97e9b84d167", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.130.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb037201-bcec-4fa3-9d9e-9e55eed185c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.130.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--060c7ebb-b6a7-4118-ac57-c6d5bfb3ec75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.133.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ad3ac8f-7d53-4dc8-8452-1ea7266a1a1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.134.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5d458e3-616b-4e74-b04d-89f710b17e4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.134.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48596d5f-0433-464c-9af4-96faff545bab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.135.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77b623ad-1b9c-457f-9c1a-015aaded946d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.135.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35dda5dc-30b1-494e-953b-417336cde483", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.139.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--335fa0d9-0eac-48d7-af2e-3d70dee1c2e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.139.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16a9b13d-3ebf-4798-a995-b67a036a6ac5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.140.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--832c77a8-48b8-491b-a7f3-f96566bcf4d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.140.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18656967-67a7-4c3e-9714-c5bb6863ae43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcdeb667-c045-4b1b-b5dc-f88b3c25e4b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beec3b05-159e-4711-b5f4-0f554e17b9a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa74bc13-78be-4959-b012-91a31ee080a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33b1f265-05b4-49d4-92a2-6dd55d26d228", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71a7f52c-6106-47c2-ac16-2a05c709ca0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ab0818d-56ca-45fd-b0d2-4801b60a5693", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5684394b-8db5-4cff-a1a1-1a378245c53a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.142.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00969830-d9f6-495e-8de8-7851504c9780", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.142.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c08c17ce-ca59-4ade-9134-055a21acdb83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.146.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f498da9-6b06-49ef-b9b6-f856fae2c6fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.147.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f9fa068-d665-452b-a11d-d6fc644576b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.148.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b80b250-c938-4ed2-89bd-e0094f1d367d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.148.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3a1ad61-1f27-4823-a015-f3b1546de2ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.149.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f799de7-2bbc-442b-9dae-0ad798dc306e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.149.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84efde15-2c49-4b79-9d00-c1a7612cd36a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.149.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d90e5216-447e-4fdd-852b-6b6f683db60f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.150.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f81b5224-bab7-4040-a967-f17d748960e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.150.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b24cc870-46b3-429e-ae75-5f2e89aede83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.151.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9863b9fa-3491-436a-aa33-e38dffb553f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.151.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb0eb927-ce53-49be-9dec-47d2c99ed830", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--776a59e9-4f46-4072-9d1e-114d80bab200", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.157.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d05f61f-7253-403c-8216-c0000309d6e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.157.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c864e60-c7a6-458e-8da8-8c106905bf35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.158.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee1fcfa0-4166-4942-a53b-46df9adc53f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.158.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df6c4acf-86ea-4bcc-8710-482199c34ed2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.159.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2ce31b0-42e7-4cf9-b35b-433670daf04b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.159.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49b318a1-f8b6-4577-a123-ac4d33e609a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.164.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19dfe9df-3d17-4731-a850-f09ae4f9bacd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.168.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--748cda8f-a2f2-458a-b116-216da94bf339", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.169.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5990a8d7-3ba5-4b46-8a03-3c58d6c96505", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.171.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81e510cc-c229-4b59-b191-54a14dcf6a8e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.172.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6be3dfb-1ec2-49a9-9430-148f3dcdec19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.173.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a5860cc-dc3a-41b0-8605-73718358c39f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.174.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c79098f0-06f7-47f5-962c-cbfd51637328", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.180.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--deb3d719-471f-4920-b517-ead7c4d609b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.180.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae1da4b7-4f11-4911-9e40-a7a5a6814794", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cdc2ed6-ba1b-4680-a094-4582bbf1160e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04d8d1d8-3c6c-422e-9762-bb59c0eadb2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff29ecb8-0535-4983-ab93-6b87b1b5457d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f06f239-d025-4a31-b53b-072e6dfcd69e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e21a52ea-38a0-4497-b94a-ac8bfad7f9c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.185.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e129083b-9907-4421-a230-1f728fc0880f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.188.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2956b77f-9153-4a80-b12c-7366b047fc37", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.189.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cba8b70-1bf2-45e4-b0af-6f4736c8f94f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.191.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3218c5cf-1725-453b-9cd3-706da0c3ffcf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.192.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa36114d-a156-4a4d-bda4-390152cb4040", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.197.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd351f70-be7f-4149-b4e6-1c634c218a03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.198.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--835a61d3-959a-431b-8101-015b65f65bbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.199.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--450110e1-fc1a-4a5c-a7df-e08f1cc9f30b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.199.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36c0d05c-ebd5-47a2-9656-06df4dc00548", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.199.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf53cae2-4f35-4fbc-b887-5c84939bb440", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.199.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e7bbc2d-25d0-4695-a903-725a01bad251", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9b26594-fbb1-4de0-8339-965b37fadcb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8d9b348-c21c-4076-a9da-333e42166a00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe40f07f-70db-4906-90f3-c790900c4fda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82551114-aa64-4100-8497-533d24689552", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f41a12ad-aa1a-4eb6-a8ee-4dbe97740b97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1de954c0-7b9f-4478-b007-22793c6265d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--891f3a0d-0de8-4b45-b2c3-36425968a704", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.202.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5798c89-fe33-4cf7-9b87-924d8084c629", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.202.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d20f8c3c-2bfa-48b8-917c-dccc32a1aa45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.203.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce3ddafd-084e-4017-92e3-437c9831f906", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da250b9f-1dce-4479-9eef-56a81320bea7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--123f4787-0c3d-4745-8982-0196708fbc16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d889203c-7b68-4ee6-95c2-98309d124098", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a13bdcb8-636a-457c-b7ee-a85fc113cbec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d31c4ca-a7f3-4289-939d-39104a8f1237", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6491a7ac-e6f6-4df8-869d-b64d55acdf31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0fea909-daab-46a3-afe3-0b7431fe5abe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--123677a7-35e6-4dda-8919-78782682561f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9dd6573-3625-4f04-867b-65d15ffb2709", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90d6b9ca-5d48-4bc2-8362-728ea2ff9ab5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52c53888-08a2-47e3-af2d-ac82a8aff091", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7f51c8d-8aca-4b8b-8a6b-a45e17776594", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3b4dceb-2ed4-46c8-9427-b129068ad7b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62fdf022-ba5a-49b0-bc39-dacd9ff932bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.208.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59c83646-9863-4c11-b3ac-ad9419fdd030", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.208.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--094d3a62-8060-430b-ba5d-dd590c50d41c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.211.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ced0b53b-97ba-45f7-a79b-38e0d0f3ff37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.212.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--741e59b1-332d-4148-8731-a1bfd9fe1d98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.212.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--855ebdab-e5af-43e1-9a34-ba26b3d0c657", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.213.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9bb050c-5a22-491c-862b-7e9a52a15676", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.215.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35cedb85-5bd8-4526-beb4-be57d456241b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.215.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--870e6928-de63-4d11-8e4d-5580df859a7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.215.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eec5975-6cdc-4bdf-8e55-acebc4ae9edb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.216.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a7cd2dd-650c-4946-bced-12dea1309513", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.217.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7165e0bd-f566-48b5-b69f-fd834730eac6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.218.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--659d19ed-0029-496a-8cfc-4855414e7b02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.225.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98374239-b6b6-4e34-b391-d67c16922820", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.226.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fbf88ad-1aa5-4247-a652-84bb2a633c9e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.226.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01091187-21ca-4942-b8e0-8339a93a4500", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.227.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90c16c80-e10a-4593-993d-e0ce9e1073fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.227.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a1282c5-2d87-4837-a34e-f3da4e713223", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.227.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35ffd01a-11bb-45cd-af0e-8979491c0ab1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52b34e4d-ba42-4a37-8cff-ab523b1e06b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.234.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80a19aee-e383-4103-acdf-cfd718d34cfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.234.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f54d1f5-8279-47b7-8a88-90b4e93e3a29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.234.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--febd25e8-44bc-4204-ade7-aeb0219f9f44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6470349f-9020-4949-8375-da66a2831184", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab239498-7182-418d-ad1b-675829775c9e", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a18e017-f771-407e-8f01-4ae5e17892a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf7c5c9e-ff0b-4fc3-8bb8-1fb98c7f754b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.236.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1254d1fb-9ef3-48c7-8cea-b9de5ee970ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.236.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f481fc9e-2224-4f09-ab7e-fd6d4d7c29c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.236.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae7cd847-994a-4ae1-91c9-f40f32a1fdf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.236.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a1d9082-c21a-45fb-b7ad-6efc290c1bfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.239.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54b81768-cfcf-4881-8ba4-286e5e38d480", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.243.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7817b307-4d82-4f1f-9b29-8e2a5f31e1c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.245.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--819c0f5f-30e6-4869-8c1b-64e0620b81c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.245.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7accc57d-c0fa-4455-8b87-6617f786695d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.245.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0732aac5-e8ec-4189-9697-ab7e0c9a3e9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.245.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b9710ac-6d7b-4e95-8197-4a56853880a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.247.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9b28c56-8fe1-43e4-99d7-9671596faa8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.247.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--217b74fc-6452-4425-9f85-0c462e3c48c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.252.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f4a7242-7e0a-405c-b549-e86e18df6d2f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.252.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e39a243-d36e-499c-9138-01885667cc91", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.42.219.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c88c9e87-9b6d-4892-adbc-e2fbd85243df", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.42.240.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f265f94-eea4-4a28-a5c9-90f2acc3013e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.151.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--829eafbf-3d0d-4777-b707-c6a9f2270821", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.191.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fa3115a-fba2-470b-970c-59b6f65d1973", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.22.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54dac539-aed3-4461-b1c3-9e8b50abe280", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.3.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5756e2f2-018e-420c-87b0-e555492dcf87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.58.120.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca937356-ca63-4f64-9813-e5e15eebe4ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.59.120.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5639d81-2684-4555-bb2f-7cd9dd24592a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.59.170.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e15d6107-97ed-43c0-b03a-3dcd7e8fe833", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.67.183.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--920969e3-dd37-49a7-b23a-dd5f83e05489", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.80.240.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0a860ce-f86f-434a-9748-ab0f16eb864b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.0.30.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ea65ecc-0489-42ce-a60f-faed0d342abe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.124.24.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40a66f5f-00c0-4b52-a917-6650b90b15eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.124.35.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--279545c3-e8ef-44fc-98b5-bf18ee2c6227", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.127.182.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b583491c-583b-4183-941e-728b3f7c6492", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.196.53.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75169e12-5bf2-4f07-91c9-92b59a9fe58e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.56.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a56e6d63-3a38-43a2-af2a-e0c06ff8a626", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d250b0d-f29f-4d02-90ef-b1f8fe604cf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a04f614c-0ec0-47ff-a584-132202babc41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50b20b83-0823-42cc-a398-1da3bf1a4b6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27dee566-e37a-4a16-8c74-87cf42b3126b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d58c6e2-5812-4949-848e-ac263869c964", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.205.145.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04cb4b6c-86a1-4645-88b3-dff215f43894", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.211.2.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76ba27ab-95d5-4a24-bd2b-24578415d497", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.57.216.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cd7cdab-7f86-4b52-a02c-157408dfb624", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.196.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af1e99b6-83ea-495a-a48a-d1a8a4b83a6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--014bf4f5-5442-44dd-8ba0-99145751fda6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--816ea8b4-cc1f-4767-a25b-51c92c4bbda4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d6ae7f6-3550-45ff-859f-279e5fbb392e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1041d3b2-8772-44df-a93a-377af93ad7ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--192d91e1-b5c5-4e5b-848b-3a3eb4da2eae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6ae6e87-b0d0-43fe-bc96-fd0a433a42bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f54776b4-dc6f-45b8-bdea-4c040212c12b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01f357de-1211-4d85-b432-665a45aa207d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43d1c74b-e22f-41e5-bea8-f8f278a5b48f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8431d7a6-5413-47d9-b583-eb29bb530686", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50428cba-565b-4e6e-9b81-48a738bbb87a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8309c10-0065-4ff3-b762-950c5e599c5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--455aa472-f5e3-4ebd-aa26-8bd07597489c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d4c19eb-eae9-450d-9e83-a6200a2eed11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75425b42-595e-4a56-8636-da8a7138cf76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c46bb53-437a-4533-8bf1-8254b74e2219", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbf8d8c5-c246-4db9-9342-e755afcbc65d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7de39b8-744d-4074-af41-e1914f897f4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4293ef31-f539-47d7-b32f-81dbe0f112b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2356cd92-b448-45ff-92a0-733a27612407", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ace08e7-3353-411c-b734-de20e0359430", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a161c18-11db-4618-a04c-bd57b08e67ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c446feb7-415f-4fbd-9a5f-64cf80319449", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5d99a54-cea1-48df-8f27-e0fa63342272", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.92.17.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--072791b3-c955-4f41-b140-107c83a1a509", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '155.4.244.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4533102c-ca0e-4d18-bc8d-ad7d0e6d34c8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.146.60.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d05da814-7b7e-418c-848f-597a9dfde8a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.192.0.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efcf7529-2fa5-4231-9bdf-77e034dccec1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.197.64.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2df36a19-71df-4d3e-8239-73867b0581e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.215.55.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06695e87-f6a2-49e5-b8fa-aa25b2917d9b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.227.232.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cacbeced-165e-48a7-8110-0bf0b039b29a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.240.120.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f625540b-3dc5-439c-9ef1-a398d207be33", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.245.205.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--256d3fff-4efd-4b8d-b298-f0e024c3dfbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dcfa712-2e15-4f84-8763-5541a84606e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dd0d268-940f-4966-9116-bf5da2cef9ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59a79601-4094-4750-a75e-2f9fbc1f54e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ab25308-8de4-43ae-a327-fda87d4027e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2335c81a-2a8b-434b-8218-eb1e935a96f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c93cb78e-fa3e-4983-8213-6f8ef8e242c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82ae389e-3852-4ffc-bd1c-a656410ae6f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09a53e28-bfcc-458f-9a4f-c82c160523b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--209b6baa-8684-4bda-a98e-52cff737a184", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17b4bde9-8cd9-40d1-aee3-3e74018117ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcea68b2-bca6-44a1-8d18-c323911be8e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3916a9d8-0ac7-4aee-a045-1b63ac6e3120", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50e30d00-2a3a-4cec-884e-212d200437cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf20ed63-7662-4481-8ecd-a48ba17a4d60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b74e1203-64b4-4742-9379-e8d1f397d5f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5c0d659-8425-4696-8c68-979944f504ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.40.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0828965-7908-4efe-b68f-e0f1a32f2c6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.41.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--797a939d-03e9-4dd5-99e8-24d7051cf40c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.41.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68ce1d92-5ffb-4be6-9dad-ad80c3237756", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.41.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8590c898-cb51-4d2f-bc8e-40fe525ae547", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.41.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b993ade7-01da-4f24-8163-e6dc28838e53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.41.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72fbb53c-20b8-467c-b4c0-5248ffac16f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.41.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b480ed67-71ac-410d-9a6e-0374edec927a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.41.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d3bd8d5-b1b9-4f8e-b7ca-4fbfe4bcd5bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.41.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dde296fd-2221-4652-96a7-04225c9a63c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.41.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--871e5cd0-277e-4c9f-8dee-c9a9cdf94584", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.41.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75090e45-0987-44b7-a7bc-657ab8d2c9e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.41.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cc7f435-2bc3-480c-9b90-1a2a6bb18d41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.41.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2aa17b4b-5734-4e64-b63b-df45ca1de083", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.41.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5134ff28-7049-4094-b126-28683faa7bc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.41.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fe17ac8-53b8-4968-9ed0-5a65607d1bdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--412afb3c-79f1-4967-be9f-b9bce11a41bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--089c3d3f-1410-4de7-81f9-7d757a6f53d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--743910e7-e566-48d2-8ad0-2e149cfbd6bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e08fd4e9-fc83-4dc4-8eff-3b216b515ba4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e17ae327-56a6-47a2-b1fe-2e73128fe105", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--016d12d2-578d-42dc-85d5-1f13b5a33e76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be8d79c8-5bd2-4b18-a214-d845935adef7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44ffc9a0-06c4-4b6c-875b-3c49019eab8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1633f0c-6dec-4943-ac19-9177c7594273", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--948574fc-9a64-40d0-86e6-137e81d37109", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac4c489d-4c6e-4a68-b8a5-642820a1fd27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f27b646-4145-4803-a5c9-728ed55f5775", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ac34879-28cd-4c38-8ce7-4da3d6a283eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3c99995-5ea4-4449-8bdb-5f2c6501bc43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1ce922f-e6af-4ff7-97ac-427371f516f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b530822a-5b13-4720-91ec-18819545563f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de344d2e-aec3-40fd-8081-bffb918b88a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c432350-d6af-4277-aa2d-8c7afc41d561", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--950ebc37-d619-4863-aa1b-c0c13685418c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--861bbecf-53fe-4bdd-adc0-397de69d553d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--994882fc-52e2-4fa4-9776-5dc7d0342979", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.42.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e08c7eed-69a1-43bc-b316-50513b595075", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af1fc26b-0e34-4a12-8b87-c506159a8c18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06ee7929-9435-4715-9581-b6bd58cc76c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec037f58-ad0a-40b3-8e53-690d78ca9d5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--314b3435-b539-45f9-a6a8-1ce0213cbb4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d132743-3f82-4496-bb20-d3bfbad4465d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44c5aa19-3778-4017-9987-c8452362dfe8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6f1365a-d5ef-4c86-a1f2-11ea51f05320", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3031ccff-36c3-4eb2-8702-87b7eda69d09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b490e88-35e0-4c28-b2ac-1820eaf47c2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d26ce0f7-8c5c-4e77-86bf-cd547a5b1d4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbe57307-1e7b-4823-869f-2128cd1e951c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9957b78-eeef-4eb6-9e92-b3e0d04aba6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--defd39bd-4541-4552-aeb6-3c74561aa3ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4b0955f-cc6a-436c-a0b1-cf3b8943648d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48984392-4fc9-4242-ad93-af98d2ca39e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65ca13d0-060e-4d32-a78d-ea4edfcdfabe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0959158-9c85-4db0-b97d-5db0cb379c37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c975211d-2d83-46fb-a1fd-cb49faa0193b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af685c07-ee72-44a7-9a7c-4c24f3793d78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d0e5646-f4f8-4be4-971d-e523e484ef1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aad0f457-ab91-442c-9daf-aa1cc5200e41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25fb6f2b-eec6-46f2-823d-2d9aa169ba99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d53e74a-15fa-49fa-a33e-998a62480aab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a5045c3-6d3b-40c4-9543-9f209fb09a3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c34708da-8896-4743-b0f1-db578e866b4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69c0f4a0-57a1-455d-8826-007bec4630c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.43.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--387f9fe6-0bee-47b2-b7e1-39abd78d4636", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.87.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea84bdd8-704e-4bc2-a2b8-4f44ef776bb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.15.47.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1d47ddf-cc17-4e1e-a3b7-f981830e7f65", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.15.73.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76336abf-af8d-44e6-bf55-5919102bd720", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.180.116.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bbac633-bf30-4ccf-abe5-33e868fa490c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.22.196.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2ff0e4e-c94b-48aa-bfa8-85c9872356f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.109.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca454ea9-57fb-4d7f-a971-e89f80c94339", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.163.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffcc5aca-73c0-45d7-8c77-22a8dfaaacc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.171.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fb42f67-5ca0-439c-b140-1af90b3aec1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.184.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae495675-0d76-4f7d-812e-d4f3355b4238", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.184.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec85a3d8-3c8c-40c3-92a8-2b3a5a6169af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.208.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e45c0276-f4c9-4b5d-8493-28cc73915f2c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.49.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a84f5fc-5375-4cb5-95e2-ec707b9909e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.7.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--972e78f3-8cf3-4553-9dca-68edf40ee3d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.82.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d36c49e1-21c2-48e6-b665-fc9c2708cba5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.105.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--785f844f-a732-4621-9154-5cbaaf02e8e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.13.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a806888-f564-4f82-8079-d40fa76b732e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.161.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68209681-fdf5-4654-b044-794d98f02542", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.181.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4df20f04-c567-410c-b84a-efedf8e5c891", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.211.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5a66e34-c71a-4916-af84-758d4f8ae577", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.219.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b79b47b9-0b6f-4e6e-9106-461f667f4f5b", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.4.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2de170fe-5d65-4e55-9e58-c378b19e7a7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.93.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e06871d-db2c-415c-9a90-ea7471dead17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.50.11.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07f422d8-80c3-47e2-a708-d346b4fbfd3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.50.113.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17eae0cd-e5af-4b7f-a0ba-6f6a436f9c45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.51.229.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5589fad3-6914-4654-bb9b-57f0e1287bdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.85.212.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fcca615-6175-4966-a934-a1f68ee7af67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.85.213.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5ec345c-8506-4502-bb19-5457f0bc8a4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.173.154.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45d868ce-d401-40f3-92ed-cf0c31cf7600", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.178.224.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11380e02-edc7-4c45-b736-077d1c9f4d90", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.180.79.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f9f8b67-add2-4d43-a78d-7eba45e6ea77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.220.109.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78f0af8c-7f19-4f06-bb15-3f6e1cd72423", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.248.6.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60e47849-12c3-4a01-8fe3-3c8bc68c747f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.51.96.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a53745be-1989-400b-8efb-86d939f152b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.146.104.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a0a9840-b8a3-49b6-b409-e381d5d4c2e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.10.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5610079f-f144-4880-bf06-351dbb39c927", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.182.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--597f335c-d466-45bd-a743-044fa9d4c63a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.27.0']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d94c8816-ed23-4b32-86bd-d3a0f218953e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.35.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4592059a-f68f-4767-9e7c-858d3dfb90e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.63.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--067b2459-c097-48c4-bacb-99e5b589213d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.96.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d252a85-fcd4-4070-83ba-76c592ce8668", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.98.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a42d2c2c-caf8-447c-8665-5b7392545ca7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.106.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ac2097c-2afd-46f6-bd3a-eaffe62cf704", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.236.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9ceed77-dea7-4f49-bd64-2fe297eecf27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.29.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab700c28-6b98-48e8-ad65-b611463a8477", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.224.26.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5234af78-0683-429e-882a-5d0bcab22eb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.168.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fde46df-714f-4fc0-b842-ee359d17b7ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.185.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a60dccf9-dac1-42d7-a05b-ca7aff3bc4c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.191.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f1e4e0d-b596-4855-b0ba-8d313ff3e871", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.243.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--756cf85e-0f76-4ec6-b194-4cb4cd77c383", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.8.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dfcb2ec-4914-4164-b583-af2179e14110", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.135.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb9d02d4-9431-42e9-9684-760068fda683", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.225.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3d7fb76-3aa9-4106-ba76-214b770983a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.41.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a002d6d0-e765-45c1-86b6-1d2aab9829a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.47.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8b452f8-cf15-4e5a-8f3b-b332c8b36c1f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.55.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bc988d0-fa8e-4918-8ebb-418a581709f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '16.176.125.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c6f2781-33c0-4909-abf3-088cf1077c8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '16.58.56.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d669ff44-06f5-4083-b5b1-8d48dc83c432", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.69.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--599789e4-2332-49b7-860b-29252217a879", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.71.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8add619d-d64b-4006-997f-132594812443", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.76.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ab28d2d-adfd-445e-a067-c5b33aeea739", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.76.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2438fdba-c983-49ee-ab04-1fc31a8c0443", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.154.74.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--896445df-5291-491f-9567-f495e86fa56c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.176.48.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--119708dc-fb22-40d5-b7ea-7b2ad23689a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.179.201.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efa2860b-a0b9-4c05-b2f5-ddbc277d14e6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.187.240.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20557cf0-9368-4459-8091-ff5f223d8e16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.19.19.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff8ebecc-fbbc-41d8-9de1-008837d00294", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.19.227.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ad7ea6a-50d2-451b-9eac-b9b3f6f72f51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.250.44.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b558323-b9ec-4deb-a88f-02f8d18a2043", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.250.5.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--228f0629-4f9a-46fa-9a55-e133d35b9732", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.30.141.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e439ab4-7afc-4751-9bb3-cf9fb930f33d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.129.70.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb45f0da-aa56-4613-8a0c-b5644d4d4b6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.132.53.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40e7f9cd-7086-4626-ad0c-89d4cb2b6e03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.18.68.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05f7ee52-8c5a-48ae-a05e-9a1fb8a06573", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.33.210.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ca6c3fd-23bd-4e6d-bcd8-33a0f36d7841", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.121.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--902fa465-197f-45b2-894d-6cf53356ba90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.139.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c8853ab-88c4-4032-864c-a7fbfb0c6534", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.160.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ac63513-1c6a-4ef4-9526-7945f86563d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.167.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9735c5d0-ab36-46ef-8288-615a931b3ba0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.186.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c074d7c4-d08a-456c-bcc4-25c704b244b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.212.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b47c26a8-b2a3-4918-804d-76161dd42d95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.214.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63820bb2-e74a-4d0b-9f78-12608a12be9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.52.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51dcb39c-10a2-484c-a246-5d6be465f21a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.82.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91f90123-4f80-4e62-a738-848541f4516f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.49.89.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e65cf6d4-4cbc-4cf1-b256-97be607005ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.81.121.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c3d0e24-7d9d-4b40-ac6d-01dbfb21e2ce", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.19.243.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09b4cd94-cc9c-484b-8bc9-b08bdd22e9f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed3dc805-735e-4ace-8b9b-a2cef5d51715", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c218a3ef-7721-494a-a7cb-51fdc329f507", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5ccadac-3028-4c33-aeb9-4983a6561bfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff4e15f5-9df3-4228-897a-f86ee57a2579", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45e03cbb-8403-43de-b66a-a8c109c21baa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e729786-5add-451e-a92f-8e72f38ac54b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d415f44-1e14-4b9c-be18-ad4a2fcf45f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b519e1bc-1b91-42f2-aa6c-3ba6a19d3a26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8170dd05-0d7c-4b75-bddf-b7bda6625a76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c000e7b-95a8-4796-8363-56b173c4473a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96c45dcf-dd02-4c5d-9c0c-48bde7653ac9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c3baf0c-1012-411e-bfc7-17f606f69beb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2d2f2ba-25e6-4cb0-9caa-70d9b7a68816", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a72c0a6-be31-42b9-93db-ee0f26847dc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae2f2d2d-23c0-4350-bf55-2492b19ac69a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d78fd225-2397-44ba-8b80-3dd52cd43611", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1e24899-d211-4fa8-b6d4-709806200efa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2832ee64-34a7-4e5e-a97d-4935caacb90f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcda363d-2d8b-4ffa-8a91-a2c8a5f4cf59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2bb7b37-76e1-41cc-8680-d27abfe1be6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24d54c9c-3cd4-4474-9ec0-8ae1ad768978", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c470a9b8-1c93-4110-9fd9-fbedb77b53ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b106519-76d8-4c47-a3b5-e48ef2719896", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbb495ac-ada9-4f78-b30c-389d2cafd28b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9895cac8-7855-4d26-b7cc-7eaea9937637", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c425a736-0654-41d0-8890-e679c1a0ce69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8190256f-6101-4a1d-adda-c28f98487d71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98b9b0bd-2538-4d17-b86d-c8bd1718267d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94cc6d6c-04cf-486e-8569-ff16a39b85bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e2bc404-4c59-4afa-9c42-2da15c55e9ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0680e3c3-cdc6-4352-adb0-0e6e56467660", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6838cb7d-f817-40b9-aaa6-f94e7533a3af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5b0fea2-3518-4bf2-b06f-2584f7a6a1ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50208218-e4d9-414f-90f1-02113d46c36b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f76b3333-b54f-41e1-b5f5-30e2e6cfba88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--193d0494-7fa9-476d-9322-cc128cb6ce18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--408dce16-101b-4b3c-b8bb-e3523997369b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab64c720-67f4-4219-9538-175edc0a4f4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ad86ca3-7af9-4569-b9c6-e1f54a0f1902", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e17eb922-556c-48db-8c70-6dbb6a14466d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4df3fe9-677c-4e72-be87-a88c5f5528da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88002725-31e9-45a3-93cc-da22f62524bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54f08e88-9caa-4096-9d8c-c538351d5a57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09db91dc-649e-4c3d-ae15-4b6f89612a90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1151afa7-2224-4428-bd0f-a1df5da622f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--658e0a39-a0ca-4d87-a773-c3d07893e2aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7b853bf-9f47-43c0-90ac-63f3a46e6036", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e050fd3-b7bb-49b3-9061-97bb5930f647", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8e97493-d308-4a22-806b-251bbbd83134", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e032b035-b234-4c75-a5b9-73c2cd662470", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3ab6b81-87b9-4bfa-bfcb-a78a2634f34f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9afc5db-3926-4d50-98b9-cacf646eedb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6aa4aaf0-1e6a-43f3-855b-c79ddbcf4e76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45855844-03db-4ba6-8f66-2ee31f6c84c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2e73e86-62fe-4a78-90f2-8f71a5a150f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b65515d9-2e05-4d0d-be2c-55e9d593b647", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c658db8b-647b-452d-acf9-89e30636ae60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baeae0a2-ec27-44d4-b9e0-f647278f91fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c48798e-482c-4daa-ac67-d53450e22548", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a4dbb7f-c5d2-4704-b5eb-4db593733b47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5b3de02-85f1-4f4b-b6c5-59b63aa745f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b90d30b0-490a-4fcd-9ae5-2386e689c176", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64ceb921-a644-4e6d-825b-a747b16a2e5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21a3422f-4f3b-42eb-85dc-529f051a3dd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd20bfda-73ac-47fa-a142-bc96ea5f7853", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cff1133-3794-44dd-b85c-90f356de7d62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7321517-e677-4ec3-a40e-5a4110f11e8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e178e0c-d798-43ca-ac24-2ef168e87727", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ac848c3-f4f5-4c41-9daf-befa6682ed6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--852dabb2-26cc-4a61-89bb-7bb0599a3c0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--107a269d-b97f-4c4b-bcae-850c5264cbae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b32abfe7-a4bf-46e4-bb1d-b6aedf2d33df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cffd5ce-a33a-4eca-800c-945947cffdc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbd9c6de-397e-4805-837c-a2444b56832a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--668d25e5-e0c4-4cd2-8a3a-dddd7078c0d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b70d8e4d-f9ae-4dcd-bc76-65f2d05148e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29e0df01-721b-4809-bf61-f31aaaf532d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--924820aa-975c-4fcb-a1ed-7654670015b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95574ec0-8b83-4195-8b69-966573444b1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e40ecfc3-5b9f-4777-ad2a-31c2d0c5c888", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60661b8f-67ad-41a8-acc6-01f6b4c5efa3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c69a59a-d891-46b4-8d93-2f02a234d40e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41a1d926-8bc3-477e-a662-9a18f1f4511f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29d2bdaf-dd86-4daa-8b2c-aa76eeaeb73f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--101fd637-a84e-4849-ae03-e73cb90d190d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d32e47e-672e-4cff-98b5-42cb77ff1d80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--686409d4-c04b-489f-a023-014e7106f0a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e940ad7-be1f-45e2-88d9-f700bad1d5e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--382cd728-cac1-4595-8438-4f7e982b958e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bff82027-f887-47d5-a776-b65abc66cfed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05f3886c-528a-4a49-b708-fa8bcdad9ca1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88e1c098-42a4-4cfd-a83c-1f0103f60e15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63ef39f0-a5f0-4b00-903e-562df84c367c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02fcb385-0a70-496c-b1fe-d656100a5f7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60da8402-8904-446f-b8fe-04fcd87cc0fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c699feba-31ee-49e5-ae18-64614a503b70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af4aff95-e35e-4bc4-9e57-fcfd59ee2fd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9799b0f-42d3-47b6-add5-95a4729a70db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a01beead-382d-4152-af22-2e3b8f3ecc7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5648085f-560a-44f3-85cf-85fd32832a6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a91488b-4867-41f9-9c1d-00be9d26c5b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c01c6bf2-57ed-426b-9381-0e15ecae8850", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32f30156-9ed6-429e-8192-0f68bb034681", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68e8e905-f0a7-4a64-acea-ae00a4fd341b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dbfdd41-03cd-43a0-b41d-9334d0783494", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40972746-9b04-486d-b14a-1f06ce87f5ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ed2b964-04bb-48f0-a53d-c3e8f5b90c4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12089b96-681b-421c-bb49-f6efc0d1dcad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04d529fc-0b87-4723-a90b-be0884685be3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d734ca3a-c200-4b6b-bd77-d83cdb96b22a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46c7c459-c1fc-44c5-a608-0653506416ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--535ece95-e861-44db-9195-e15b4c3f9f05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61ba0996-d64d-4dce-be8b-5a41e7ab5aee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e497aeee-9269-4e01-823a-681ebc9ea74d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b21293f-ec1c-42a1-96d1-8997977b6c1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--391faaf5-8c6e-4241-8b97-f880569f1187", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--536f8baa-8bdd-419c-b554-a7a179397c56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a14b848-49ee-42bc-b74b-f08660c7f1e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--081c10b7-d6e2-42ec-a9e5-b696b8992883", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d567317e-e397-4dc5-8210-d573502b613f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2858f65-dd62-4235-9f2c-715e8aee9303", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68c8b581-836a-4c66-bb48-46f2f8cb5c51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f0327a4-a4e2-4589-8719-bcbbe5d9d518", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17b8eb10-0c62-4be2-82d0-5ea96b9089ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2a809b4-11c6-4520-92d0-395e52c3f103", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dfebb24-b72e-43ec-8406-f44142b92124", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--914631ed-9f69-45cb-bc0b-30ff8410d554", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--353fd7fc-c94e-4318-a6a8-864a0a3a8c0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c65cc8f-5bc3-4545-9488-9fe68c21dc81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1771e242-8da2-4fec-b8c9-4d6de9bfa1ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd8a1772-133e-47c0-afd4-f4bac19c99d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23242718-e17a-4f68-95b3-12106b393406", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cb384c2-9be9-4e91-bfd9-ac514e62e2c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b18ecf72-cf98-4691-a44c-3591e582abbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a50536e-e5fa-48b3-a93e-39240a00c7f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8d2bf2d-50ff-40b2-8a43-6a5db3928abb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efbcc61e-2460-4755-9532-fa2050ce28f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36338b7a-b782-458e-9a1d-5b4708d3308b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b89fabf5-9ec8-4cd7-91c3-e122df9e1093", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71ee5260-055d-4ee2-b65d-8abb3629b6ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--462ec585-4293-4e3d-8363-888472e1f117", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b704f0c-b965-448a-837d-add95b790fe1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04989a1d-db5b-40dc-96a6-0a45db82cb84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--710147ae-f586-4fc9-9b08-bc2db29e04ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af15350b-7ce6-4179-93dd-dccfb2345543", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--551ef798-311d-409b-a741-1b0b09bf847d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00cbaa0b-4a28-4a33-9e0b-6ac3ee8d9301", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b369326-5154-4dd6-8a40-2a6b3cd86ec4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c71257f1-b444-41f3-8bbf-03260f8c60a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83942045-d8a8-4ca9-a32e-c4db3630226b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d01c9d3f-643e-48a5-8fff-9bfc38942ed7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be6200f6-6614-4631-ac61-370c0bb0d4f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--030690e4-16fb-4590-b7a2-56494b07d5b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13e710c8-3cae-4fcc-859f-b0511a5eba2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--142542f5-39d3-44aa-918a-a0dfc9bf2cf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7deff233-f019-43f8-b05a-082573b00f0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1059690b-03dd-42c3-9f17-854273fe3e20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6aaa4397-7220-4d4a-bddc-2b1c26087541", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ca415c8-c3ac-4aaf-88a9-d2063da24558", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e79a92b1-cabd-43a3-a2e9-3dbf45451bae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d87e68e-1bda-4d28-b24f-955eb21fb453", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e9bd239-a5b9-47c5-80a8-158b299deb4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f51f695-0e5c-43ab-8d06-8ac667c381a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b612c84-47c1-41ea-a305-73b6218861b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4233f2c-6ee1-44ad-9cf2-cdfd22a8162e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b7b3377-211f-4abb-8980-1eeeb9d1864a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--202e697e-0d4f-4524-9cbf-9df60d5f852e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--198dca25-14e6-4f2c-a13c-6a2e4337d83b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2e1142b-d73c-4dc9-8f2c-8a09787f3bac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a730017a-e7a9-4267-a5d8-86d4d52006cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8c1b7cf-07ea-4b29-a3b6-74ca8ad8bf9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21a1fc94-c20b-40d2-8153-9bcf4a369f1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5ea54ea-ea13-47c6-99a6-d751ce693020", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e486dac8-f695-41b3-8976-8eebb1c44c56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9be742f-aad0-450e-b3f9-d2a8267e0c5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52e1f3b8-c8bc-47e2-bd5f-89d02a817020", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01d94fa8-7a58-453f-a537-f35965162e31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bd96b75-1c1d-47be-80c9-b64dacbcaf81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--410def8c-8c67-4e03-8812-0da523742352", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dc4969a-124f-4a2f-ae22-b5b3b4a15e99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d75e45f-3499-4cf9-9e0e-9efe786b0061", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--903c8506-5663-4a59-b338-5f68eb4b547c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc290d8d-7d77-4302-8272-600ac11abe18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cea2a1e4-0014-443a-be25-dfd81e491d94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c131df03-2087-4aad-b518-7fd16585c134", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cbc4e79-c550-4403-b3df-7bd7ea6f9f7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cf0dfb7-23a1-4eed-9f60-b354ea04319e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38a98cfe-61a7-45dc-b01b-23b5a330c35e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a58baae3-d215-448c-916e-8ea35a75d39d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7bfbe34-39ff-4814-98c0-4a0d9a2e4fa5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de405cd1-f415-44ab-b92d-03e4cae7f6c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd8f6203-7636-4965-8944-a96e30cec8ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ca0eccd-3aef-4b37-a584-95fcd0583890", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5809cf99-fffa-4588-8507-b9541a62fe33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--173de7db-66e2-4033-811f-6e6f8ad83f3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91eca07d-5401-44d5-9b2c-5c67a2b3cbb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9b27e73-9257-4a0c-a4fc-8e8c364cbd9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77285a4c-7543-41a9-b2b7-3e35b72571a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da9f3d8c-e613-4049-8f6b-32771d227c3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7ff90f9-471f-4e0e-949b-87544510f00a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84e4fca4-c2f5-417b-8008-c321dc3c1a45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ad47bef-9e2a-49e5-8f6e-b671d5802612", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2d0b82b-95a3-47e6-bd48-ebf142a37b75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--388dfd43-54c0-49bf-96e9-adbb16006a7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3aa98ad-aa6d-4e26-9cd0-b2b9508974be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ebb1c2f-f55e-4318-aa41-efb9275d643a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf8cfb10-5edc-425e-be15-855768b677c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9f29629-e246-4639-89fd-206eebf9a30a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc637e98-18e4-461f-a4df-bb95155a1523", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e25f0315-18ad-4c83-8dbf-37975fa7bdec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c45eb59-5511-4c22-9308-35b17248b73a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e0a466d-860e-4079-99c2-04545b3de9f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bab9fc98-d3f3-4400-9819-478b2d30fcde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc594e86-56ef-49ba-ae5c-c874036a2eeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d764594f-3075-487a-9d67-38e25d5e09c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94cbfa0e-4b09-4795-81c6-1e626920dac1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58622a2a-1161-49f8-9017-ac046d25139e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03201add-adf5-472d-9506-d04ad98c8a21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c32ebe73-706b-4a08-ab96-6e35bdab9767", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8ad0ce9-b259-4a55-b8dc-8c0d13e2daf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32ef65d1-951d-4407-b8fb-1cfa3777c9df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--926b0335-8141-4da4-87ee-e34131c07631", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f88bf74-61b2-4807-85c6-769c47ecea92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6924ad34-31bc-4b32-bbcf-70c1d006eb6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cbe1643-ec23-4864-8210-314273433b8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d743014-e45d-47dc-98cf-dc9e67d99652", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f2f64d4-be6d-476a-a8ec-be9ec9afdc00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a177d95f-beb7-4c74-b63d-95744184b979", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78123f44-0803-4f6e-84e1-863edf2910f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae1bed9b-130a-4859-99ee-1ce954070965", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--725d33b8-3c27-4888-a3e7-0874d9bea2db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f7cc82a-2809-40af-b0ff-c1e67c7b48d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca6e48f1-4a32-4af4-8af4-49882c781173", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04972831-3fab-4e7f-ab70-7c37dcea7cbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6cca4d9-08ef-4a16-afa4-b085deb46964", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--337fe26c-9e61-4c17-8eb8-48097aabde23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e23bcded-8eb5-4719-bfd1-6b2152b48b12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de08c53f-e48d-4582-8c0e-5cb6119e3069", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2e519f7-d946-4bae-8bc2-8e0489f88440", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20663682-5a0f-4b60-a7ad-c71817001c14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fd5ac70-a9ce-4ebf-8470-e9f70c51e3c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd7748e3-646b-4889-bfef-2852de7e4866", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68710899-0033-4600-bf4e-91e23c293a12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4d14e74-8b00-453b-b7ff-cd1c1b1f6438", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14642c52-ddcb-4d2b-912e-846f64e0f381", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e50080c-b3f8-4f44-b3f5-40583e9e18b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--627672f0-12cf-422e-bece-e9a1abdaea7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70656450-d76a-43ab-873c-ec61b1fc845b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae584ef0-747d-40af-b100-e47cea9ec2d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16b43abd-7392-432d-8a75-f57daa1750d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a64cb97-48bb-401b-94e1-eb424e65c1b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36e191c8-9d6b-43cd-aab9-38ab52791158", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4f5b244-076e-4524-a4dd-43c3c7a6ef69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4a3e293-c239-4ff3-83c7-8ba8c1616e8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c722fdb-cebc-46ee-a5da-ed157f9a368f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94b8403d-b748-4575-993b-a6274d32b6bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdde8e2f-1b71-407b-94c3-ecaabb3326c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.18.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c5f118d-4d1d-46ba-b360-83ccbdc7c1c6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.220.165.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--faf48fdf-a52b-4ed8-95cf-e0af03f80769", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.243.165.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2b4b939-c713-4170-a264-929bbbbd178c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.243.167.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aab73c9c-7a57-49a6-b0aa-8f452df46fdb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.243.36.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16822ae6-bfab-4765-896a-72d0ee733573", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.243.59.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0c68ef1-8184-4b0e-a8b5-46b1d5a8acfe", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.244.29.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99a4a229-ce5e-4f85-8fe4-812506817bcf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.62.231.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb3d3e86-b420-48dd-93f9-2c2c11c6ba6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.128.183.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1024c244-cde8-40a5-bebc-51cee42eac1b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.227.230.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dab987b3-ed27-437d-a6e0-2dc49b2b777f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.8.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b8079b3-cb1f-47bc-b65e-5e8310ea3435", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.9.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a67ec18-edde-47f2-bb50-c6472278f2d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.163.123.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22d5e809-de1c-4700-990d-89478935c90c", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.163.123.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--893f456a-065f-47c2-a0f5-d5a2618b70c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.163.190.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4a91ac5-3016-44ac-90df-2006334f8f80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.52.198.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af5ffb82-3f59-4228-a13b-e385e84d0c63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.153.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ec93c29-cf48-4c2b-8582-8bfb1ed68a18", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.236.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7eb3b033-9e77-49f7-8ba0-f8923d7aa3ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.130.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e654b140-3860-4546-a56c-b4828c7d3aa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.144.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70ebaaee-6b0d-457a-9907-3e5731ac1be6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.154.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20c5893f-e7b4-4691-bcb2-f409d98e3832", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.161.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c2ef05b-50a6-46ba-a083-e0a7cb56a75d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.171.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9110fed1-5607-4c9e-83ee-911aa0046292", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.75.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--116c0e1f-6504-40fc-bb07-1968ef5434e8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.78.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d73ab2d9-ad23-455d-a306-80b2d212e7fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.101.154.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f00ea6d1-9e7c-43c7-9f2b-731a5d54e7b4", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.140.216.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80a156a6-8523-42c6-bcd7-37a62ecfa074", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.10.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--013a4f62-c699-46f2-83e5-997c859c7ea4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.10.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--332a8d5c-92cb-4f84-8c48-8fc61443b5c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.10.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7c7429e-c112-4ea3-9a0f-d694586a1bc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.100.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cff8bfc1-c6d3-4ee2-b0f8-964e51e6e6c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--262bcdd8-122e-4ebf-9a50-bbdad32c2122", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9a7457f-fbd9-4377-aa1b-6843d897b317", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d412704d-3b0a-4d37-abc3-c5f04638bf60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.119.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0830938-d84b-426b-a749-32432be3b2aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.119.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9576cfab-edab-4fb0-902c-704735d9e341", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.12.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63308886-ba20-4216-ad72-97c00d58aa87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.12.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2279100b-8a07-49ca-b9bb-3e51c333d936", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.12.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9a23b0b-1547-4d8f-a56f-27dfd05b2fe0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.12.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff6478ba-96a0-465a-b675-3b7324fc4c3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9426d34b-c212-4560-9533-0306cbeb3b9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--929b1293-7354-49d5-9f32-f2bb47f40fdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93376726-d1ff-46cc-893a-5560035e56b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7f5edb2-a181-49f8-bae7-a66d83526aea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c678caf7-f0b9-4b02-905e-c0cd7936d390", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.128.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b5c7fea-57c1-41df-af61-9a29c3180672", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.128.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--581e534d-5071-46c5-a2dc-f52d47b45739", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7804e661-a40c-41ac-b286-473b4559ddaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07ad955d-7874-4ef9-8653-9b0d33db01e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff47f73e-81ed-4b03-96b1-b53a8504b67f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c36b322-855c-4df1-86ee-a11817658a49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2029ee3-8250-46cd-a4e6-b70cd4ab310c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e764159d-1bbd-4794-aa81-e6d04497170e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd90f2a1-8009-4b96-8912-d4951076b1d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b54c58c2-abf5-4c02-976c-ec1f5749a112", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ada0307e-be2d-4924-afd0-7c82e5bf4320", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f54e5ba4-6a02-4c9b-89b3-71a4f2dc27fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7724655e-8ff1-47d4-acb7-b26c6c63dcf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db9d2b4a-25b1-45d6-996c-85b7551fbeac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--566d7966-e794-4f68-a1b5-113a0dab6e3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b84a8c5-dc26-4f68-9ae0-e22fd126cc0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f31d08b3-3ae6-4816-93ac-0cf2840ac829", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecb578e7-6a90-4387-8306-f991e225c521", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--248c01ff-a758-4db1-b7fd-637c94c5ffda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f86c5b86-64db-440b-98d5-6a3c6ca6ab26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c587b24d-f9eb-43dd-9967-96adab104412", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e51cfdf6-3340-4b2a-90c2-d51ee6642935", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.151.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfe56700-2b87-4c62-8937-9393d6d4350f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.151.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--301e0ef7-4aae-49de-ac10-a98d7210c596", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b64ddf5e-7119-4209-b681-5483a00c6bd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38d85689-a74a-4710-9d5a-6dd150dfee79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83462aaf-4bb4-4f33-9344-fac27d77ab01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3edaeaac-7b75-469b-b643-1acfacfc3fd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--490534e4-599f-446c-ab97-5863b82dc9a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d38ad603-c613-4eb5-a029-22055f0415c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01c5e66f-dbea-4f5f-8622-badf52a08cdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d6a1594-6069-465a-bc03-cf6a174a4a1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64f1489f-1070-4de0-8053-53c745ffe57f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd4bc813-215e-4a94-936f-48a79153e509", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fa76d53-43ce-4001-bfa7-9a60f0876487", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26cf72eb-20a9-47ff-ae82-dac2dda1fe85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d1ccb1c-95c9-4e0a-a09b-31cdba78354a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc93f491-2c3e-46fa-b122-0832da86c039", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae268782-8a28-4c81-9e93-fb056c3084cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7538c816-bc6e-4931-8c12-a77159f16d98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db83456c-987a-4172-902c-4c926b39e1e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beb4d1d4-20a4-46d9-8b61-d4cb6a78b73a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c31dab0-bfa4-4a98-a894-a96f5a9f37cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a144784d-017b-453f-b4cc-4c316ad94571", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.164.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55de6da8-eacc-4a2b-942e-eef03d83d0cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f19957af-c5d6-4f8b-a5d9-2292c92a7750", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06abd6f4-d2af-4a2d-8a17-ffac8e62d1d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3225b09-ed9f-4f26-9cfa-cf075d6cb253", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35f67723-f69b-4642-871a-246312500721", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f31ea476-c9f2-42d0-a43e-c2a0fa9d5152", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5af9508-a993-48c3-81c4-521382259628", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a3a00b1-4950-4be8-ac73-ff6409d2d633", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8f87879-223b-4b58-93af-e9317494800e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e48cf900-ad0a-4f7a-a5b8-f35ff87d5dca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0466eb16-fbe1-4410-bcd6-7c924ea7534f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6450b95-c292-451b-be20-a209c2add453", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb62a5f9-7cca-415c-9a3e-0ccea677794d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d465b33-d83e-4a6f-b587-6613b7cb8f1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23ef5283-3dba-481a-89be-6a2b3012af21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71387943-2fa5-4b9b-b1ad-072cf3d56089", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dc436de-7df0-45d3-96d0-e491ec39c25f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16ef765a-c989-4842-8a55-d9aa24787cf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd6f75d6-ee8c-4a37-8c57-d5d0bed5d5c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c0d3ff4-590d-4758-9370-110aa3d421eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54c973f9-c0d7-4aed-aa82-3dbb771b1efc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55f7f4d7-a8bf-4c0a-88cf-be96f8cbc8a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--221c1acc-0525-41ed-b3f6-c8242c5e1809", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4429dd0c-d75b-4c6c-acf4-03f915c10bf6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b568996-9087-4f19-9622-c1fd9e4c6485", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c792f6dc-80df-46c6-89e8-c310f9844810", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61d10d37-5c53-4289-92e3-4f79068800a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccbd6af9-7d4d-440f-aa1c-4e7dea3d035a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82644d44-27f9-4118-a98e-54ce77521846", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a91c668-f7ba-41b7-b745-d9d4d0dae416", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab861fd0-3310-461e-a23a-239f75589ca7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c89bcb55-4a39-4f26-90ce-dc551db26d6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1814c6b8-be38-4944-980d-e7639626379c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.174.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4266fd0-cf9d-4bc4-af9b-3778d3ebd724", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.174.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3022166-e085-42cf-b598-667f7378769c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.176.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da6c38b4-3c9d-4c50-8822-f292a9069a01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69fec9e9-0cd0-4f38-b496-ff05ad762519", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a618e001-3140-4d8b-bd5b-0833a77a7ecd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4332e1b8-9471-41ce-9b08-f01b79a96164", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d26bf38c-e797-4b8d-a35f-030328d9536d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd3693d4-c672-4290-91b2-19a47c9478b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd4e434e-b46d-42e2-b34f-5b0ba6b1d109", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5511a827-22d8-425b-bc68-d1f1d1c717c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b71ca79-2ecb-48f5-8a1d-27b94c12f18f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1ba056b-e0e8-498b-a941-2392cb445d1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b03b8508-0bd9-4764-af91-422e6ab043d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bfa0031-6311-43ad-9a60-46bc7db1bc83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.187.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7eb7502d-9858-46b6-ac2c-ad177a51111d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f94a28d-1700-41ae-a72f-a723c2766c2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e26c9fb0-ab4b-4508-8a78-40ee72577618", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c80c72e-52bf-461b-bf04-f6b7b5bd0a6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b74dc6f1-2cc3-46fa-88b5-d7aa5f3f8b91", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.205.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--894d5ccb-9f68-48d3-95f6-e6ed9a75ee8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44c87cd3-5781-42dc-8b26-b4ae2ff0fe63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ef81808-8dee-41ef-8ba1-2550642b3bad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e0fd8de-fce4-4f94-bda4-8e9c369f1693", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daf39418-79cd-42a6-958d-2e01c102be46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0db01ede-ec67-458e-ac04-b97641c84645", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.218.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbf8630c-3a79-4e6a-8b16-f197f6f2b919", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.22.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--854dbab5-75e1-4393-b79b-c8a1d8397b5e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.22.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--486293c9-64be-4b37-a216-0f9df6de4ebf", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.22.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33de0d57-88b7-41d3-b3e4-47af99f92c83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.221.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fed9258-5038-44eb-bf31-32c3d12cb436", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.23.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1cd9bb4-e539-4fb5-8447-c814e2f70571", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.23.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8780d6f-8fdd-435d-a287-83769e8d0f3e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.23.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21f5a11c-fe98-443e-95d8-9c4fbc96f5dc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.23.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25e52fed-83aa-45a6-98b2-cb25c1a017c3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.231.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f3ce5f1-490c-41ab-ac1b-1f045c47469d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.236.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8721686-ee7b-4a1d-a655-704dd64a693d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.29.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7e3516b-d9f4-44e2-b01f-e166433c3de2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.29.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16082ec6-29c6-4b1d-886d-40d516f43078", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.29.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8438e05-3db8-4428-a8f1-4b094bf8b66f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.29.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75129d65-6a8e-49b3-8323-1fde0acde570", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.29.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1ea16c8-f554-4784-9f24-59297f4cf6f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.33.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27c14dad-6597-47e0-b6e1-84b5446f80bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de407454-83aa-465d-81d8-1d4baa94287e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae02c317-8b85-4333-a3f4-6e48e79f4802", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4342eee1-4b0e-4b5b-95ee-1b24b794bdef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a77fe45e-1bbd-4c6c-9220-8f709de0fcf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50ee1bf1-b985-439d-92b9-b2020778d3a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--191efb16-6bb4-4626-9a77-2c73feea10cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--573c86cf-340a-4d20-980b-229e80798777", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b9e9b85-d16c-4900-a354-b824223a8964", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df1bd043-bc01-4563-97a5-17b3f615fd5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b983346-f693-4080-ac3f-6fb9f41c267d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23252421-d577-43a4-b38a-011dcf5187c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9497256c-66f6-4cc9-bab3-16cd89590433", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91066ed2-0a5c-4d18-8326-01073ba75827", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--274549df-c6a2-499f-bd05-e867cd5e9799", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b049e8e-f0f0-4024-85e0-1aa5dfb0c91d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62e4318e-3afb-44f4-8a56-824be9089620", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--761e4620-900d-46d0-a01c-858e7ab226a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1d215d8-82bd-4deb-a094-8bfce4ad0920", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41086772-ab1d-4217-8f75-86bcc20968dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5b990f2-f94f-4523-9754-d5915ea1f841", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--217d6fdc-97ff-4a84-b752-c8edf0a8e864", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d2f6b62-6347-428a-8c02-18c68f708977", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08a3a4db-9111-43ea-85c7-0d2fbd7a4473", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fce45e5-be05-4f0b-9959-e4e524ada31a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b03aa89-f5cf-46f7-bb02-3fe9dc07af10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e6ff46b-a0b9-4696-936a-95b6437dc13c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--742dc7c0-1d0c-4d49-a5cc-53928d9ce9f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.42.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a62fd911-f682-4b37-a84e-198ba4ff8681", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.43.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--044116f2-bc03-4879-b4d9-73da54f05c51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.48.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87218974-2272-4c9b-aed9-f37849514d1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.48.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fea9b80-8a24-4213-8e6a-96ac0bb79737", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30a6b6f0-cf71-4c75-9995-5b5ebbf6593f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.59.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c957f7b-10c2-4e4e-9905-47950d809402", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.59.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4648a02-2038-493d-a9e4-b15fe899f01a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.59.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22c7773e-b04b-43ba-bbef-4f05bb7d2a18", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07953f06-42ee-48e4-80ea-b545087830b9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98d9112e-f26f-4d00-87ab-3a4c43bce6af", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93313e43-5460-42eb-9ddc-c330d797df58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76ab0d01-73f8-4680-9532-a05749474f99", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--389ccf55-1409-429d-84ee-e258a783481a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.172.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d753a7d-d950-4cdb-87a6-73181f5af05d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.205.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--364210cd-1c70-4ce5-8896-f48e3faf979d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.226.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9f7ed6c-4b7a-4730-908e-13dba27a6c70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.233.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffe204cd-3fa3-4690-9b46-d80a612626e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.238.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce70b5dd-dad1-4351-a938-23d0e3756c60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.47.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae046115-c603-4ba2-9c22-9d50b11b993b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.57.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f385868-3258-4e0d-8c32-13992ee24e15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.60.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aaaf7d38-6daf-4537-90e4-4099153a5d5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.120.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--239a6152-304e-4d83-ac6a-d730f1fb0742", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.172.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b1fa7fd-cdb4-4107-be76-5ba224de5a52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.185.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bba242d9-9a5a-4e21-b222-dc5d7ed546c1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.188.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cfb6b12-168f-4c73-86f4-10bba95fe350", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.137.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c5e8bbf-4985-4d15-84f6-dcc5fd02068e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.176.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f74626a-d491-454e-a840-44869b599d26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.186.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebaa9b04-1b77-4e84-bd03-04dd3c1d5f8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.92.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f132b52-3945-4d0e-9303-e8d8b11c49ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.179.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f97a228-4300-4203-8378-c03832b92aab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.230.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c00a64e8-7035-4e3e-bf24-bad62faebe09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.50.15.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25c166c2-5004-411c-b75f-a6af72a42907", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.50.159.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c9ab15d-d6ce-415b-b4e3-845888cf5280", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '166.1.133.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2609c7bd-de28-4cd3-aead-e82bbdebe790", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '166.1.60.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c9fc7ef-94c6-4a93-8cea-a619a2684305", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '166.62.41.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f0bb8f7-29a7-4e6d-9ba5-0f07064ba224", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.114.115.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0274091-ed99-43ab-a9f5-415ba8aea27f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.110.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3b820cb-aef6-4ca4-a029-00b9300043ac", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.133.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--004d8694-1003-45e8-b5e8-3887c8f11688", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.17.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b505514-2be1-401b-9e9b-dd1519fd9641", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.174.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ed8a17e-4304-4f25-8089-e5e12399be4d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.187.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf29b167-018d-443f-9875-9ef23f2c4c05", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.203.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2ec020f-4392-4126-a9e1-35b635bdfc5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.252.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27ebf73b-6121-4826-a7e8-d22d160b9c89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.59.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9a38c9d-b8de-4972-bce5-e3e4c7ac597e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.248.144.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f0c2f40-43d3-4463-9875-7abcf0bfd06d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.250.185.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--003218bb-8f36-4020-89f4-e0dd5bc38c0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.250.46.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db8558af-18da-46ab-83d8-8c61e939673a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.56.93.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6574b9c2-1301-460b-aa15-19e6957f4544", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.56.97.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3050a7d8-cd95-4477-b5f7-99c056b59cf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.58.123.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7430cdde-e71d-460d-be89-e74f98d24514", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.58.157.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--305cc8ce-29c7-45a2-bf21-6801362c1bb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.58.168.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e728c9d-86f2-44c5-9dca-e242e6c03121", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.60.11.255']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69e74f71-d178-4363-9367-0fee0f8c4452", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.60.114.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe605e04-37a7-4851-97b2-f97014df5ba2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.60.194.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--791f272c-c509-4ea5-b562-d0da19b2907c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.61.136.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d455e5e-195e-4efd-bc6c-c4f107b7c345", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.61.245.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7dedd74-5b62-4210-aad8-af0147c3c50e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.62.68.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce38e598-6405-48a7-8d57-0e15dcd5793b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.63.210.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37498462-46ce-4c10-869e-954b98fa254e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.1.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--827aefe4-8914-44e7-9794-f652e468761d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.137.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab7d993f-5f3c-41c0-b0df-fd9f4f1e3045", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.138.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e3dc9e4-16fd-4359-90f9-332ce572fde7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.239.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df69ad20-e8e9-4fb3-9c64-396726bdb82a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.62.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac2286ce-20eb-4060-8916-822d77270f1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.70.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b24a9c8-b98f-4c36-9b28-4ade319ba951", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.88.164.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bfbe9b0-d942-416f-802f-6de60fed9bc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02f6eea6-5acf-48b7-93c4-9b3dc0b6e74b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50ebc5c7-312a-4a66-8f71-ad3f66c0149d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ca9362f-daff-4d90-82fa-722b3618c9d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d541d1a1-8bfa-43bd-b770-a9273a3df26e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58c3b170-5797-4ca9-9f0e-7cf5e47cd8fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1315f0a5-eaef-4089-aab0-e3d225203537", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23ae8402-07dd-4ce1-bcd5-bbc3729b1ceb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f02949e3-8079-45aa-83f6-cea291d5d067", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e8ceed1-daa1-40db-8f12-27fbea4d970e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--653cf8a9-99e4-4206-939b-b3c9e2074aed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c19162cf-0b21-4401-82e7-ec4a7831d127", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec31248e-8d26-411a-812a-6d0627741f5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89c6cf28-0d1e-48f7-96e7-91d1d85e62ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7819f655-1c80-4381-82d0-b8d97c6b21b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c738f010-bf7c-47a7-85d7-982e2a103cfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--735ea068-7ca3-411c-aeb3-9b715046d6f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--702d74b0-7989-4fb2-9c6d-c71407b441b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c758b574-71e8-408d-9401-a8ceb8b1c02d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5457a668-4ebb-4114-ab03-cb24e75ff662", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--064ea7ac-e6a8-4796-971e-beca988f0b10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f2a600c-0a79-43b2-9ee5-28ad3269fd97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6e112db-887a-488b-95bf-48f72589d6ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32629aed-f1f2-49cb-bb03-6c5c47349c95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75c3cb49-ca5c-48dc-9249-93eb3ba2b36b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a30e234-1ee9-43f4-a110-bdffa72348b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00e47941-b2c6-4336-a3e4-3bd6cfd322c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c1c6cf6-8fe0-4cb9-b264-81ddf6d1f69a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ce45554-5955-4b97-abac-ada5a3a88634", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28714fec-5614-4a96-9bc9-43bbeeb7558d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd5ca301-c82f-4c19-8406-5cb8fcfa3229", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83383faa-cbf5-44c8-a3f4-579fca31bcb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--febe7b2d-f4c6-4b0b-9e01-ded5619af495", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8edd83fb-3b73-404a-9a06-06fdff8bbfa9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f927b150-b518-420f-a3ef-67d15f20d360", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97f85e77-c453-46f8-ad41-853bd5861d8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0022e14-716a-4958-8376-96d07a35cdf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2424e88-4dad-42a3-b5c9-e640b719f0a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31a378bb-83c6-43c9-9e37-9719ec60338e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eb6a1dc-fe0e-47ef-a6cc-25d23675fe33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5128e947-dd49-4ef6-9261-35fac174dc04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a21798d8-cf2d-4950-b9c6-0ae5b669cb87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3e3746a-a975-4ba6-bba1-911b1345d1da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82de821a-0168-47b9-bd85-682927b67178", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08dc15b0-7524-40c2-b052-0c90780bd2a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f50f565-e2fb-4b23-a7c7-d647e172d326", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09f2909a-66ec-45e1-a5ef-723d5071be45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0272b149-6e45-473a-9db8-fe465c8ff23b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef9997ae-199a-446d-aeb8-43c3a09ad40e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a378d5a-ff74-4ae7-8c80-355e26a7cfc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.151.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--106fb331-7414-40f3-a8ee-bde076f94baa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.212.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fccff75-983c-4ca6-a235-d75a4d941a29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.213.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af3e3849-be17-4c37-9d51-4bfc95730ac5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.85.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3c89bdb-b810-4a72-81e2-f4e869a5c0ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.93.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dff9bf84-ff8b-4d2a-8859-5bad5f9908ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.94.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1414e1e-c74f-4356-8794-4d8ccaec1361", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.107.1.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18073964-a357-4907-bb1b-19dca865692c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.110.195.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22e0f073-94ca-4f50-82fb-9f8388b64548", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.138.213.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--671d3243-30d5-46ac-898c-8434e5a1e87b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.138.232.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41be5c31-07c1-4b51-b197-494cdcacf53b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.109.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b26e1491-4b96-4a96-b00f-e44742d376b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.113.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2460789e-1e48-414f-b2ba-074fba03b8cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.118.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea9b771b-aa19-4192-b435-aedcf4e3abe6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.140.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bfcba22-0402-4291-bba7-e958d22fffad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.159.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03e84761-ad5a-40bc-9386-50e632ef71d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.31.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26b96aff-f003-488e-8648-171dbe155052", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.75.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41dc1d8f-03a1-4bde-878f-564caf13c137", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.93.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0612fa9a-d299-454c-878b-407b2a858cd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.93.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b402d27-606f-407f-89df-bc8e7ad5b3b1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.167.228.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36bf25b4-2331-4c58-95e6-c65482c98cd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.181.107.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afef775f-81d9-4054-b847-68bc3b8de4b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.195.48.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f0a72db-70f8-4034-8b21-b1b2b329f291", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.196.206.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fe1b370-4966-4824-866b-d09adcd2ef01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.196.245.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e58b712d-4657-4f59-8daa-49276526b771", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.220.234.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8eb7ddf2-6f64-4671-acd7-abc0da85040a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.222.140.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fbde2c5-f3a4-4b40-a076-afdbeddc04e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.228.193.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8566e8ec-2c0b-4e09-8bb4-8b5e08cee5fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.90.171.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b210a566-4d8c-49f2-8f95-da21e7013735", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '169.239.181.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f6dec30-2bd0-4597-85a4-6285819723aa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '17.246.15.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eafe56bf-35c7-4af4-b382-57aec0b2a3e7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '17.246.23.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0241c11e-56aa-44de-afd9-43ba7e215d56", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.179.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--218dc3c5-e117-4885-a4dc-ffeb3ba9c883", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.181.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8391de1-8a78-4ade-8f16-a8ad3d7fdeb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.192.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d07fc57e-ebb3-4145-928e-0110121005e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.194.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25bdd7ca-de52-4854-84cc-a7d5924f1c16", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.198.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--680e1b31-d40f-45d3-b062-5b2c900b49d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.150.221.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81097b8c-78ef-49cc-b2fa-eed376a0e303", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.163.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a379bdf-1e20-482a-988d-7635673dc8e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.163.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--067ac478-758e-4e07-b618-7d15ff97b304", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90b0a6ec-c5ac-4da5-b6e5-75fe469e8b40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--babf4194-ac30-4c8e-bb96-f4abdb40384c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc022d91-0433-4430-8acd-cbd2a1743849", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c5f7d1d-99f1-4242-97ec-dc05678242e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e88307f-4ab1-46e1-b9a6-98607e123a72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b5439bb-14c8-40a9-9a97-55bf93fbed0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.233.254.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8efdcd2-0faa-4b9e-83cc-b4b8454d1273", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.239.150.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f23ffd04-08a4-4c40-97cd-9ecff3a3d185", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.254.195.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f25c24d8-6c7d-44c3-9af1-0171a9d7e287", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.155.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--add72a3b-2f62-4cb7-bec8-fc1affe342aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.160.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34600aeb-6fe0-406a-a9da-89aed582ae7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.167.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5c0e8d6-d161-4029-839c-4dd18259836f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.220.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f73912e9-f097-4c89-9f86-dc8b9eb9fb25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.221.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ed63b28-c3ad-41bb-8ac0-3a7d586faf5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.231.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5111899-abc7-443d-9931-e258a6317262", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.79.37.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--312b0599-bc7c-488a-95ed-f2cdbe68b342", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.79.37.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dd5a1d1-65f8-490f-88f5-8b7a26fa1712", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.79.81.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abc505bf-8bfc-484f-be28-200a73594ab6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.80.193.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a283a527-ea45-423c-bcf8-568c688072e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.80.20.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89098e78-3083-4502-91e2-7bed90af53b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.80.202.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56ddd89b-ae7e-40e7-97ed-c1a98457fad4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.80.210.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98106424-153a-4308-b609-3256810de576", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.80.64.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3902f0a4-ec53-40a1-a270-345084164969", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.82.129.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a54b6ce7-91e8-48ca-8f97-376e12462a7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.83.240.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88ec183f-5ecb-498a-8ed8-edf26cbe4f98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.105.76.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c16272b-d913-4948-9a13-57e10ebf6fd4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.109.111.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b59dd82c-2a44-4eff-9c23-7ff0b2a29dcf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.120.25.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--227d6bf4-0578-4735-aafa-c9cb576f65c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.213.130.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ef3ddb9-c95e-4534-93b8-4baa391e037b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.231.189.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7e4b823-18c4-48ad-a15e-93adb4799e26", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.231.196.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59061cf5-4df3-494d-86c2-8c084326ee5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.234.8.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dd7e218-2ca4-43c2-8bc5-bf942d25fe60", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.243.148.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89a37167-c9c9-46c9-bc20-1be290632db8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.243.149.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7a49258-b91c-402a-b451-f8adbc4c6937", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.244.37.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76f7aa01-8e80-4b53-9cb0-2bdad591f99a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.25.158.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e88dccd-a7ff-4d9e-a050-0cd54abcb7ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.254.105.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09044c83-8f61-4c47-a49f-c0cf70a75a49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.37.190.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb7b070c-cad2-4109-83a5-f28259fc8e33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.100.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a663796-e4a3-44cb-948d-df2742cca2f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.11.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5474d4b4-9164-4365-adb0-1dbfec3575d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.11.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c11b9bc-be6b-44a9-9c33-4c2d85824113", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.19.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f78dcdc-ffe7-4001-a3e2-687f07e5e037", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.210.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37188c30-7f9e-4f56-a709-0eb05155ead4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.5.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad30fe32-a9bd-4b95-aaf1-8fe4eb569567", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.93.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce1bd91e-27b3-4a9f-a363-8d40325b49b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.105.128.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7faf6a43-9034-45c3-b243-40c666a6c2df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.105.59.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00a2f24f-aea8-4c6e-8ed1-c9295e2fb7dd", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea4a24fa-a808-47c6-aac9-3e286133df3d", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f11bf9e0-fc95-419c-a41e-6f8c5a7520a2", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b67796f5-d8ff-4368-a15c-f6b494caa79e", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a99f4b0-263b-4b20-ac5d-db5d65c1a996", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.172.180.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac89e7e5-8ae6-4480-bac0-4dd38103301b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.172.196.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7acae5e1-b1c0-4330-9f70-e72e1c041466", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.172.26.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50fab262-760c-4992-9e0d-eef2c1fdee0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.172.30.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a092d0d-a478-4eb7-988e-85d1614e9917", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.174.236.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1d5841d-7828-4d39-9c38-d8ac6a8ebc6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.174.250.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8809985d-98bc-44d2-881c-7b297c5f8967", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.174.46.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a21a1d65-5fd5-40c9-bfee-c369d8482be9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.185.40.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea0822b1-1209-4515-98e9-ae693c07680c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.104.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73008ef5-806e-4686-87ee-51ae6fa04bad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.113.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06aa017d-f05a-466c-b0a3-1c505ab1c849", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b36792fa-f14f-47d5-a742-66c511bbadd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b16e2cec-360c-4f66-a82a-1b79e6cadb6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf5b8775-d18a-43c5-b1e5-43b4b9f47a39", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.203.149.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14420c23-c261-442a-b36c-ec7fe9d0b07e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.203.234.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e01546ad-d168-422f-93cb-54242d774a72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.205.112.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc26b307-2075-4907-aa6f-54f03caf4576", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.206.225.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a30458ce-6b25-4215-bd91-18cfb1ec0ab2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.206.227.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfe09707-72d6-4ed5-b0fe-1f9d0a7e560e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.208.24.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d79c42b-494d-4047-9bfc-517016da1362", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.208.48.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4dab08c-73d3-4ae1-aa90-a489622b9760", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.208.49.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d041fd7d-eaed-43ee-bbba-2ace9ae3ef01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.208.49.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b039d06a-15b3-46d6-bfb4-e9078f4af344", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.210.0.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbf10ae0-8c58-4744-b6b7-f0744f853e27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.212.106.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e6f2184-ba1b-4fa2-b93f-6f22728f6e1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.212.200.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cf684c2-dcb0-44d2-9c21-95021e194aa0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.214.209.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e81f7ff1-1079-4bd5-a5b8-9568cf6917f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.108.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73631c70-2744-4b76-a4ef-66529f4e4b4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.12.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--432a1c8f-1813-4bec-a681-67f53bc0fb3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.143.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--193796d5-a851-4964-bea9-d7a6be354c35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.15.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d15a651-7bd0-466f-9bc1-bb235b6a77de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.231.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dedfc82c-f47c-4371-8e0b-b951285dfbef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.27.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efa15cdc-deb1-4823-be47-ac58a5da0bab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.3.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5f0e385-b889-4b7e-90ab-32a0cae9f2fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.8.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9665ca9-f935-40fb-80e4-47155437f8e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.233.219.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0622fdd1-0b8c-48d9-883c-800e8550689d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.233.221.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f1c4d39-46e0-4111-ad8c-66a77377bc6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.192.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cb0420f-81ef-4387-b2e1-851d48a354e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.192.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--691881fa-07d5-499c-9377-fdf79781186f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--706ceca5-12fe-4371-aada-2cec947890b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5d6c2a8-e9fb-411b-9927-f2413ca03651", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--469b9271-7214-4644-85ea-caf6000f9e19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4e9b605-3ce1-4f69-8d23-ddf785f95e27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.21.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcc4633b-7e92-450a-abfb-decfbf9e2189", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.217.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01fe407d-d1e0-4ed2-b3b6-d72b2a3d18a9", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.217.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef023acf-33c8-4158-b7fa-237c4ad649d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bad1a440-07f6-49e4-af6c-c09a5b801e48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a679042-4862-4285-8d6b-f6bf87584bf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cae7f40b-230f-446b-8c08-6779e54ffdbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce73520d-75ce-4f84-83a1-b0ad5e317821", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0326e593-6693-4f1d-9945-881b75ae6d76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.221.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--374ea8e3-d4d2-4b06-b7ae-659fd1209460", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29f8daa4-a9a7-413e-a1fc-15fd19230f49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--656dcba1-92fe-40ab-af63-379be863259e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51cb4608-15da-49fc-8049-1ad871e175f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2afff8a7-fca8-4152-b653-459d96072368", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.106.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab073cb0-ae76-4312-8047-d8524d7b24fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86cb319f-ccc8-4dfb-a425-dd29c8616f52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78d14667-5ef0-4b0c-b32c-dd171f89b6ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51b0fcfc-90e2-4273-bb4a-167462b31e5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.117.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c52fbd7f-4bb7-491a-9f20-4acdb12a1ba5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.123.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a33a7cc-5b41-4029-95f7-7f6fde0a8752", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.126.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--122c9931-9778-42d8-80f5-070cb19340e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.126.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ea8c10f-48b5-43c4-bec8-a1769f2638f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.15.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7564e3d4-b87e-4bab-9a3f-c599ff38c2cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.22.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdf51c14-9033-4da6-8738-211ea628913f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.22.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a96a90c1-a4db-4b75-a039-25d0ffa7978c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7807c085-a8d4-4768-a726-c3b9fbbcd53f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c48cff3-e53c-42fb-bd40-f83ca9c56b46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6a5ce3b-7215-49f6-9b8d-239466725d9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20657849-803b-49b6-bf70-61f91200237f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.96.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eb7cd88-7e5e-4dd4-b424-f1e56a12df0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.96.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9c6cc16-61a3-43d8-823f-55a8ee73e97d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.104.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef06b2b1-558e-41d6-af35-625234ca24c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.136.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cd7fe02-8eed-47f4-9046-9952189ec2b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.136.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e5a462a-2c57-4999-92b5-d8b5fb8b1f61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.150.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e84be82-d788-4d27-a9b3-d1de65702a9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.150.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b52a0a36-bb23-4006-9434-a05e1aa8d85a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.155.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9641479-624f-4102-95eb-3b2a6cf6ace4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.155.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6c3cc41-5488-4720-aece-8b932f018eba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.156.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--102d2993-caa6-4532-ab9e-b4eec36bb2eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.156.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3029b8c-9670-461a-9ebf-3d7b5b5320e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.160.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--850f2eec-2fbe-43f5-afae-e9607eab7e29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.171.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0434361-99ab-449f-9aa4-5f10d205ddd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.188.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20e49140-e374-4c8f-aa0e-2439704fcfa5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.51.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f4992ec-a809-4004-a1ed-f4dfe5881acc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.51.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5139ab2-640f-40f4-bb84-330b6facddf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.62.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae3a135b-b7f7-45a6-a1e3-35502513812c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.245.112.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--064df9d1-273e-41d9-826a-729bba25b09c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.83.83.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c38b7329-7b55-4d8d-b9e3-aaf663d7e3a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.86.117.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34756fba-e08e-446f-ad5f-a31d8e19b7ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.94.9.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34b73d94-85c1-43f5-b8c5-ac4a877a1da8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.96.14.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2751925d-c346-404b-a18e-368d09d1625e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.199.117.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a4d0e1c-af26-49ba-ba87-7bc64527e30e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.230.150.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fc9757e-cdec-44c1-a366-b59b757433a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.210.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14167811-a7aa-486e-9f8e-efcacac09587", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.221.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bec1ae37-e858-4d84-8c31-b41ee5682571", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c68afd0-df33-4322-b4c9-7227e6e6dea9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e6f6c1a-deb1-4366-b05f-a108edec3d2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c96adad6-b80a-42a5-ad28-3d64f2ef3f0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7d758e5-1741-4598-9eca-cb77d27f57c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83e81ea1-2b9b-4723-87bc-53df5738acf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d01d46d2-554b-4eb6-ba9a-57242e1f8536", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0286fcae-374a-476f-b52d-0db318771dae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f83ed600-2f8a-4680-b4db-e63f04f05ae6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44063a49-9444-4276-bac7-f24e11c24c55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b03d852e-895f-40e4-b921-46e37cd295ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.242.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ddb4e56-e066-4bf7-8033-c6aebbf8bbfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.243.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2993d64f-9496-4d8e-ac72-ab5caf1a0de3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '174.138.38.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4218711e-8eaa-4c0b-9976-c47f589fb519", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.107.233.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8737bda9-7740-468b-b338-7079a124148e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.107.32.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6349c3fb-edfe-40e3-b979-e668231d0e3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.107.36.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10cd5745-3863-4ce6-8945-e2c9b91115a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.110.158.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b6aeda4-158a-4a35-ac8a-11bbc93d4eb8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.118.127.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa648157-10bf-46af-9d1e-043667179f6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.19.74.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d15b436f-3533-47df-8cef-cf6569a41242", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.192.243.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--761b157b-5f70-4924-85fb-90b1032744da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.209.26.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5904a0b-ab40-425b-9c30-40d34f7cd82f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.27.163.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af9e0e81-ba70-4020-83ab-a425e947a739", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.27.171.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--344ffecf-282b-4af2-b97c-b58998f44f4d", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.41.159.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13ce7383-b20d-4134-bf5e-15187e00c3c5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.45.200.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49b44569-8673-4cc6-8855-8dfe95a97610", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.6.54.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ff912c5-45c0-4a29-99be-e614b1584001", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.111.121.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e72eedc-9206-4127-9c28-814355d18b2d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.117.104.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ea39083-3d46-484d-a588-86e15b8e1c62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.120.22.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d441741-cc2f-4ba9-b3ae-fa99ee961745", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.120.72.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fe3e2c8-a797-4089-bf16-efe742682e92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.122.119.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0301f51d-ee26-4db0-919c-e36dcc56dbb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.123.2.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c33e607a-c232-4458-b214-35f9888ed788", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.126.103.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c6a3328-8a59-43c5-b5bf-7d7d662d30b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.19.11.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b880698e-4453-43c2-983d-b158d1343ae7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.196.187.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3a3f02b-e719-499c-bb4a-c1d67a454603", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.235.182.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bd45bdc-b870-4887-a60d-909b2a5e4201", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.32.193.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--463e7b9f-73fb-496d-9c41-b73b336884cd", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.41.224.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04633542-6614-4684-ab0d-c1f94887bedc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4af73ba-83c5-439e-9670-f09a44d46ae4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5d1e954-29f6-4a33-8dfb-3c31af7bdbe0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f68f2c69-9b72-4bb4-86b6-dd01201fae16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.134.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0fb9dd0-534f-4279-945e-c4b93738406c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.134.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29e19c4b-a87a-40e4-a060-f92e2f50d9f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.134.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a8c96a4-61ad-4fd7-a7a5-cbc5a67918bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30322b43-43cd-42bd-a1d9-f83d2c124c9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dd4fdfa-0b79-4950-8dd7-2db05579108a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57fec7e9-030b-4ad9-bcc5-340f60d51d0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cf33263-c62c-4620-9ca7-38e9d25b4f07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4594651-5312-4293-8821-fc8eaa9e30d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3fae7b2-d87e-493e-96fc-03a58c3cb79c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2587c699-a8da-4ae4-9a84-2e705f367c23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4379a3ac-4ea5-4d6f-a03c-4df0cafb67d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--802f0be6-b3a4-4bd6-ae5c-e78fbb0ac175", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4c65250-788c-43d2-a8a7-3751d23fc7ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c31a1bfb-46f3-40bb-aef3-040276e158a3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfa4a47c-abd1-4850-a59b-5ecdb3b22a4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46014158-7bf9-431d-88bd-f395ccdf578a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e35289a7-761b-49d5-91b6-0fcb7fa477fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d48f1ae-f0ad-4c1f-822c-4e1abb9016be", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c040dea-3eea-44ff-9c72-48ca018a9c80", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be338b61-abf1-4d90-ae8f-ef87cc3f18f4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28aeef33-b02f-4c9e-a5f8-8bd976b4d897", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd1b8b0a-8a9e-46a9-a199-b5f5ecc9c238", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ebd95c7-bc34-4f49-a557-b2514ab7b3e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bcc853f-cf56-452a-8b50-c835b074db59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad3e5f84-1c99-455b-adea-341c4c04969b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbba61fc-ff6f-41e3-8acd-4063ca9a9c87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c878458d-35d0-45a5-bade-c57c1a415e23", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--478165f9-5434-4ef6-9030-64f07a00026c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f3de3d9-e051-49b1-8934-564d68c2dee3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe00e4c2-0c3f-491c-9780-736d5452cda1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16572e8a-cd61-4410-893b-adb831cf8a05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b530605-22f1-4c95-8599-38b45eae4381", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41118741-957a-4010-b3ca-b694e297266f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d1c42c4-c865-41ed-8620-fc4194546753", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b9e9d35-cbaf-4343-9556-76e48c7dce3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d679db0-89cb-4965-b949-bf04412cbbb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--126732c0-4fe5-4049-895e-e6e3ea74d3cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4393939f-b7b3-4e07-afa0-0e27c972324d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cefdeaa6-147a-4310-9b97-86254edce077", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b72831bd-9eac-46b5-89ed-c840a131fe00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6b4e1e8-1fac-4daa-ad4c-dd7db73c7483", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec7a196f-f06c-4c5f-811d-09db8a114b23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68bf945d-4c3a-46e2-8a0f-d42a20fcc0a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e0db399-c2bf-43b7-b28b-e047d9e415c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cad5af18-bf73-40d3-98bc-c06f0a824db9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ec31435-ac81-4539-afdc-c766370790c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20940f1a-da0b-4839-9489-1153473dab30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f3466cf-75fe-4c7e-b7f9-24d4a61d8fda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.88.159.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd10bdf8-4a0b-4e15-9661-7c92122cd5fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.98.30.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b42f53fb-df78-4f4d-b1cc-f3d8b91aae29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.101.112.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0025822-904e-4217-a03b-96d7721db26b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.103.34.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a33c63ed-6e95-4065-bf6c-108eabf676f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.118.160.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eaffa56-60dc-48f7-949a-a7beb977e45c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.12.183.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7256d878-20e2-438e-a5ce-ce88f18f57c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.12.223.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf76eeb5-1ae0-4b0f-b004-d3b62cc6e59e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.121.146.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50d22a89-0552-468a-a0fd-69ecd86c6725", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.128.1.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96ffceb1-8dea-45b9-a66c-dc4dd1d9048f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.129.104.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e265f4ec-053e-47ad-a006-5ca8f11fe54e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.137.19.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a458f396-e5a4-4028-adbe-151a8056a72f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.141.11.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae0044b6-9223-47cd-a9a0-13e5f9ca61b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.152.86.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f929c72c-dbe9-48aa-b071-5d974432354d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.162.3.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20b70c53-c233-4370-bf56-1090cc5d48d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.182.145.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc00c4b5-9b54-41f7-abd3-56e2f80807b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.182.15.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c3eaf34-adee-48e5-ba2d-8c6a2cdaea8c", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.185.72.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee8d0b73-3ac4-42ff-98c0-7ba37778835d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.197.219.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2d140b2-e0ee-4ded-a2da-c19fbb74ea9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.222.253.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82abf2af-7b11-478f-8579-b8724d7a95fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.23.180.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dad6664-87d1-4e96-a04e-b8eae943f6c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.35.113.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4495b1fe-8606-41cb-bbd1-5fc276936890", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.36.194.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cacca3e-adcc-4c91-92ba-f4ef38e2b51b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.36.214.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3a63003-037e-4411-927a-1943e9c0fff8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.45.126.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--513f8658-dd51-47c7-964a-7270519ae74c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.47.166.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41cc2bc8-8e77-4cc4-967b-82332bac5734", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.54.62.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c28c3df-38a7-4d5c-baad-fa68d9a5a1c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.62.35.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--836bc643-693c-4d10-9d27-c761695ec9b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.74.167.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8af6c94-fef1-4b6b-93b2-c027c2418dc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.8.138.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a15d94d-4fa2-4c05-9d36-b01ca55e4aa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.82.41.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1073b95a-d281-4891-918c-54c375f78ac3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.87.152.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--537a1d76-8c28-4889-af49-0b4978328788", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.96.127.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5737401-6a14-41fe-aa94-0835447a1949", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.105.139.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1a396a4-3efb-4edb-9927-0ce9163b451e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.105.68.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d90decd-0131-4fe4-a596-750d79d37763", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.1.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9525f680-8cc6-4c83-b5cb-45c7cd26c017", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.212.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7bcdd17-cbb7-45fb-9717-9bab57b66af1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.240.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35cbd59e-2ffc-43b5-8fb5-d17038711258", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.84.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--532f94fe-6692-4ad2-a965-2cf85a782e3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.95.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd24a7f8-e546-40af-81f1-2b33111201ed", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.156.177.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fe19b0a-fb3b-4215-8f02-575d74d60b96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.157.171.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f5ab791-bc49-4d40-9d81-b6d99a5d3b65", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.176.76.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e7d926e-e6ef-4238-a160-3ddba00d5664", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a1f0b28-5e8a-428e-ac8b-acaa2978479a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dce77f9-04d7-4d98-9fa6-5e6e9e416236", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a4856c9-b59b-4656-b257-4b99fed66610", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1cf8c01-9d9d-4f49-9191-4a296d595856", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.214.76.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--056d6e90-d13e-4bb5-908c-0736f1955a03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.239.180.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c722ff61-5301-4a7a-bca6-f880419a710e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.206.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecec7931-c6a7-4e02-9931-d261fea68ac0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.216.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff4190d8-2ea1-4922-9b68-c202f736f6a1", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.0.124.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9fe299e-53c3-45bd-8271-eb1c6a798631", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.101.231.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24fe1563-f5f2-466e-9222-3cf970b43dae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.106.89.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32ee3d3d-2916-4596-8086-a7271c363f43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.127.243.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12451352-de50-49f2-ae46-10e11186d134", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.133.60.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea8cdf10-75aa-4db3-afb8-2c57bb8d4998", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.173.83.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2786cf0-e5c7-463a-8c0a-15de30d4b7fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.215.90.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af553af8-1c96-4b8f-bfc5-6fefc8632d21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.217.168.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b835f2bd-771f-4a4f-8202-a83fc3810638", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.24.4.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3da8d00a-73e5-4d2a-89fc-53d655f95ef3", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.24.51.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef3ef9e2-850b-46b8-82c9-818dd0a3cc31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.25.108.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2fbaf7b-1095-4c94-9978-5680ba6708db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.25.144.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d6a8bb8-4872-4d3a-958f-ae6266b2cff1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.25.148.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc619553-72d1-4479-beb2-fd2864191b94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.25.68.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--244fddf1-0f31-47e0-9084-a434b22859f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.25.68.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d597ac90-4467-4da1-9bcc-006d00e89de0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.33.210.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c56c4d8-3949-431d-ac5a-252729b85928", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.43.146.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cb9cd3d-ba3e-4c9b-ad9d-6845f03a70ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.43.168.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a452eff7-8365-4209-849a-18ae087a2009", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.48.207.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2dc75b6-4fcd-4b82-b5fc-779b1a8575f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.48.207.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c4ba8f2-af29-4963-a2f4-2e0313179b3f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.57.170.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d86512da-af27-4e93-b989-19a3cb029398", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.60.116.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ebad791-c3dd-4c6a-a844-9d9cfd062641", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.63.36.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82153fd8-f0fd-488a-8557-76282050680b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.73.246.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7012c17-8400-4d16-a53f-6e58f052e32b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.82.157.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a454a61-94e4-40d0-b29d-b2544cfc70f1", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.93.248.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ec4434d-f9d6-446b-807e-cb8797267d9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.116.101.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac1a3c57-643f-42c2-be49-6a54a40201a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.116.89.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c789cd4a-7505-4ec8-9a94-9c59e0b5e844", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.119.209.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2fb249f-c8ad-4845-affe-e6a05b64ae06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.119.235.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da7c893e-bb31-4f40-9126-d3fdcaae2910", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.133.212.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb3233e6-6ac9-4177-b766-bee2f2c5ebce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.143.235.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0e08a54-e39b-43d3-a614-9bdfeace5edb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.189.74.1']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ba6d7e8-b17d-4cd1-a4ba-0de7fd358bb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.190.15.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c53530e-188d-4e58-89a2-b13d39f41621", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.191.179.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e76588e-ee88-4350-ba17-3a9fd18f68cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.206.156.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--583c48fc-88a5-4b31-a5f3-af86fc3d3b24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.206.252.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d197de7e-ab67-4a3b-ac86-044a5f9e8a38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.207.114.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfcc9549-acc2-4be1-9038-6fb5c13999f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.208.181.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1a90008-0c74-4ef4-998c-f88d9ed13274", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.217.208.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0ce9a4d-f0ad-4ee5-9eab-77791f3b354d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.218.118.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--207b3f2a-3524-4032-8413-b85b17c8dff9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.221.179.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11e8f8aa-5048-45a6-976c-8a2a546303d4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.106.151.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--363d08e9-799b-4bc7-93b6-bc51273efafa", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.110.149.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9aedafb-ae08-49a7-a074-687a818baa3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.167.128.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e07f4d84-c1d0-4ea1-91b4-af9c1827f7fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.167.128.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb220584-1df8-4646-b976-bc20e66503b2", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.184.160.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04d21190-eecc-4710-b36f-90f485a65236", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.184.182.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--842b6e0b-3007-429e-aea3-7f03b93c32f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.184.90.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04e2b61a-b035-4218-a94e-b3ded140396f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.184.98.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9904dedf-ad7a-457a-b783-48d56fc3496a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.190.5.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef24ca29-2aff-4807-b44b-4b6df366b9ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.251.145.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b332682a-76a3-4d7f-93d0-1604587f9fb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.76.143.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b59c5796-2e5d-488e-bf4d-6df30301a64b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.76.233.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e1f089d-02d4-46bc-87a3-fd2dffd677e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.1.67.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a8a1ecc-74c4-4fe7-bdd4-c2457653445d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.104.43.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35e02c21-529b-42ac-bbd3-97c7d6f20467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.110.191.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32f8679a-e718-44a3-a4e7-7d7464545881", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.114.58.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d65076d-6593-4baa-95c2-c3705cc71993", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.114.58.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fb36879-5d6c-44e5-a1c3-3af40981335f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.115.171.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--562396e9-3b4b-42a3-a054-2952cad8306d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.118.148.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22e8298b-907c-4df0-995a-253f3a805541", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.119.100.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dabeaa9-efb1-4a25-8267-c63c8c7cc6a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.12.159.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5a314a6-6d0c-433d-8221-30ad618914c4", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.122.93.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2193f25c-2ad1-47c7-925f-430c2d8099ba", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.123.136.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e15e773-1723-4b51-a413-fe0f45a79621", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.126.23.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4708a6d-7a14-44db-b914-dcd70b4dd89c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.15.84.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cf0ed04-3d89-4d97-b949-099df243f918", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.16.140.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e18f297a-97b0-40f5-b45a-921d0ed84552", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.167.54.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7561a7da-b344-43fc-95a4-b873f2f672eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.168.96.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a8f4155-5853-4004-956c-5ca4dac43f5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.173.26.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0a51869-5764-4eb2-84d5-ddd418d802ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.174.180.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bef2ecaf-2ccc-42e1-b7b2-43f4eacb67b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.178.200.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cd70794-a4c1-437c-8ea3-1a98688e2a82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.191.118.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f150a5c9-df57-4776-bfeb-27af70188eac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.191.225.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1bd900f-3349-45ce-9745-064d79abf710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.208.97.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d4981a5-397a-46b9-9b96-50e5e02ebf72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.209.111.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c38beca-bfa6-426f-b84a-586bb250ad3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.209.72.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ee232b9-074f-42fa-81a2-25ccec8c30a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.219.202.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f88ec160-968c-4120-84cd-5f452ba3ac19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.229.110.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--946f045d-6423-454a-8d73-e562f361bacb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.232.244.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a6f25b9-680e-4347-abff-1b58c7041e31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.233.89.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae349b59-bf81-4e9a-b080-da6aa7e5dfb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.233.89.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9617b054-2a2f-4e8d-8d23-fee6007d96b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.233.91.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f93c95f9-60eb-42c7-b95a-24946dad83b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.233.91.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46d32ed6-0f5b-496e-95fd-a3534c97f2de", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.235.252.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb300715-56b5-4a79-92b5-1ebc3fd389b3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.49.8.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b19852d-cf06-4308-96a4-589f3dd13240", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.78.18.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecdd5ec8-5198-4235-a1a2-ed8e92f8bca7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.80.159.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6873335e-2c4a-402f-bdf3-415260f31062", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.85.209.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8aec5e3-619d-4c91-b234-e5066d414232", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.94.232.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9c58744-0bf7-49e5-bf75-42dae18c5dad", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.97.42.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e64a16ae-db93-4154-bda3-0003b6def93b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.138.158.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a4b780b-8f0c-4df8-b4e6-1e477d58d5d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.138.158.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dd942bd-54d8-4a02-bd22-ca60a3fdb39a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.16.3.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f1850c3-79e5-4ca6-b968-2ab83092eb89", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.176.78.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94a3c384-f2c0-4202-9bb2-6dd0c27f4d0f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.18.161.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24e94c68-fe75-4f12-9e98-6cab390f5fc6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.180.154.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b99d2275-abb8-4f6e-8f8d-142063870edb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.180.57.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24a8fa60-7a75-4149-8d14-83b647d781d7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.180.59.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--364f5eb9-8ca7-45cb-a8a4-2da752043651", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.191.77.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dedbfb7-512c-41ab-b4ee-bdba116acb91", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.191.83.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7a3ac7f-cdf6-480b-98f7-eb6b3f91a55f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.242.139.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c6dca25-7a40-41de-8399-19ad73e9fcd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.42.93.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1021421d-4eaa-4de2-a477-47449bd660fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.54.23.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0e19781-dfd0-47c3-99f4-d7a2c82e5172", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.54.23.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37536b14-e83c-44b9-993e-d0f22c9e11ec", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.8.161.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5334cbf-74d6-4fdf-9297-b43bf446f1b1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.93.50.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--970351dd-b258-425b-9408-8cf4671fb2e4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.96.95.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd994e59-81a8-4697-9269-8574f696aed3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.104.26.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aa8d604-85d8-4dac-b23d-68ff615b670b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.134.40.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d825d9e8-1187-4b4a-aa97-95288dfee48e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.143.42.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06609c8f-8974-410f-bf16-6e8dcd14f8e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.149.156.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a18e7b77-77d8-4400-a047-8f9736f81a53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.158.20.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91803c06-ce81-4443-85c3-c4ab857e022a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.171.242.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5270f40e-0ea6-4cf7-8754-35748cdf14bb", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.193.72.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0aa6e843-be0d-48a4-a0cb-e71124a37c41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.201.208.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1561fc2-d9b4-4c8f-b3c1-11c6040b1cd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.203.200.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce8740ad-71dd-4e59-98f0-af08dc51f2ea", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.207.186.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b35aea0-e9ec-490f-8422-7d600615cbff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.224.249.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3715dcb-86d6-476d-b8b5-3c63f5ae12d4", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.236.101.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e258b18-193e-4c6f-8d55-d1dd40abc629", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.249.2.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abdcace5-85fd-49b6-bb44-7f1aafa1a97c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.36.35.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c3280db-375d-4a8e-8db6-cb0d9d6288ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.92.115.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7773bddc-e800-4ea2-9059-f114f9ee052c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--029b9587-584a-46b1-9161-7c87cd6713dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e7d4516-d47e-4061-b6f8-008b87aaa60d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0990aef0-afc5-49a6-9a4f-ccb2047b449d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a63fce44-a15a-4a6c-8cb9-07e874c902c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c4d0ee4-9ce0-4b1e-94be-e5edaee4121d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba58910a-7346-4650-8bfa-e3107d63d3f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f47baa0-8c8f-43f1-a7b4-5ea25a087b9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd00ba86-f309-4f1d-8959-4b9160649e9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--504c733a-99b5-46ea-8b91-dd07a17038f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dc5d7e9-f239-44d7-aefb-bdf1a573e841", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2bb1646-3ed7-4b13-b532-8c5d014931ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58bc587f-6b70-4024-b708-2b0a12fb6fc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1147f271-2ea4-4ae5-a2ec-f5b8abe4fd20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb0ec2ab-120d-47d3-9160-0bb127a11191", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c0b0810-8ba7-4749-86f4-7be4aadae462", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cf6489b-74c3-4638-b21e-71e357398e63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8057698f-8752-4b17-8243-7510f21dc739", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f224681a-5962-4d89-aaa6-9c24cc68f123", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21a51669-eb94-41de-b2c2-143094b2d418", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12693c0c-bc52-4ee8-b25b-e37af1bf1116", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02db0e44-f60c-43a4-ab1d-d65b51721d3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1e29e8c-9917-4195-b78d-151aa755438c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb0d53b1-2648-4ae0-a7bb-2fd5e0066083", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--088f3ce3-8d37-4b9a-82bc-61efe450873e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52c885e1-2e0b-4e32-acb0-cef4ce51a8e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a466c63-0231-47d7-9190-cc92b243cbe3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--132d4a3e-376d-418d-8f7f-b398a102c7b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a146708-794c-42fb-bf98-d749b0367386", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a5c45c9-362e-4493-9dab-e0b6e4792c40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--060adacc-79d0-4814-93e2-b2e201c27795", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32144b3f-3ab3-4a78-a1cc-0a18c680daf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fc8d9b6-119c-4a3e-9817-a854fab45d8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7366bf3-fad3-4354-a262-91fc5556730e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.107.179.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20efd5ba-56b8-4cd0-987f-106d016802d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.155.203.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3411247-dfa4-4338-b443-a2cb86473c19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.22.21.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10b14fe7-9fa7-4c13-b1ea-347e25178f54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.100.87.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c748b3dc-b142-4344-9e41-59899c0e0b51", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.102.115.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd827b44-5635-4e16-a147-50372eff8d38", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.106.29.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc18724c-a632-4a34-9aa3-bb98c5ee6d29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.107.80.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c1853fa-fee3-45a9-9dd8-7ddbe2cb29d8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.113.139.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55221106-e7f3-4cfc-9840-808507c53e4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.12.59.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d8528f2-847f-4e14-a50b-1e8a75743cb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.12.59.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97619ab6-f4d8-48d5-a635-887d2f53f391", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.136.15.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca4188be-7cf2-42b7-804e-5985a4d8a601", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.136.15.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--689f86e9-22ca-42d8-b16c-9639645adc5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.136.15.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6970798-1257-478c-8d17-ce94acf9bc04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.136.15.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c01d8eab-5ca0-4db1-ba87-c31e9a454730", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.136.15.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b08d0866-e196-4d9e-ba04-e5831a878f2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.136.151.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c746ad44-f9c4-424a-89cc-29e547dc66cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.150.191.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--465fb32c-7b06-4510-8224-c261b478596a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.169.182.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0b7311d-80a9-4f44-b760-0893269d26cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.169.4.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e91fcad1-bc0d-4ffe-8cce-01f4405378b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b58ee44-3659-4454-a591-bef4b56160d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b130dc74-b0c3-42ea-b2cd-2094e008c721", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43ee2dad-df39-4572-9e1f-e14a2c69884a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc56cc98-e970-4c41-b1d8-7de87394a8ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a302740-ec30-4239-af8a-cd32b4c9bef6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.185.80.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9effa3cb-ba13-4125-b5d9-7ff9c016e52f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.189.114.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24c55c35-ea7d-40ac-8fb9-6f8311a31d27", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.1']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f792065-ba7f-4a6d-8152-9c856c195f0d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6044099e-a032-49b7-b670-5e0ab5009b5b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e499bb68-d864-439e-9300-99cb8d6c1b87", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7925be83-7f09-4033-8a95-5e2faf48701f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dea1d578-6b64-4bbd-8ed0-ba1604d4b492", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5999c117-de5c-4ff5-9b29-667926343cc9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b6e913c-466d-4a64-abc4-26ba5ff0cb90", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fb8bfc7-b484-4929-ad6d-5559f6a01be1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0ad1015-1ff0-4f03-b8cf-6b993a9a436c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc49d75d-1058-418c-9b56-f455865d0067", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d038f7b2-eea7-4bf8-9c93-49d3a9489338", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5275a4d5-cd35-4333-8e14-f6e777b92398", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e427cc9-ad51-463e-a136-01b394c0f986", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f5bfb43-cce7-4c2d-a288-e62f9d75168a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6f82380-d439-4b08-a063-bd1b50cbedd8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09fa2710-4bbe-43f0-8427-c578fe531272", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83d11b43-ae9a-4b97-b47e-ed373df6639f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b73b8cd-320f-4c6f-bcb3-d4fe0b66018f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55d6e323-a472-4a59-9808-0505d5c5954d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.239.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--605b98b7-0fdc-4e1e-b5cd-088582319beb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.193.127.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2aaed40b-7983-4f14-8404-e9f4559d3c2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.194.93.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd93d17a-68f0-4043-9e92-b4fd2db6998c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.196.0.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14e059ec-9daa-416e-b33a-d43fc10be7e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4c0a69b-3c0f-4d01-9582-34223acc3bca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bed7a881-e8de-4d89-a855-3d5c1e9daeb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02f8b970-16a5-4003-ac4b-78bc5d91bf4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0878fdb1-f343-4a42-bd14-040a40b3d2fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79ce01ea-1e70-406a-b95e-750b627055a9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.203.236.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f42b1e7-2deb-4b12-91ab-5f2d99d86675", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.206.200.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51f86d1d-2f56-484e-9b09-929fa605797d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.206.82.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--507e168a-f1d5-41d4-9d84-4ff6a2419be1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37ddbd6e-f4bc-4a52-ab40-cfd2166624dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07329355-b86a-454b-b382-8dd541077561", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aab0da12-d7ab-4d5a-bc5e-0c738488ce39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bea2448-3869-4e6c-b355-709c86fdacc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--694169ca-6240-4594-9078-80a5ba4cd9e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f939af27-fb2d-4d57-bd9c-bfb35ee376c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4c082fd-7e8d-402d-8968-f7d282aa1a5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51d09303-de66-427c-a6c4-79d5b08478aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.217.0.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ea3146e-3c7d-4a33-8540-ee3ec994b6f2", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.217.188.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7c1c964-9840-4b07-8c10-114a5073a5e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.220.100.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28f560de-3bf0-497d-b88f-680a328b55a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d8e0d80-e5d3-441e-b897-baf65e083da3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c71ae07-fc00-44f0-92b2-5ad4f30f2b27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a965c41d-d6db-4f85-9a03-9cb323cfaa94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9049b6c5-fcc5-49eb-b7a2-6f1e1be38f0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--063e83a6-3b67-49fa-a270-3c39fab5974d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb9bcfd1-3706-4272-8bb1-2785958adfdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eacf68eb-5b90-4a34-a1a3-3cd42ba9901a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5857a7a-0a13-4f18-b816-b487c6dccc6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81899754-a012-4a4f-b189-c04bd29110d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--824d9499-034d-454f-93fc-270387fc7821", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--752230ad-d3ea-4439-8ebf-4b2eff548f03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--897c8cb3-10dd-4710-b99e-79b6b238e5d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d991bb0a-6100-45b5-9d92-12fc63bc87e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a314b10-6b37-4492-8759-a8888a31ea5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60004bfa-664e-44f7-99af-854a0e6317b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f4c3196-7f6d-4433-9923-fc3e96787fb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a89ba00-7782-4c7a-9ea5-56e2ff7ed5b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e523c24-61ee-4af9-805f-21d3a11bbf76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f994dcad-9043-4b19-8803-0fa85e56024c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60331e7d-fede-4a9b-9125-68f5ef5ba1b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf953ee9-8f91-47fd-a2e5-599444c9b4cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2da69c4-b8dd-4907-a113-070a0e97fd73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5841aa38-d720-4faf-a0b2-9b8815896930", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c63b829-312d-4d13-a43c-ef2a1d858c4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ec2bc82-52d1-4ac8-acac-d9f3cb46affd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02d3480f-27eb-418e-a06b-0c0081d191ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--844cd62e-5306-4d3f-85b5-0ab05715b4b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c62a30f-9dc9-4fc5-9638-0ebb312778ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.235.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7aea4fc-e758-436b-9e03-61683b63a1a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.224.128.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a61f72b-db46-4a08-908e-a7dfc2dc71c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2be1e11-eae2-4b0d-b0b4-6c9b554daa91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba36369c-9740-4c9a-8f33-64956920b90a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e77a1e47-30cf-4995-b3f3-8d8a9523d7cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e87ee7d0-85b8-4262-b674-178b5ada11cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e726fa4-2064-4d7d-ac55-a937d89f06da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5423a473-a36d-4ef1-9701-34bcf92049dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52f1bc35-dcd2-4333-a06b-16b89162f5c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c59f73e-2fff-4107-bc0a-87730f372544", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.93.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7050d3bf-10b6-4077-b3a1-8c307e883ccc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.93.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51542068-76aa-44bf-ae2c-fbcc0abdc8f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.228.72.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72201570-1139-4fa9-bf97-8a8e07e1c487", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.230.219.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08a2d198-e00a-46cc-8a6a-b2361544f915", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.234.62.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28bc3364-c938-4528-8d3c-ebeed2691174", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.239.85.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f08a08a6-a40a-4ae0-8ccd-3645f6998106", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.241.208.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abef74c2-b223-4421-b476-f25642c633d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.241.208.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a14e5af-97b5-45f7-abe9-d4cdd146b9db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f83265fc-3623-48be-b318-33485637a9b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--088dedbc-b33a-4457-9d14-7c3dba215b3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c68f84f1-e0bf-438d-83c0-8688ca2e411a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73d568e9-90a6-474a-9d05-93b138eb0e8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be2856b6-68ec-43ca-aae6-fd2ce5c44249", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6d0c08f-04a3-4de8-9f80-3aa30f507cb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a66b0853-4c21-4809-9453-6a2b5e45d34a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0799ad45-b72b-493f-950c-2b76fbf69fcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e299001e-9728-483a-abd3-e21d4dc0b898", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b5c00eb-1fff-4d6e-b570-4b317a7bb2f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3ab4804-b640-4d16-b0c4-22f3ed71ffbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e00a592b-73af-46aa-8eb7-d547168edbb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2a6397d-aa4a-4b81-842f-8ed85cf00ed3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3d7847c-8ce5-4645-b1a2-4b1433062a2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdf07297-4508-4475-b686-bd49c6b810d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a061a910-20ac-4955-a402-e27815eede49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d041a6c-cc2e-4f25-a757-071b9ecfea3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f890cf0-8795-44f1-8759-ddd09af7afac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f79bbbb8-10b5-40b9-8f3a-fddd3b6af06c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e159dceb-ab77-4aa9-a624-8a0df4db5730", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5153528c-4be4-4204-b7b9-0248ffbab5a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00910b26-be13-4259-bb55-d870e8492c8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26fc9cca-4b48-46dc-854d-378098ecabf6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfc82302-e96d-478e-b7a6-bbaf08ccd251", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28326572-662f-4d81-8b10-e3a723f7117a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c5e9882-6abf-4733-8add-20fe415ada38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--669080cd-0657-4c9a-acb9-169eb13c962c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fd5d631-2546-43d6-828d-215fe20e7659", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66456448-c444-4dce-bda9-6b3b1d07407f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b59b2458-0319-465b-b7a0-9519f83b61a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccad2d5c-eaf0-4836-9c59-69931163834c", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9f9a05f-fbee-4433-9316-fb76f47c3c6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22ce4145-124b-4060-900f-6681a4c35c00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6385ad92-f42d-41f0-a057-ce6dc964a509", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.249.74.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bb3ae2c-cf70-48fb-8e3d-53705664b56b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.253.160.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4196cd6d-55e8-4fc4-bddd-50a227d3ce8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.36.81.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76158737-37ba-49e8-bb90-da703925c05d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.46.78.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cda0783a-30a8-41bf-ac14-772fb4d12f5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.7.180.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14b40cf8-de7a-4e9e-b5fb-06ef5c67c71e", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.76.71.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ced2b704-b18c-4a02-85c0-f814a947f51f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.91.127.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9af10397-f282-41e0-8d83-a0fa415a7308", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6d09478-42a6-40c5-a3d3-285e4c6ac292", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--757c26f1-6d16-45a0-9c6f-badc32819eac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c486f671-fc6b-42ea-a3f1-76dc3c4a695e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--077b23ea-3f50-4905-8572-afae485f4ab9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b124d958-e832-48fc-927c-2ae06bf94e3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35104e99-d7ba-447d-935a-adc9bf5dde1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.94.111.1']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--349af2a4-d15b-4503-ae1b-257459a507b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.99.7.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f66daa9-e140-4bf4-9758-33fecead9fc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.1.47.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17a0e975-595e-4fd2-8fbd-5244ddeae04e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.118.142.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a33e42b6-db61-4df3-9459-3b07ff918ba1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.123.162.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9f15ba4-3fcd-4a9c-b0bb-15c4212bd65f", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.138.112.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d70976b-0c29-473e-ac9c-340f10344ae0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.139.116.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5b1e05e-bcce-4b0d-aafb-123ef8d4aaa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.139.163.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b230c3a-f3f3-4985-a8f5-69a494f3cfeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.139.75.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10a0ad34-4622-44af-9b52-7536acf2c3b5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.148.229.255']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9327712c-7b4f-43be-b891-02af41b458e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.155.88.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8c0ad86-5bec-4881-9c82-5b82917ffc89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.158.30.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83cc1865-fbc3-4f60-8eff-c4b29543e540", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.175.236.0']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f2069ba-37a2-46fa-8b33-2bf9cb8566dc", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.175.64.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2293a6d5-6dfb-4295-817a-aea1570242ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.177.190.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef108874-08b2-4920-b11a-27e7c5c3f52b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.180.175.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4438609-6ffa-4728-bec1-a7782e0ec8ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.206.190.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--253cee49-cf15-4779-a0f7-5a4567dbe0f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.209.190.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f32dca4d-777a-4848-a406-2f0c9cbbfb5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.225.136.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d0f5234-6861-4151-a734-c5169ddcd6ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.212.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38cde52e-c028-4311-be77-f06b8392aae7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.233.118.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1ca032d-bd1e-4589-a26f-a2cf34b79763", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.241.93.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb9d7313-bf6a-4b77-b3e2-fb47663613c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.248.198.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77f5f407-edb8-461a-bf62-a8e37d02d279", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.249.235.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eedd1a0e-48ee-44c0-85f8-63994da2ba42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.28.38.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad8c0002-b9b9-4196-b4a1-f2deee811cff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.30.114.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdbcc752-a4e5-42d6-8b3c-a77e4dc93ec8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.33.23.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e610c6e4-afd5-4e43-b6ed-779650056495", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.38.56.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7440a34a-0ef6-4746-9f8b-53cb82405e9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.39.213.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--134289fb-1ab1-4e05-88b2-ed5dac0fce7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.48.216.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e13cfc73-459b-4708-97e5-1bd9f2e55316", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.48.77.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba8cdc69-264d-4976-b7f4-17f55039856a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.50.19.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0c08a50-ed04-4408-8fc4-54fd9de8486c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.52.149.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22c5baf6-91c4-4c3e-bbf9-c880ee5f32b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.52.171.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbf275fb-de3b-4c4c-8225-cca3e60cfad6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.52.217.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12fb8a06-413f-4103-8a31-02ef2e6f86ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.52.85.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cb32bcd-0368-4c45-a81f-8deb1427cd6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.53.85.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70c81116-a6e8-42b4-983d-96dcfcf446b4", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.54.130.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d3b4d43-5a90-46b7-8bec-d84bad7e8405", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.54.132.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94af2563-d591-4d9a-bce0-25f7bfe97ae6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.54.14.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fce9bc69-7d68-4839-b796-8dc82d31bbe8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.54.181.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e156511-cbf0-44ea-9c76-05771afcd71b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.54.19.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cac3bc9a-bb50-449e-9892-f17477766c1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.54.208.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e52e9ea6-588a-4246-89c2-c2da1ea9e0af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.54.32.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99b56961-c3d7-4548-92ae-d0744d64152a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.55.117.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d1abf1f-64c7-4e25-9e2b-6890a60204bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.55.77.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6ed060e-69c0-41a5-bf0c-5d3db3e36d6f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.68.83.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6dd7af9-73ee-41f4-9112-18bcce7bed90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.72.152.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ed211f6-f88f-4933-afe6-3860747a4ccf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.72.159.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46729a6a-53d3-481d-a2e7-96aa0ac2362f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.89.79.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84f55a85-2b4a-41e0-b8d8-4727c4a0b3e1", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.91.5.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26496a72-5157-4498-bc5a-3422c9eb84e0", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.101.116.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa450e8d-a73e-4b65-adbd-de61e50ce55a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.102.231.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97a8d753-99e0-46d1-bede-85a6fe0f8a95", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.107.88.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7fc6701-6d69-4dc6-b022-7ab5351b1e51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.111.225.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c079ff3-ee10-4f48-8a5d-1d59f3537ac6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.114.123.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--923b5394-bedb-4004-b922-e559b58b817e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.120.189.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--576949cb-8bab-4615-9ba6-15795cac054b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.131.39.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67b4792a-e9ad-4fcb-a076-e10e5a346a55", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.140.15.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e06f5e9f-116f-4670-87a2-0bda4238b691", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.140.169.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b8e64e8-ec31-44ea-8440-0e9849c9f039", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.142.244.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3f5adcc-daf6-4479-a915-9173b8fdac1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.145.49.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93f824fc-233e-4c09-9234-20e9fa7db799", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.148.87.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c45b7ab-a8bd-42cc-b2aa-8a05e7011ab1", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.149.48.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--260a4008-5ff9-43d2-9b77-f79340840c1a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.154.100.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1cecc31-2f85-4df4-9385-540b8b51af3c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.16.96.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55cc9ad6-f978-426b-bc2b-c77f435146a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.161.117.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--839bdf0c-4f9e-423e-a497-951afcc37b86", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.170.223.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4cb16b3-4c4a-4f8e-ba80-9ee0227c4005", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.171.185.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a5e6e65-73c6-46e5-b862-5227a40ff1e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.194.42.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c9d4600-81a8-4a96-8a48-f9afaefabb01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.200.1.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76578a98-47bf-4c7f-8319-c0697d00a7a2", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.205.43.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e542f216-8965-4042-8c1a-bda3b64e3e06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.209.75.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d89c2ae-5a79-4c9b-b45c-22b1ab83bebf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.214.86.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79b51dbd-f6ce-41e2-8863-8e68e2331fa6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.220.181.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e429c127-e77e-4653-b6a5-127ecedba295", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.230.241.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--337ce118-74b7-482d-9825-2a523f483a44", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.235.132.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51d54057-786a-481c-aa49-bd955b156bb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.34.9.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae69624f-8c1b-4ffa-8839-cbf42ccfab7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.36.92.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a63e145-06b8-4e62-bc9f-bf91c9f727fc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.45.95.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--116ebb77-8001-4c2a-8536-b26568953ec9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.5.20.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8da965a1-0c88-401a-91b7-f374fdd0a756", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.56.131.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd46e67a-6c87-4aa9-ba33-422c3608b73b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.63.148.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91b35c30-02bf-4d3e-844b-e803a879ad13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.65.18.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84cc49ce-1761-443b-8a54-2f0f9620ece7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.130.160.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b35e1a3-b721-452f-9507-5a51e202894d", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.165.26.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dddff3d3-95cc-4b0f-a6d6-2d7bcd7d9672", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.187.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed59fac6-bd41-47af-b1e9-123afb7e3128", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.215.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d78f4784-eae0-4d93-b2bb-cb1f3fcdaa4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.51.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37539fde-24b9-4564-bbe2-53915b4c9d4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.68.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99e74e3d-cc4a-4ff4-b7cc-5035ce2ed830", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c605f5d-bc98-4ca6-9735-ae75fc304e34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b373d6f-7678-4f10-bf59-dd56bce93a73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43e6166c-de9a-49f3-8b78-9b6faa87eb45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51dc7e5e-bb3d-4da8-b287-b89abddb56b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d0e351f-1ece-44f9-87ef-9ced05349008", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bc024d9-4561-4cba-9be0-42063fbf913a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--603497a6-ced9-4c59-a1a0-53e14437c313", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--229888c7-4f0d-4e6f-944f-e888cddf2d29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b50bec31-1139-4037-9541-2bbb46020f6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f2a08a0-208d-4cf2-b049-08e227596d59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b877bbc2-5256-42d6-a5fc-fd0f85a898b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f36af7a1-c716-45f1-ae16-153799e4931a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.247.83.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c46316c2-7187-4a85-8518-ae1a6de47718", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.252.189.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b32afb6a-e460-4d8e-9fd1-066cecb0c28e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.37.131.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bf33942-695d-4ff4-8f86-d5fffd4e9b5b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.40.21.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f63f87b-5453-403c-8973-412e265add3d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.69.225.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10cd8d5d-863e-4309-b27e-da18b361bd4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.92.79.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--359b3d3f-1139-4349-8583-72d992eb14c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.129.26.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d7e38f2-4637-44d5-bc69-6597367942a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.133.154.0']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d0d8081-1655-4496-b7d9-5e7ee106f6a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.142.102.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce9bad3d-cf1a-463a-8e36-17fef16dbcc9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.146.252.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5d396d5-a412-47e0-bc7c-ffce63e7c6ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.156.116.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5836adc7-3686-402c-ba7c-7fd59041bc1d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.165.70.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f40fbb0b-5fad-458a-b9f7-ff412212d8cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.172.205.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb8aa7a3-883a-4fd8-b925-e7344984a28a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.174.71.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bbb0565-8bcf-4940-a536-bc700de7dca4", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.179.210.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86de81ea-0a6e-4ee4-be4d-0562fb515806", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.18.162.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--607c4f64-3cdb-4986-a0be-39db73e52de5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.189.22.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddc8bf09-2cb3-45a3-982d-15cd8561eaf0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.190.200.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd659b66-5d54-4b01-a89b-a0306c08687d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.191.181.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67d7a1de-b516-4e97-b679-a77faa8d4d0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.216.232.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1fa3c80-5eb6-49da-89ec-f1ad382fcd92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.219.53.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ade513d-23f3-4421-9b70-878a7eb7fafb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.219.98.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7554a875-dd85-429e-bcfe-2e2382c4b138", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.225.244.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a33b5fe4-235e-4762-8cf4-020e8fc6c7d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.226.224.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f79f012b-3c4d-45bf-b88c-73b4cbd5585d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.244.116.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15db7939-b130-4fe3-92d9-d94c64c57e23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.252.91.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30ed4999-d84e-4b81-9f3a-a9432f116dcb", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.29.221.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--479f7bcd-0763-4825-9d39-7a218cdab240", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.50.35.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eb67c75-d19d-476f-8bd9-08b396e08461", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.68.197.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d31d65c-afb1-441d-a593-840fbb85ce7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.68.42.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53ddc1ed-8a88-46e0-a635-767bae9eaa6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.69.10.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7f66deb-b9c1-43cb-aec1-60df37268cdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.80.71.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--520c1c16-b8bb-489e-8310-b9fa90073c61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.91.10.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84609682-4f90-4540-9a2d-81c9c01d684f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.93.77.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a29f9e97-408c-4af6-8e69-c112a8b3255e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.10.8.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a97d531-c076-457f-bc28-59444ab9b13c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.103.180.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6303d687-43b6-497e-94cd-ae339d46c436", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.104.234.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2529980-6a2e-406e-85ac-7f4a636fe117", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.104.36.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c2073c2-1abd-487b-b13e-e5f3aea2bee4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.120.248.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17ef03d6-799a-481c-af74-6da93439b845", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.120.250.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a2bf439-8cfb-468e-89d3-9e22f417b8da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.121.136.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca6199a5-349c-4fd9-a082-c79f50880e60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.133.140.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfd33d00-4b60-4b47-ad4f-05cc8b600307", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.133.16.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d986e9c1-6abc-4a60-8624-d2d53524ee35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.133.198.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bed2d4bb-5b21-41c5-be0c-645c5e840a38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.133.22.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72992ae4-0997-4e62-b786-7c938d9634f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.133.252.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--697f0574-4d6b-46c0-8666-430bc0800a27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.133.252.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee56ba63-e6d6-4b3e-b0cd-bc0e80007c30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.134.131.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--759fea2d-5422-4bc3-9ecb-92793a9975ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.134.145.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26cb2881-bf21-40ab-906a-2bb38db14903", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.14.224.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b352388-971c-4676-ae2e-8f0ff7a72d61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.140.152.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78e6eb89-c6cb-4f84-b112-d3421df13732", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.143.252.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c96867a7-8379-47bb-b2cd-9dd989fd3972", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.153.102.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--106cf214-35d2-429e-9eea-b5f967365d40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.161.36.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e69e4d60-728a-4316-b0d5-a1e8ccdbc509", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.167.237.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c99b471f-fc96-404b-a404-b641ae403e0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.17.137.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a467582-c916-4ce1-99f9-eda19f6fda64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.175.10.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1835b1fe-0cb7-4f2a-b88b-4412b96fc32f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.18.226.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b747251-cba8-40aa-9eac-7fa57fba96ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.181.4.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d185c30-e160-47e6-b1bc-149773561c6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.184.231.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b05b5b62-bf6a-4e78-89e7-b8c8c32c65fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.194.51.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ae38b47-c2e7-49d9-bcd0-eaa57e3d7730", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.200.243.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4029a02-2fa4-4521-b063-a7a3ecdd5607", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.212.216.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73133ee8-a9fb-4872-b73d-5c064314237f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.217.20.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01b6b93e-c502-49ab-806e-c92284410787", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.218.175.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef5a805c-7a2f-4396-8cea-05ed70392bbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.219.216.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb67ef57-4a17-4229-9e70-10816ed7a111", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.221.50.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3ca0ab9-dc54-4eae-9e9c-6a99006bcc52", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.223.60.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca1c760d-fd22-490e-9d79-c5140c35e2e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.227.87.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--755c28f3-fa1d-4a89-bfca-9c6f767329b3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.244.39.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d986053-50d2-4243-a37c-64668e9fd772", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.245.254.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ed18d8d-5238-4a33-a505-0acc9ec375cf", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.32.246.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8a9c10c-54ed-4d29-ac4c-5c39351f69fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.32.59.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d441dcda-69a3-47ec-a43e-2cccbd4326d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.33.18.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc7dbcdb-0822-463a-b000-cf2854deb241", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.33.217.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96c03478-0056-48f6-b191-0e1b60ae2e94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.33.45.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a44392f3-2c6c-49b5-98df-66b29f537696", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.46.130.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f02d5510-e84e-4a3b-8c74-43b1c70b5bba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.52.97.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2be22977-91ef-4086-a7cb-586d37c77a7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.53.249.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--754f786b-246b-4145-b68a-269a31cb318f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.57.83.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f15e0deb-3e32-4c87-b125-be56ac02d549", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.60.37.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa9ea293-663b-470c-b27a-50373a80fd63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.60.47.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--228e02ae-5b2b-41f9-b012-6fbc121c84ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.60.51.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f09cd1c-78eb-44b9-b677-1827a2eb7f3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.61.102.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5e1f05d-8a6d-470e-a1cc-90831c5bd2ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.7.58.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--729da5f8-739b-4434-be5b-fd7c3febe0f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.71.28.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0abc134-a608-40cc-9cd0-e8c55066e546", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.80.24.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a13d35b-3bed-4808-8ab9-7a4ea476b728", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.80.5.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67660f12-d22e-4eb7-af4f-91d20e0094c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.80.50.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c286ac3-a8ce-4b11-a1ef-b5c5af48d397", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.89.184.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--628276b1-90f1-4326-9f4d-19a0c4946e5b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.89.31.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--501bbebf-ceec-4f99-a7db-64be736398d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.9.65.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c63ff8df-5c94-4b0c-8644-4b30fd1560ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.90.83.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1431d034-e35a-4679-bef5-f20d92a0f189", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.94.201.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--639eed6a-a5c7-4ba3-ae1c-a9f772f74c7e", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.94.212.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c827a9df-b704-4a75-9c14-a6c017a09780", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.94.56.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2a61a30-05c3-4e24-9d15-df5f45cd41ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.97.242.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5558ad9e-d4f5-44f2-a066-93988fbab277", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.97.247.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed2bd0e0-3a78-4435-90fa-95c488396556", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.11.32.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d2b8eb6-dce6-47cf-a84a-c956288f5db7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.116.174.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74b471cd-8aff-4856-903e-40f6a70400ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.17.127.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0285248d-2baf-4407-831c-31e45660922d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.179.68.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88e5b587-bedd-459a-a1ab-252879baddab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.186.31.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05bd07f5-2357-485d-854c-e6b118891e46", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.187.132.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--076e0c33-eb0f-4376-9fe0-490ab56a89d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.243.204.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5412379-33b7-4f1c-8220-a934665b5ad9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.6.31.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e6dc128-5139-4c34-a2fc-102458bccaef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.81.49.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cc82549-bc9c-4a8f-8cae-85b817392447", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.98.221.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aec8d9b4-de68-486b-b6e9-e7fc43dd3755", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.109.200.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60feff58-d5da-469b-a875-8b8d399ea72c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.109.200.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d64a9aa3-7a90-4e44-bfc9-0618d8ba6350", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.109.200.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38417088-00a8-4a58-bc91-fbae7fda91f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.140.101.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1620440e-5cfd-4124-9c07-5ee58d2ca2d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.141.188.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a52587d9-505a-47dc-b629-b3b63394830c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.143.254.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--875776a8-8cc0-4b65-8eb5-22c239a3cd44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.81.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a0ba363-3079-4ec0-a053-df79bca945d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.84.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69fc6bd3-bcdb-4f86-9b53-444f132dc95c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.88.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ab2c340-708d-4c92-9aa0-f81b27aff1a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.90.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64c66f94-8957-4204-b681-045c09ba341f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.210.198.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfb05fe6-0fd7-433c-89d3-dcc36028d15d", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.223.121.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78a1a7d2-ac9b-4750-9562-fa538c8ee676", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.235.106.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0ef96a0-d70f-40e6-980d-0423fa9c7257", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.241.150.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1384648b-7193-402d-a12e-9fc93402f0f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.241.179.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53755052-8734-4de5-a822-e2881627b843", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.241.222.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d7d2cd3-c395-47a6-b1aa-61431f216a09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.253.248.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--776ac31d-117c-46c2-b08d-911f0911d245", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.253.248.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f14e75c-292c-4acd-b14b-4fd7ca0a0a75", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.42.116.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4c2467b-3141-4fc1-9ea3-d952a8e56a2d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.67.197.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c5630c7-4b4b-4ffc-bb9b-1cee85bf0d6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.81.209.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17a489ca-cfc5-4308-afd3-85996c018c03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8693631-b45f-4d42-b609-104d9f614ab5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c4d8130-6a13-48c9-8c80-9ce29f59a551", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b665a62-132a-48e6-a431-060cc4f0d157", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b501c468-5967-475f-88ee-0317480dfbc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e06e5b4e-ce06-43d5-8ea7-1b5deb76a3c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd439b0c-1f17-4866-b214-771e97d6f836", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a03dc0e8-a7ef-4e70-80aa-ee03f43b4e83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75f16067-69eb-4f9b-a82b-66410c091b77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--833ec465-d30f-4a21-aeef-5675fd1ee464", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c60fc70-0dd9-4192-98cb-5e41b999a046", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--375e8a05-1c95-4a9a-aa81-a6233587a023", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96c49cf2-13b8-44e6-83dc-34c91eed18ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b618a63c-1779-47b9-81d2-8ba04ddefdea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee3b194e-d400-4761-84ca-efd681c7f375", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f1b7bfa-b357-4abb-8a61-3780f08b94d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--394fcf39-bc39-4a08-ad7d-01df54650f42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60118925-dbe0-4962-b264-02afb4f267ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c676a4cb-5332-4df1-b1fd-d7168c2b7dd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43e66414-2615-4663-99b5-67695f3564f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a85044ff-6e96-446d-a070-adf6486a242d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3896ab2e-78b0-443a-b00f-29d863a2d3da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40acd1bb-ba58-408b-9c6e-83823812465d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c2577f6-cda5-49fc-9370-393d3610c476", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98e6d303-e914-4e11-a05c-d80b97402612", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c405a0fb-cb89-4c9f-8be0-8a9a93327203", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--947a8204-1d8e-4383-a0c3-8548a5f628d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8fa8133-d000-4850-9b26-a5abe718f2dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94507918-092c-42cc-afa3-faba54b30e4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e01c46c0-fbac-45d7-807c-5dfdeb952b3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb4a95a1-dc9d-4ebe-ae73-bcb52177ee96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21d88989-caf1-46ab-a2c6-a39887950ea1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fac2cc3-2bb3-4d16-8ecb-5f5f3d751ffe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15f78039-3e5f-4fb7-8f7d-86effa8e508e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b42e689d-b0ae-4d6c-bb82-e18216550cb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44548630-2580-44fc-8521-62a53969a999", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ebe5670-c78b-4b16-b2ae-be5ba6ce83a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cf1a616-bb40-48a4-b8af-fc6f1b975c45", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2a9c4c8-43cf-4881-9436-dc7c8049efca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.169.194.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55a6bf4b-5c61-4bd6-b29b-95d3f9eb6493", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3b98fa8-2afd-4504-aa23-02d67ea59a38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7626ff81-8263-441f-9cff-1ea13579a99b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba5fb3e8-9b40-402e-9a0c-784f11aabeeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67521f35-c57b-4ff1-999c-b750e60f5ed6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7e3647f-5d0e-4aad-8d0c-3359be88fea3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82a8cf36-8b99-43ec-8354-1dcc36700b03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60e170b4-3c47-4a64-8fad-ca8278959f8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de7fc1fa-5cde-4618-b927-a662c816e204", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ae8fec0-c51e-4bd4-a332-d95c3e2ab750", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b22826ed-6e81-4170-b834-82c5a96b7482", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27167e63-35f1-43fc-8985-37cc9410082b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--244c6f76-1386-4946-a0cc-572ab1753db6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca360c87-3a58-4b5f-9c04-2fceeaaa2d31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31bf2f0c-69fb-4847-ab2d-11b5d44395f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a17fd839-d84b-4911-9f53-023af53f9142", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e2be9c9-dc92-4b4a-bdb8-381b5921a613", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e111de0f-97b2-44bc-9af4-abaf80b88caf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c1e08ce-f96f-4443-9b56-9fc75956b58a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e8f9f76-3345-41ca-ad54-af5a3d220b9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5899e9ac-50a6-44b7-bc29-419f959ef23f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18c6a50d-bb56-404b-97a5-59a56c68cf56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49e9d286-ee85-4910-9086-7b1fa8084489", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22b86372-1450-4f64-9061-2dd1ef30e26b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0b466e6-7e33-4367-b9f8-ac35a638197c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12aec00a-d85e-44ad-93d4-2f4f65f3ec9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5999e8ea-067d-4556-90ba-16ac0729c6e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b643a5d2-d7c2-4737-a6a7-3264a922e4e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5d2eea7-cffa-486b-8a18-ead33d3ea5f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7cdd55c-2d53-4d01-9de8-35439859571d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c40cb7b-b33a-4e7b-ade4-d7c4b255b5c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b559eafc-d0bf-4fa5-bf3a-50b6b5a9fefe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc243d58-c35e-407b-9d47-a8ed8de28f6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b21d4652-65a4-41d9-b61b-285f606f7178", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08657b2d-d3c9-43a5-aeb7-d68edf7e7f3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--204eba40-a99d-4160-a56d-01baedd7ddf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a24a4be-802f-4f23-9c8b-712478d91b2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c765dae1-8104-4859-a185-a91266974261", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.31.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc8de11c-80ae-468d-953c-e6e29d1a45d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.22.147.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7511c473-7e17-4d6c-a42e-ee4b091eac10", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.221.200.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--893bdba4-ae8f-43c3-9041-4050fe6a8bcc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.23.126.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e86725b-b41e-4f4e-b728-aa46426f4edd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.233.48.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32cdecb9-de03-41d5-8238-79ba9f25b0d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.211.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--614b2c68-0db8-41f3-91c2-dc47bb209a61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.211.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98ed78b2-fc98-48a9-aafa-23bc0e5cd9b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6138a1cc-e495-4231-93c3-e769692b54a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ea7a628-8476-437b-89b4-17c82e052322", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdb412ba-6295-4252-9fe8-b63adbdbbc1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08f86439-990c-4093-bd8e-69e640fef5d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98247e87-8d09-4d02-9504-b7c9bdc58527", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.30.14.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c7afa52-ba3a-494b-b285-b9995ea32054", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.162.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3f2ee34-e64f-4cda-9945-699a82b147e3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.162.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96988f86-adfc-4731-b789-9283536d1f45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.162.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebf14cc1-d7ca-486a-82c7-13022613ee38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62a8d3cc-6390-4d83-ae22-8db2e5158eb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88599c8b-0e9d-4aa6-9e5e-9d8e2c62c356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf571455-df30-4cec-af6d-a41b23fb8012", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70b93b98-40f5-4460-a7af-45189138aa57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a1ba994-9cf5-4ccd-97e3-c60aec298bab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bac4dd6-24f2-4435-a310-45bdde216075", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c430bc5-bece-4ff5-8e42-21c0bfc09890", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca8aad60-f812-47e3-a5ee-c084d7cb9f80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da7261ec-c1dc-4486-a4c0-3bb50900c123", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8313e404-f283-4612-937b-516f89944867", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--857f6947-7fc8-45be-942b-46dd6fe1f9a3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.37.33.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9d4a6ce-bba7-4bb7-b5bc-80c895a6d4ab", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.39.208.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--031cd23e-5649-45a6-8ef3-2f28c4fa8861", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.43.140.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--036eb2ef-0643-4b3e-a01b-8d220c987e7f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.43.140.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcca092e-b89b-4d19-8a37-d9a8c2bdb30f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.43.140.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccf58f31-6825-4991-8d6d-78dc3c2148a2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.43.140.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b8deeca-5adf-4060-9c43-f3314397f299", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.43.140.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92c25e9a-f573-47fe-91aa-629f0d7d47f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.43.149.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--612f4d75-d3df-4fb6-a319-f9c7149a07b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.43.159.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f466796-ac88-40a5-9dc6-093c9064e351", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.43.159.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35a4c114-ec16-4073-90bf-31a86e6a0df0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.46.255.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9bffc7b-5f4e-42ba-9e6e-09453b279907", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.56.116.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6590f8ee-7b35-4b73-bf3c-9d5d4477b4f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.186.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e165493d-b782-4ec9-b945-527222c0c731", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.186.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2771b4bf-5542-463d-871e-98b25e58fc30", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.107.115.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6791f448-7902-4623-a789-2bff717a473c", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2048178-eb01-418b-b99c-9fef63890aea", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bddbd196-dbe6-4146-8969-0debd76914da", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ef782b5-818e-47ef-9965-6efcd58a3081", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ddedab8-fc4a-4701-82a6-6908ec2617eb", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3e47093-16ee-4bc3-8bb7-931d15c61f8f", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba07df96-4d75-4677-800c-5c25b8de82ab", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ff4345e-5520-46c5-beb8-76a7a4372bb2", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7781509a-356c-4dd0-bfe6-b7c59c09900b", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1fc90f3-da7c-4942-afe8-2fc1d08d9d58", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eebb677d-4f5e-43c4-86a9-59cece8377e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.15.52.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07bfe5bf-9a30-4636-b875-66b441125ff2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.164.107.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7292ea72-87c6-4cee-8e51-217703701572", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.170.189.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44c1651b-825c-4c87-a13f-69bd4c8592ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.176.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca4651c1-1155-48e4-afb1-981a8fa5e4ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.176.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e742fc9-0efb-4bea-8a62-fa732d44866d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10d0e3ef-75f7-45ec-b77b-b83ed954a3d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20f11a72-ae8d-436a-95bd-d04297ce08a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f66844a3-9be1-4b58-bdf4-8a5e387cf8c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.195.210.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4153c2d1-dcaa-4783-b0a2-7efec7ebd64f", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.213.3.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76285d3b-74f5-48e5-97a2-1b9ed985cf76", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae6fd854-8ab0-454a-baaf-92e1bf7da633", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5c4f277-114d-42a8-980e-b68115aed60f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60e958d3-7b73-4a26-ae53-dc2c5f624164", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa7a6429-cd56-480d-b61f-bbc8130259c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb87bb85-6a99-4160-92fe-8d13bcd63cc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f01b62c-dc2e-40b0-b511-9e0d9dcf5532", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e31c9812-4677-48c1-9ec0-e3e53ced4182", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6ab8141-1e04-4810-b198-5ac152b4fb69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.59.206.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc0757c6-4c94-4c1b-aac5-77cbf0dfcf23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2963999-520d-4699-b9fe-8bfbf781ac10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80fb46d4-d4c1-4916-a67a-6fcc071a9d9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a30187a1-6c9b-434f-aafc-380df6c21e9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c4fef2f-dd74-4e40-8589-2481b55ffa98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0589381b-4109-4d3a-8655-b1884790d12a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cbc0ea9-f536-4c64-b5b6-ec3a208dd891", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f346f35-fc56-4d0f-ae57-efe54867d1c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8f47c55-8289-4f89-b25a-b463ee86fb1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8da59d0e-2af5-451c-aadc-0b5c6b47e9c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75a86e26-4109-491e-a65a-edea8bda0521", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.112.228.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dff896e8-d20b-4b71-9dd4-b16d2efecc86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb681bf2-7c5a-4799-b6a2-42f0d9e4b1a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8e8b9ca-6e6f-4829-a598-e4f6decc6b98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4c15996-09c3-4686-b90d-16f68be100f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--606cdfff-269a-463b-bf08-749221774844", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8b1d1d7-d87c-457a-a694-b7e647ea1ae0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59a4ff6a-070b-46ba-a9e9-f3993f1b2f6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4167ab8b-f690-4717-86a4-83fa23ca9df2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21efb344-fcaf-476b-9822-cf27c3037b57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03ebee8a-9043-486c-afb8-2ac22d1d8e3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf0ff085-1e08-44af-b5ef-697766df1492", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.142.136.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ecfba22-de1c-4268-9600-becce67eaa08", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.154.118.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6870c76-0d20-43dc-8648-9f3140bd7a6b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.158.4.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91a2ef40-5eb1-484c-8f54-00a9cc4f0260", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd3c2151-06ee-46e7-badc-3753138de4fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1710c293-ba9d-4bb8-a5f5-8eebc2ed578d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--214e2348-dcee-4626-a3c3-1d4703630e47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d4d99eb-c218-4d4d-b55a-d510e5756bf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e71c1db-8827-4ac6-8a68-22b0e2af9559", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--918387cf-ff12-4144-9090-81fd7747de39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6360081-05a1-4ed2-9410-c495d7e774b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aaacf6a8-22ed-43a1-97a1-fdf06ab43e1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd792e62-612b-4326-9394-5609684f20a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b105ca55-e2dc-4a6a-83cd-0651f4fb3126", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06719933-6b22-43cf-8c76-9868e507208e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ae15b81-aa9f-4669-be3e-8de6885137c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d44093a3-c770-407c-bfa7-7b4d176b7cd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5701167-8b13-4ebf-a351-daf8b586ba39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ef77cb0-7059-46af-aef5-7184c44a53a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f2a8092-4d35-43d7-a871-94781d977735", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d203b1a-cd5f-4def-a08b-9b0ec4b323e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba0d49ed-d9f7-4992-afaf-7a49273c91e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed38a64f-3f85-4e53-9237-b5d5dbab34c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75a5486d-a721-4bed-9478-ba24a59e3a5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa91e9d6-1ea2-455a-8ddc-512c8837530d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--909fcee7-cd64-4ab3-8a67-f9251d0dbab0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.211.99.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e674b569-7db4-4ba8-ad29-3ff2a15851e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--984d7685-8306-4d93-913c-99b3a22ddc78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fce005c1-9fc9-45a1-887c-a9f00e5799a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49c9a622-c272-47c2-9000-dfa8ae57ce79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53728b9c-a82b-4d6b-9832-b7ec131a1daf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68b2bb92-3adb-4a30-9b9b-d444096892d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.119.195.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b83f9e3-5588-4207-a6f9-78ccc2af0c6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.130.56.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--596c4fb4-2151-4b45-b056-42d5977b7770", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.196.53.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20e8316a-fbaa-4c61-b5d8-f83d9d84ae2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.204.71.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52496ed5-8448-4a6a-8259-59852e6d5aa1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.219.0.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02a0a3dc-051a-4a5e-8e15-45c31cdde7b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.238.141.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7715ee01-3799-48e6-908c-deab0656cb62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.250.95.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08534478-76f9-4608-9201-4065382a704d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.39.212.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7602955b-5a5f-419f-811d-7bceca20d2f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.74.218.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f33d3675-17d9-4f75-9d76-a7f8b1f2c33f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.75.34.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca0c2df4-310d-4757-bc6e-2e38cb77aa95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.14.253.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--723aa12f-2329-41e7-8d75-ee23fdc25b90", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.140.11.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69ce730f-42fc-4f4e-af5f-6fcb9c6155b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.185.169.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b04d0e37-29f2-44fd-8eec-8c6f87b4c29b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.186.15.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ba1874a-3ed4-41f2-9b86-943889e19ad7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.186.15.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0255fbc-79fa-44c1-88c1-195ea1b8d8dd", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.186.6.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb09f746-f626-470f-83f4-06d716d211d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.186.9.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f282829-4ebe-415e-b097-f963e3b566c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.186.9.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a242c9d-ed4e-46a3-9b2d-ee0044c9e36b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.219.32.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff41f65a-0bab-4748-8525-34816fc1876f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.225.146.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--302fc47f-83dc-4895-ade7-d0e4c4d90b3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.235.16.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff69b0e4-cc9b-41db-bfc2-2533c7d61125", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.238.177.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2218e51-92b6-4f1b-ac7c-90515bdebde7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.243.0.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf78c183-c4f2-4e53-9f40-8741686ba88a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.243.14.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31e525dd-01a7-45a7-b9a2-4875c5ccdeb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.3.97.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bddf13ae-82b8-4fdd-832a-59be09799c13", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.44.15.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c95f811-ac47-498a-b6a4-f300990dfbe4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.5.145.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--341dd8e9-4b31-4b07-91e5-9bca5dfa9d17", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.5.145.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ffe5ef7-3fb2-4a3e-b87f-002d9767c41f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.94.219.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--320e602e-aae7-4f67-97c1-9540611053db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.11.179.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9f2f1a3-b595-4912-b57b-cb18f09bc1d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.11.181.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17f97b10-f1bb-498e-b1e6-a72fb3762921", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bee75213-3edf-47c7-98f0-5204cc7f4a44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1476a605-a805-4e1b-b620-90190c88d6f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40ff8754-c3be-46e0-b112-b727a2ecfc07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72cac501-bd47-4439-98d4-29d3a3e32e32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4575a247-5e67-4b33-8ae5-72efc88aec99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--210ae951-a58c-4229-91ff-bcc9801b31ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a33dad68-9ce6-49b5-b2f8-58b8e8f8df50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c065894c-b30a-44b1-835d-ff9ce1b868d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4062f95-352e-4e90-a808-5560f46f12be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46b0f7e3-0ed0-4dd0-9a9e-24bb9e8cf407", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c816d24-f780-44a3-87fb-54ec0fd072d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6687c943-0cfc-4a82-adb2-eb325f53d855", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6171629e-aca0-4fdd-8f10-d6cae831f73d", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a4df1c7-f4bb-4a7a-ba09-dd8b65121843", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adaa4473-479c-48cd-91ae-bd5b2b9c24f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--096313ac-5ded-4167-b25f-43f911940847", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc1e454c-3f9c-467c-bbbb-9bb3753a4a87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c46427d4-eaca-444d-b9e2-43283233c192", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fad9271-cb6a-4afa-b3b3-d8c4043a091d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95cf4127-a576-425e-a5fc-6695e4c4acce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45a5a048-4376-4131-af52-4b09a3a000c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60b9f6d5-13ed-4180-9503-a5974849b94e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff4ce834-0df6-4e7b-9e6b-aa16ca74e714", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--621aeaca-8979-4587-ab80-3e1ea674a5f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c30db0c-66f7-4c34-aad9-3db47818291f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6cde41f-5451-4c0b-a02b-cd697f1888aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1164e2f-41cf-44e3-b588-1e52df261022", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--560acd34-8e22-4a3f-a57f-138214a96535", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfc1b1d7-f576-46a9-8c53-864cd7326806", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4590b1fc-ec42-4edb-b549-3998e1536f2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a7e0bec-93e4-4d04-ac55-7aa0a53abd4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0e7d02a-1767-40cb-9046-a963071b8548", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--633b452e-ce99-4ff9-9076-4e9fe5c86d29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdf23761-2642-4e37-8b21-4d97314daec7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd06f198-b518-479b-ac34-585628cc12c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e411406e-8c4f-4b53-bac7-cf732a7605f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f32dcfe-22a7-4960-8723-835d7a378354", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cec94d7d-4399-4497-9298-c53cf61ac2f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0aa25aa2-9964-4cbb-a036-703012dfbf5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--612235f1-3041-45a6-b681-eec3c72d812d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4f741a5-ff50-49a0-ac1e-b706b60c2815", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29350756-03ac-490c-baae-f4ae37c879ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07c82e53-337e-41ff-af25-4dff79f78079", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e86e8a21-54fd-4dfa-9b44-a03f91c60c81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f8f83b0-b399-4f51-b7d9-b15ebbc1a795", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32928295-661f-4f5a-b042-2512e1eb9710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c68eeb43-ce44-4aff-a04f-6a4c79d87383", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db5b128b-9d01-4661-ac16-987072fbfe08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83ab7813-f1b3-40ab-923c-d8301584920d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5f49d2e-afdc-4d93-9750-3acaeb1328e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ef702fc-7436-4498-86a4-b35506c6631f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f88b829-7ad2-4a80-8f49-fbc79d6e2639", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5bebf2c-af66-4173-94a4-2af9c1c35c6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c3affa1-375c-450c-a90f-5be9f904b4e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dd75fed-2a9e-4e51-8957-da5f8536a3b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c6c1c51-d382-4389-8fe4-d99da6e6cc08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce6c6136-140d-4247-ba6b-a79573d91cd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc3fbdde-662a-4778-a050-ed82379a41a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7057f1a3-1a88-42e5-b84f-ac6836d2fdb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9054cf8-ea45-4bba-af98-8da80921043a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2cb8fd6-3b79-4dd2-a731-5fbc3e0c863d", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5135fc05-8d60-44c5-aff6-24e78426e842", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffa363ad-0141-4973-8b98-73ded8b29946", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2b49175-a2f2-4d42-80f6-0503321e1140", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04281871-eadd-4d76-a53e-50fdc9941b91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--734a1578-f919-4fbd-afa8-05f918f75039", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--570efc52-4025-4322-ba5d-5e1329c69ffe", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a30ae8a-a765-4d1b-a72e-6ff3ad8fbba4", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fc3021e-bf2b-47c1-92d2-f66c46703473", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24cddbb1-7688-4556-b598-5f8f020763d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f670190-75e6-4d6c-9118-7ebe2b4fa66d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb2ab949-a981-4f96-8092-b276f3d2d6f8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bfbf00d-8caa-4b81-a815-2874793b8e94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1dec52c-9b01-4403-a9c4-7156fc1093fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b5573ba-3d25-4c89-8b26-54af78ac3346", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f9215a2-4eea-4683-930e-97074273de2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36eb08cd-beec-4f32-b67a-6a8dd9adb981", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6cfdf3d-5941-4c44-981e-e8b331933776", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b72de176-a1cf-418e-93b2-6af6808c931f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e8e5bc1-ecc5-4748-b9f2-c363ffd2ff74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.255']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e899f82-2520-4620-ad66-fc62ece3a642", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9ae60c5-379e-48f0-bb2a-209e178c1f32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf8455ab-1f30-40af-876c-1fbe80fd2d35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f635fc6f-028f-4e5e-9012-0d69c18b7dc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba23eeab-e80f-4a83-8af6-d64950124f7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df7a56aa-e260-4cdf-8b49-b9e52ff770b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de655f9d-41e1-490b-9e2f-7cab5fa6dab0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdf9522f-45de-4450-bf92-ce063368c3d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c7aa601-5929-49c4-9953-91222dd652c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a01cb4cc-0eca-4839-a776-bf293fa4ae90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0af46fb9-6d7d-45ea-a99a-8d7845226a6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d32c0da9-6215-4a0c-8dc6-e9854c49cffe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49b59ed1-6ec5-4170-ba55-897f2fd95f5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6c12140-dbdd-4789-bac6-cd7885fec574", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6beff73a-0c7a-4976-bced-1e4901bab938", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bf914ed-d9d7-41c3-b121-9587db104520", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed2ee94b-16d4-4065-bc6e-ef3d7108661d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--263869cd-da1e-4fcc-8521-d6b35685ecb5", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16174540-926c-4112-8f68-b2087ec747e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2467969f-a69e-44a6-8c4d-a3f812df205d", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrparis", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6666c237-9508-4819-9862-af502ea5cf4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb0a12d4-5a32-4775-a878-94a5e94b2c36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be4b4d31-3600-4bd3-adfe-caa92656ffc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6320a8e0-8365-40ca-83a7-862a48db8101", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81d7cdbb-f196-4413-8d03-844c34f90978", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f4a429b-67d5-4391-96d9-d3c64db91a5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0e3ca09-e6a4-4b8f-afd9-2a87a289eb77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b163d029-e871-4657-8735-902ac7b56305", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43905e6d-15ae-4881-a53c-1923541a5607", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af27e9ac-0c37-4e5d-b74a-bb1f0b6b0068", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efdbb111-0135-412c-91ec-49b823df99e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--388eaab9-b7d9-4ade-97b4-8c0962a06e37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03029f64-b6f1-46fa-a0b0-dd8f5f634f75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09791b52-6120-4a3c-9a84-db96ef0431ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c7d64cc-52be-4e99-9f0d-d2d75a8923dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddb8356f-fb33-42a6-b86b-66c78018386e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe1ebf79-2cea-4ec7-bd14-7312030f034b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac30ee05-ee56-4f57-8b16-09b7817c4443", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a59e40fb-3f73-44c9-bc4c-9c83ef448be3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df65aecb-81be-465f-896b-ece9d5ab92e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61d00fc5-3131-4ad5-8309-f921b4964392", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cec7e1e4-ff18-481b-af25-8f567087f473", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3726d83e-5226-4b95-a1b6-8359792a53ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31d02286-d30c-4446-95a9-ab0a954b494e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e70aebc-e155-445c-bf2f-2c99484d6355", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f20032b0-f4ff-48a2-b37d-ff6a4c465869", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab97cb47-bba9-4e25-894a-8d914db35af8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.252.153.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00207b83-744c-417d-a7f8-faa560e46127", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.46.253.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d929ec4-3db6-4807-90a6-e4b796f01c53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.50.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--365de54a-76c4-47da-a839-2d347a74b83d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.56.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7beec212-5581-4c7e-8f8e-7790cbea9fbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.58.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--896b847e-fbb3-49dd-b956-a8f04dfe59b2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.98.55.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c75062dd-81e8-4922-ac28-07dd07a5e573", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.98.56.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22839fac-6be0-42c2-9b8f-ffcf5e43f33f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.98.56.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a6192a1-2702-4e25-97e3-267422e3d12f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.30.231.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39e995c2-2049-4cd7-85a6-dccae9ac5f50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--202a85a4-a80d-462a-985f-2f510aaab871", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f386090-4df9-44e9-ac61-11a6a382a421", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8753d7d-b887-433d-a927-cd6fca12baa1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e100be9e-3bd7-40cd-b2c8-6a53762444a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09ce1e5c-e5a8-4c1d-8696-c6b4aa2e0f99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4b02d48-c007-423b-99e3-a786c7a351da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43407f9b-d6f1-4a16-9346-9029e23b7fa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98e89742-5492-44ea-8b85-e2dd71ff0d0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cff51c3-f862-4155-9a86-2ca0ff6239bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5beaa0e2-d666-45a3-9e28-6dd58d6312d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3fc7bc4-bd6f-48ec-8d1c-ae7d7a8d4f61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cf4e8b9-0fc7-4c78-88ae-7c605f23a7ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4064025b-4bfa-4c9a-b4f9-bc5765dfd748", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2825c7da-6756-46ff-a074-9e0ae77b572b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b5f471f-bd54-4ddd-9d23-b5760da88e14", "name": "Malicious Host", "description": "Observed: PORTSCAN, SIP activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b71f29fe-bbfe-44c4-907e-b8999b051b68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0011d401-1c31-4c7a-8681-74bd83b48267", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cac99cad-81d6-444b-80e0-b4e6f41100fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72cf5a98-bd6b-46e0-92d7-43b57f36c007", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f790b28-2449-4ddf-ae92-009161624473", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0f3571b-59b5-430b-a2e6-c1428a91150b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7f941af-734f-402d-9877-8036fc3f2df0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20dd9ec7-b8f3-4426-93f8-adce44707dd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79b85c4c-5de2-46ab-bd9a-80efc7303679", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb91b929-c531-4b10-9f70-346b8d6ad81b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c3def59-885b-451c-970b-33958380fa1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed088326-5d0a-4108-9bc8-0c10c5ba08d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd6085c1-7347-4f0f-ad9e-23d7f8ee83db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49066a80-05f9-44f2-b8f1-a210f3a51bcf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a77a881-de6a-4c5b-b3e0-a0b1b1c21f84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73f35d12-92d9-4a27-8072-f30f3d594741", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8c29d14-5b7a-4334-8884-4115d369cd87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b4027c0-a41d-4438-866d-9a601d0e06e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf3921cf-7122-46c2-a6a5-8a01343f9b2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b35cfef-8bbc-4b35-b3a0-49e0ca9abb93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3003e2da-d3f0-4652-a4a2-a1e166995ffd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09a34cdd-3ac3-44bb-99be-957342d9f402", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1717d4f0-d2d1-42c7-8ca3-e0fae59eabd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28c1b7e8-a701-47aa-ac05-f0cce2db66b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a17fbd71-fb8b-4cad-8a18-8d45fb50d5c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69a7966d-c80a-4fd1-9df8-65ac2c262733", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.158.143.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--530a8546-89e0-4487-919c-aa21a4772237", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b41267e7-b20b-42f0-8073-640a1489ce99", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6634972a-9f3d-42f9-912a-5a6945553fc8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6eb750e-6586-4577-aba2-932a6b7461fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.59.22.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbd0d6c5-6b55-42a0-9b1f-753a97b39e3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.63.211.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d1651df-4f9b-401a-86ea-f0664f3e2fb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.105.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e885aa1-8989-4136-b23f-8007e454edde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.116.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7b9932f-5e13-4f28-8f73-4f12d94ac982", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.42.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb9f6723-d543-4a52-a648-a028b8bfde12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.89.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c839e8a-19b7-4b44-b593-a1285577b9d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.92.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f090360-83ef-4358-bbbb-46265d4e4501", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.17.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d885956-ec76-446b-be1a-42ab87c01093", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.195.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58803999-96ca-4112-8fe4-373fa7685801", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.197.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a7f62bb-3abb-4802-a88e-f15583406f46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.33.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c59c2988-c7c6-4090-af36-40d520e738d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.49.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b35d821-a4cb-4f2d-a039-89edf78feb97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.57.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42e4907d-cf4a-45da-9a6f-4d191fc27495", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.112.233.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64d421ec-61bd-4a3b-b0c6-5cdee5253854", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.115.56.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7815b7a0-7a31-4422-8c1d-d6d14fb998b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.115.83.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ee2cdfb-87e2-4fc9-b5d3-d278b7f21e2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.115.90.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50382aed-bfcb-4405-a498-df990e3eb8f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.208.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e653fd6-3fa6-48f1-91c2-af1b25ba99f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.216.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dbd1c74-22d2-4034-8a17-b648b9caccce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.217.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6169a359-ffaa-4f37-8eb5-128d76285482", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.224.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fccab28c-40c8-4e0b-bbf6-bf984339a654", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.241.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a6fc8c8-3ad9-47ff-8935-f8c96da01cb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.32.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5526b438-1203-4c28-8d14-e02869bfa22e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.119.74.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--194d7609-531e-49f2-b52b-6ff4f7cba0e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.119.86.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fc34594-fb27-4bf9-b7f7-3d8164a4dd67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.124.87.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--649caaf8-229e-49bc-8d96-bc9dd9aa1f9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.124.91.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52954e1e-dd6b-4540-be91-48fc787ddd53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.157.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16156ff5-1edc-4bc1-b38c-192bc6e35c9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.173.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c0feb9b-9ba1-4ff9-910e-1e06db7a17f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.192.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04314639-4c6c-449c-92da-5b75920636f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.195.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16241e80-ba72-4d1f-83c1-ba4ffc601300", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.202.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c25d0b5-c252-4334-a554-6fe9d8ebf249", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.217.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29ae4523-bab1-4934-bb71-86946814d9bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.219.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0637e3b-d3c0-4da0-bad1-0e2580ff3d06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.224.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6eae53a3-9dec-4d5f-8906-9730841127cc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.254.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19f08784-6081-4f91-a2ef-e451486854f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.73.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36f5a9d0-292b-424b-87b3-18cff768b5e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.73.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02ef1f27-eaab-44e9-9006-ec9fd0ad2da0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.74.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc136dcc-43ea-45ac-8b0e-88719fead798", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.78.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b07678f7-07c7-4397-aab7-9d47980afe56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.89.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8361da3e-c12f-466e-ad38-1f22eb76c33e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.162.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9879f4c-bc0f-4e01-be25-1c1ac4ff454e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.163.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b356daf7-6d6d-4fed-856a-33a7b0e51452", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.164.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7785735a-2f42-4b86-b022-a34bf577bda3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.164.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53d4579f-cd77-4fcd-9862-744dcd525568", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.150.192.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7721366a-be24-4db3-9f7f-516f20762316", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.150.194.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9138cfed-dd05-46b3-b33b-78082c97b0e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.13.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e8ced3b-91de-4587-a8e6-8b980660c52d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.14.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66924d8a-f2ef-430f-987d-a2e4a5cab255", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.14.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98149bfb-df5e-4fa8-be31-61718a6eb868", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0174b64-5bc5-4ca1-a440-ae23078ae82d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d65b2908-9705-4d7e-9265-13f6c4204467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0078718-254f-4121-ad10-efd0f93817a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.2.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ed06e4b-086b-4989-919a-1eba3ee6aea0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.3.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dda6d0c-80ba-4da1-a632-50bc660ee1f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.32.0']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cb14b78-5704-400e-8964-4a76c2ee60d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.32.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb09a430-6f59-430c-89d6-b71d4739e1d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.33.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df5512f1-af73-4aef-bc89-c817e7abca1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.33.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a3b40b0-83b9-4b12-9569-2129bad25949", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.33.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2ca8b25-6ba9-4972-ac6c-d44301938a4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.34.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ba3cb84-efa6-4ee2-be85-9b13e019989e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.34.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc0389c7-5ab0-4107-a0aa-46347918a457", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.39.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb9d4616-db12-416b-80e2-19741208a4b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.5.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4ed3052-df9c-416d-a9a8-2d5c416dc528", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.60.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82f0a07f-ded3-4ae4-9e5a-f3d23b3f9cdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.60.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c408e8b-c4f9-4720-b1ce-a2f562663d91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.61.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e320b6a1-945a-45da-9d94-eb93f0c13f3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.61.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19d50f22-76d2-40fa-b1ac-a80633852e1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.74.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0220f869-d040-4004-8865-95729487720b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.0.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e55235f-9f1e-4cce-9665-9f2ecf69cb69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.0.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6247aac2-6837-4cd5-947f-b1d520c00653", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.1.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8a5335e-43d1-490d-aea2-7bf4905e00d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.114.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d668275-90ff-4a27-9a9b-c945180c317f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.12.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a6b351e-64f1-4e53-b7f1-95d5befca13f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.120.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ca76af7-2ceb-4e4b-b572-c9d47f1b2749", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.120.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cbac689-3718-4fbb-84b0-9d941ae07d23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.120.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0221fa4-40e8-42a1-9cb5-01e6fa01afa1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.120.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a81a280f-d90e-4f54-a5a5-9a035f8a750f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.120.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9a3e188-b2fc-4510-8e25-d877484d706f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f067d73-297a-496a-b29e-286277f651ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e67defd-2c2b-4fe8-83fb-cf35267be965", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d16e78db-c341-4fa5-a0d4-a4d8257e0289", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.122.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd47284e-511c-4331-b23f-33f1af4d27ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.122.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0799dee6-5a4d-4099-be5c-7667e9302f4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.122.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e464a48f-de67-444d-9d45-90b2e575f442", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.122.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--089534a9-7186-4920-942e-18b6543cacfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.123.0']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--001a0600-d350-418c-8cbc-9889137b531a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.124.0']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4962d999-634b-4689-a70d-d54ece65e675", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.124.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e9010cc-7594-4ac6-a5c7-95f384dca649", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.124.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf4c4e54-da46-43f1-a3ff-b868385fc11a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.125.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--878d0163-198c-44c6-8fa3-3c0dca65a62f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.127.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0e6ccc1-fad1-4008-8118-82a9000c2dd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.6.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcd8e884-c16c-4772-b47a-04e77529521e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.6.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--826220f0-6efa-4d2d-b6b6-4399702cc2e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.6.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff2beb85-0b02-48ab-a951-0112d8899464", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.7.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bc631c6-df5e-4473-874e-7d67aa54917a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.7.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43183d08-0532-4c32-a4a2-dc4b8e76f762", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.7.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2500260-3ecc-4da6-9724-2c1d7c67113d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.7.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--837bfadb-ec61-4024-ba14-d9678af89ff4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.8.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba236dd0-94cd-43a0-96fe-6e80e5208a69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.104.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2505a59d-a665-4f4a-9b41-7a1c1803ed7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.104.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c72e353-3cd6-4720-9787-a81de89a1b2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.104.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--435d5fb7-20df-43e5-8e71-5a840ca2479d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.104.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62723ba4-4a2b-4eb4-b482-4873dc696e59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b36eceb-5b92-4a17-a362-b920b74b0a9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--250ff145-a1f9-4472-a1a7-cab08d751913", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a19f241-7a45-4a33-8d08-1a8c37d614a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--632dc166-31bf-4304-be68-c0e4dd1c7381", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a873f71-aaf1-4b51-abf3-f01ac9c83573", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7aa4941-f309-41a1-8eb2-37676a05e006", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03540fb9-51b3-462c-ad2c-2bb0eac22d54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a09a674e-d833-44c7-8a50-4046636369d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98a4cd90-48cc-4394-9047-7595c0320b13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff217521-7eac-42ef-b0b5-a509b7b7ab06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dc83b53-91ee-40e4-82b8-3e879b3fc347", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.108.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baea6e41-35f4-4216-a966-8cff685208b7", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.49.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--800883f1-d07e-4079-97cb-d58b69e3974c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.50.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a7101de-2b0c-4358-b730-647b6489b5a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.75.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d962f4f-1321-40ba-a179-6191940b9220", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.80.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ed375a8-84c9-49ab-badd-bdabc130fb4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.91.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--236abc1b-3eba-4a69-8ebb-bfe5551d2fb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.25.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8adacfb-96a2-448a-8c0a-0aa46912336c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.25.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f584bf43-7675-4030-8a83-9b80588c7d95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.8.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baf24374-89b1-4af9-a597-170ca3b691b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.8.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--423a5872-a0f3-41a2-8461-bb10db1bd8ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.9.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--208b85d0-7d7e-4dbe-8c5d-38feb5aa8f4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.172.67.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4db60ab5-5498-41ab-a325-162455b7306c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.172.70.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b026b489-4d13-4ef2-b164-160abca61d95", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.187.65.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0180954-5c10-4567-9eff-19d8fc600414", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.196.97.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e2c5ceb-f3d6-4668-8e1b-742a2e976fd6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.203.42.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11356d1c-eee9-44bb-abcc-fbc1714747ec", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.210.129.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4314b1ca-14d4-4ef2-bb6a-42c0c75f0e35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.58.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f6c2577-751d-401e-a5bc-d22626fda71b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.66.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8de4114e-a7ab-472c-b795-6a45576b4b9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.72.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b048f54-5c12-40f1-a562-c84a2a5f165b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.21.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fad7f077-7e11-496a-8853-dd4c24625057", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.21.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--765e20e7-4bf0-4cc2-8d4a-ee0508eab727", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.22.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--006f460f-480e-448f-8405-68a4df698ab9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.23.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bdd7dd4-7eeb-47a5-baf1-6958257ff453", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.24.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f154b225-00e3-4bfe-bc8a-1e911cfe65db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.24.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b50364bf-7356-4b20-b13f-2236259969ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.47.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c3810ee-7ed1-4001-9f1a-7d08d4ef9825", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.56.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a292051-b522-4776-8680-2c19d6bc77df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.8.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa610a68-eaf0-411e-8b19-0cbac4fb561a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.3.253.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a9d81b6-a789-470d-bd0d-5a1aaf7c214f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.38.33.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a7fd27e-c377-455f-9070-80cba7c8a6d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.38.35.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c01d316f-ad5c-45c1-80fa-a18f970981f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.38.43.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60308285-6047-474a-959a-c8cde8a11a2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.38.46.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04ca06c7-9299-4792-8f14-600fde1fc446", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.40.250.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8f783e1-10a6-4386-aca0-7e60bdd96047", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.42.115.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac68c646-3c02-468f-82ca-51a49ea6903b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.46.232.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6e5f059-b762-4f3f-92ee-5f2ad42286e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.46.235.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d63970d-d306-4e64-b890-7cd343c6c858", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.48.233.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--753b8fe9-93a9-493e-9b3d-017479a70fd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.51.241.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31143179-d94d-4524-bc5c-fd3eeb616976", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.51.245.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20e447a9-d5a7-4b1c-833e-e962b9a6b61a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.35.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--057a4d96-1cba-4ef4-a79c-69661856938a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.36.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ef7b864-37a5-47ee-9d5b-23577a7b3594", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.88.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86f593df-c500-432b-8384-58c814b0613d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.62.193.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe38fe8c-b975-47f5-a35e-c2176e357e0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d64f1b29-f2c3-4718-918d-a4e56a73483b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ecea2eb-f2cf-4bf9-83b9-5ec6de983811", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eddba688-6687-4ec6-921f-69b3454d1c80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84196a46-d0bc-45d5-9d8b-63b9be680d0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7772acd-436d-4359-9ccf-6139977f82cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88db2b6d-fb64-46b8-9cdd-fa8a44aca685", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0398fd95-4675-4d2a-8829-90177d555d1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a33a184-6053-470e-80bc-8de722c35ad8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d717b00d-b957-42e3-a7b4-34712d20cf23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad6a642e-503c-452e-9ff7-183418a040e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d30f9cb-b27a-4083-83e6-f21b32e7175d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a19c1ac0-2aab-4746-8cd9-3eb3c9e87c4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3bc8ded-6402-44e4-8888-e621084e7956", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd145028-2a3c-4d6e-87aa-31bdd4e50ef4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4978fb7e-2aac-4d14-9abd-cee83f7580cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.106.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9601a45-e68a-4070-9b24-3fbd41ba18a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.106.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f86bb5ea-e4e8-490e-879b-43b67c14c9d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.96.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6358a07-ad5b-4f01-b2e2-a207b4b7110f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.136.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63975653-3d94-4943-b481-3404527876c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.138.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b37e1734-4ef2-4998-9e03-ef92cd9eb893", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.152.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6541b164-6c85-48cc-9e5b-3dd478c4b53f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.154.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6ccef8e-56a2-4407-97f6-36f92300d6c7", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.154.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7130c1d2-9046-48b6-a396-77339433d5ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.177.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74640c41-fe37-45ef-976b-2f19eafca5c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.192.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef1dc131-86bd-4502-9101-612a8d719814", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.192.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9732f318-8211-4f7f-9f39-c66751358a71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2a51b42-3498-40ef-96fb-8b98880b4940", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a486a03-8319-46e5-bcae-503d37b43988", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4582cacc-44c8-4c05-9308-8afd35c8413c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7bcd250-5691-46ba-92a6-d439610d335c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bffd50cf-0000-4f6b-88fc-1a3b9ebfeae0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53093e8d-72de-4a8c-9380-1c855d8c5b9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa48702c-3511-442c-90b6-72e1fa223a8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60561752-c60c-471d-bf47-e340e3250e99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39ec3c37-0245-474c-b0b5-be2dd5dd67c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e743d668-7ece-4e49-b4e3-63e18a4d6e7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.255']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--553aad97-78b0-40f5-b32c-a3d4b7d3293a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1b118ae-e379-44b3-b38c-fb107f0468c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--411978bf-0b58-4b1b-b985-a0f72f237c7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01663c89-0b7c-40e0-b2fe-b0a24dd22a9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99b93db5-551a-4da2-b915-22b991acb06b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f90e5d83-1739-4942-8ac3-2630e819cccf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97616876-3057-4916-9dfb-86e9d56e59e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e38ab3d-d9b0-4e4f-9dea-7551d8e88a19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9486598b-b668-4c99-bdf5-d04dcdf9f333", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60b25f3e-ee0c-412b-9961-9bf0fb88d7ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0557056f-1e34-4c74-9d20-d0661036d323", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--997bc6f8-cdf3-4a03-8eb6-9bd8a4cf36db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--003817f9-8670-45af-91f6-05fab25b0033", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3120d41f-79e9-455f-9333-b92235165af6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9155920-6f40-4f8e-9013-c6f678aa5733", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3bc42f1-a732-445d-a04d-e43c08c98663", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6a7240a-bbdf-4e17-bc13-600cf5b074c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--388d331a-7bd4-4ff8-9f74-d696453cf2ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25b68d2b-5693-4028-b4a0-4a975aef598f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76504ee8-f318-4c03-82b5-2d135a68e69c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--243b8b4b-ebb9-4e88-b3cf-7aa43e520745", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbb2da4b-03cc-4aaa-956a-fd7bc70701e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdddab67-6940-4163-b000-17094b29bba0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d12ab7f-f52d-46e2-8f5a-bc3583601afd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb3ac050-96aa-4ca4-8adb-ced5a0b95252", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f69b0c5-d5b4-4c3c-ac51-8aabd0d52afb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d8e6070-6d83-45de-892a-4ff9e7ec67b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4fa29c6-fdda-4d0e-8995-ce9a70e926d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16ab809c-821a-4848-97fb-58cd1c66fe53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d6ad88d-b41d-49ef-b2c0-dc2b200bc115", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebb0ac10-37ec-4af8-a872-e6cf69531ced", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20efa05f-2a41-4e98-a6ff-644545e3acdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5a28376-ff4a-47cf-bde0-e32fc236ca3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24e44429-496f-4893-b4a5-d67ce37f3811", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.219.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97bb0c00-69cc-41ae-9baf-f0450c9c81c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.70.200.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1029d1f5-762d-410e-94b8-058775d8a389", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.105.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fa224fe-a451-4fb1-b6b8-447e12dc3a39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.72.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19181bbc-48b8-443c-b93e-51f11836a9fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.72.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c95858e-adba-4167-82c5-53dad7bb1806", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.88.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0114cdfa-eeb4-4c5a-ae3f-0010a1c8a532", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.88.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5dc8af6-1704-48e2-97c9-04be93f25558", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.81.47.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23db741b-c582-46de-ae45-6935de1698e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.81.47.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d16d30a-767e-4a6a-a152-805e324b3725", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.167.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b1d82e3-bf34-48c7-b1d9-9525e021264e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.27.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09d103d5-cb76-48b2-99e2-04f8e0c9cc2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.119.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9681cf3-3b4d-42e4-b1d3-284c1848cd69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.144.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ef50069-2ff8-48ea-8b77-9899b3a50d63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.144.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75b6462b-1122-4122-92a8-e2005c46e99d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.145.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2df865b9-a245-44f3-b485-0fe894d1f121", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.152.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b2fbd46-9c03-4334-a308-7b5f6a90d586", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.152.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0d5e621-755b-4d93-b0db-b8f5cc8cfff0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.167.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29536d88-162e-479e-9073-bbf84929bda9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.9.45.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e199b28-0fb3-4629-b7c7-54e87faf2c4d", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.9.55.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a440f0d7-4ad4-4e99-9afb-085d166cbdfd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.9.81.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b739b85-4628-41a5-89d7-f97f61daf849", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.98.165.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19bc64a7-8722-4e1c-9f42-3b0c10a6da50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.98.166.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30fcfb63-7892-452e-803d-6889ca132991", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.104.44.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35c2019b-190c-4f69-9451-e4837c63128e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.11.230.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f796f2ed-87cd-48c6-88e8-92a3afd39570", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.118.102.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5ca0325-3638-4724-8bd9-2d5f2464d8d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.122.20.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--725135d2-c0ca-4a26-b95f-813d612d2b64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.123.234.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d17a1633-d36a-40bc-8486-07293ce8f40e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.123.248.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--534f1c42-0949-400c-acea-423effd46e78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.127.18.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1900ce0d-9d4c-4719-b508-16191294a129", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.141.105.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22689481-071c-4483-8f3f-12b01c67882b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.150.246.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--032b6b22-995d-42d3-9a30-72ec543ac5d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.199.10.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c668758-1c70-42c4-a7f2-d5884c6865f8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.227.84.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fce03690-6d8a-4a6f-93b9-b2ab057e4502", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.229.8.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--475e5778-cc8a-4893-9558-6ad6e8607350", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.24.146.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afbc4886-99df-4df2-b352-b0592bf2d57d", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.59.191.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--108ed106-87b2-402c-b5c7-d0d7a73f8d87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.59.191.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c748404d-fbf0-41f6-9b1c-3a0485dcff21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.59.191.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66c06d38-55e6-40fe-8ba7-b9b158c36211", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.59.191.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2fb2c89-687a-49ce-a268-cba9872b620b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.59.191.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76297658-4c4c-41fd-8611-fbf35120058a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.75.2.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a95037f-d454-46bf-9e0a-3462098a20a7", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.82.88.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3c23b86-f63d-44db-8a02-92f1d0bf6dfd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.132.118.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c165c13f-f1a5-4e9c-bc21-d15e66783626", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.151.218.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee173d48-e287-43d4-a934-e2edd314e92e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.173.64.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e538e22e-35af-46e1-ab0c-b23fd732204c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.173.65.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32eb3477-07d6-49ba-9c80-86c5452cdadc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.217.12.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58006aa1-e6b9-4dd8-afbd-87350d36eba3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.217.246.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f95e199-7e87-43e1-91e8-b8565566f85c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.217.247.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40f3a231-cec3-4bce-904f-fce7102c2f8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.224.93.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a862719-f889-4bf1-827b-374f1bfe0525", "name": "Malicious Host", "description": "Observed: MSSQL, MYSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.243.208.255']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02f38636-14ca-4bc8-b21f-75d0f1fba1fd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.249.205.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d28b619-8b3b-4412-b315-52d1d88a9587", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.249.87.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a59dda9e-a71d-45c8-a6a9-b4452fb189a1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.249.89.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20987bb2-8cd4-4e8c-a3eb-fb5e54ed2b0d", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.26.210.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06d92099-69ad-47e9-8119-c06a2d6255f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.112.47.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--621be5c4-571c-4d84-ac09-cbd45b3a8c52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.125.94.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47fe7f7d-12f2-4740-9894-f7b4502f5f01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.126.88.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed1a932a-bad3-4798-9ff5-0ab9e20a6f10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.141.95.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd03fb32-cce7-4f2b-bc65-ae4f0592fd29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.142.121.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85959b11-0438-4098-8b99-2958a735a6f0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.145.0.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1833d3ba-bc88-4768-bf88-a069bb468bf7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.165.15.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d293b4e-0a1d-4608-a911-babc01a1710d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.183.141.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da015ce0-844f-47d5-9127-8686938f79ed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.184.134.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1788c7cc-650d-446e-a7c8-7dde05feb4f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.56.3.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2184f284-0445-47ed-b93f-a1273cdfb9b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.6.193.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95dffe31-350e-42cc-a540-b1cc90df52bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.71.141.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc892765-65a5-40fb-a410-a93b61d91aaf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.79.29.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d392184a-50f7-47f8-aca3-17085a20790d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.161.47.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5af7eb0d-d827-4d0f-957c-af36d83a40b3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.175.74.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a87487d-35ed-4a3b-856a-5daa9b2c691d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.192.232.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de7b2f15-85ef-41ff-83f5-ebf9e1ea040a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.23.128.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0277146-d5ac-49b9-8b92-14e5ff9b0393", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.242.185.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b746b46a-b2af-48f3-a846-e719fde143c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.28.19.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97814db6-aeb6-4ac1-ba20-d4ed5e6ea6ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.57.235.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fae94ca4-7469-4c1c-9f4e-61d8f92cfce1", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.111.126.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aacc8982-05fd-446c-95c7-31e35b489eb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.157.177.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa42cdce-ebb7-4ce2-b01b-bf655bec8b0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.168.193.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd6ad630-3a77-4692-b51e-76f488f135d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.236.211.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6361b61-5f4b-476d-8070-a518913c4eb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.48.30.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2430e78-4ea8-41a5-bfa0-739181a627a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a82ca71c-4e3e-494f-9b78-9a40ac34b0c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee8bb315-7705-4df5-b026-8194e3eab344", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7130128c-c0b0-4383-a9b5-95ce1be3187d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.147.22.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--895a7f65-27d9-46fd-ba7b-b663b59637b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.209.66.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1bc1162-75e1-478c-b2ba-06be8f84dda4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18d1b5be-fc8d-497a-9599-b9fb3e969107", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c77153f-2b34-4af5-a97a-3e56c0e5b8eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1058447-9241-4152-9921-f40b27859378", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb7c6ca1-f02d-4bfc-9597-bcf7a0078e33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33cc3b8a-bc02-4bf8-aecc-2d2bb93743a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4fdd72d-cf4b-42fe-826b-a0a75a220ed7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a62d1baa-5d9c-43c8-8f1c-334e0e1dd0fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58eb9100-06f7-4292-a027-f860e46d82f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c845c5c-ce01-4ff7-a017-98a6fcd75183", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edd9f1bd-813d-440c-8ce4-d99d4c896491", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c469aab5-210d-4bda-9058-9ab2e8f103e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4c286d2-bf34-4d07-9cff-60f81dde302a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--072505fe-8e76-4f38-8b7e-dd8fcbbf3029", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad761322-5d34-43ad-b928-d66baefa41c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a8e9713-d2a8-4d4a-bc63-098e588fe9ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--048d718f-7781-48bd-b5ca-f2c9f6a5ad7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0942d9a-efac-4907-bc70-fb5a3d615ccd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58560c40-d2f4-4b7a-aef3-6faf10067cb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d52482af-e858-48a2-90ab-c87e9ca7a4b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a8906a5-655a-4443-8fc7-ccca66514f82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9dd4ae6-4455-4916-abfe-32d465ea2c10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc2302e2-29d9-4e24-ae94-9e9f098fba4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e49bec8d-cdaa-43de-9f64-c6626007cc10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfbe6ea0-6c97-40b0-a1f0-c934b09e2ab9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5af42854-8102-4eb2-a5f1-41c3ffb0cc20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c52b14b-5819-448c-a8fb-af98f44c4b9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a6571d1-db68-408c-a4d5-04c79749ca6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a80174c4-4dd4-414f-a8ad-9ca6cc4c37ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f673c3b3-9633-41e5-a1c8-9d69f22ff117", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03af3080-6bfc-4efc-bced-58a105773423", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db8f8bc4-269c-48d5-a9c8-14656d38d8d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f3f1327-7027-4cb5-a675-62ff2639ff58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1adf67aa-2e53-4e3e-867c-0b03fe6dd78b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1d8e32e-4caa-457f-85b5-4554d7a1fa02", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0dfd396-20c0-4f1a-b52f-5444098bcf8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef85cecd-2140-431a-8c14-1c3bf9ef8893", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55702a43-f96d-4794-ba02-b19bd1d13cc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d193bfae-8229-4166-adbf-b222f5b1f8a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afef556b-058a-4478-bf3f-09e4f4aacf88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e60f429-80a9-4053-a8d5-975324021777", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa24d078-5662-421c-b7a1-09c8f3ad14a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3dabd69-8bdd-444f-b687-7d4c6ef2ac0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--170b2290-9f18-4ec1-be49-1c2d5ae5d285", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0606c8ad-ebcd-4c7c-bbdc-b7b174c2ac9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cc2a7b3-8609-42c8-b34f-0e88bad8bd80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f50e7c4-aca1-4c26-a311-81606f441f69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0225cbdd-585d-4bd1-8084-6fce5d52b3f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1c26e6c-2cec-4631-97b3-c2f3f6a2cd9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6a6c7e8-d9ed-4b9c-8ee5-ca952b381c34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47b9cb91-39b5-4c52-b31b-52f460b1549d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd8847ea-9b78-4c27-9676-a1dd51edf939", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3690b5e1-df78-4940-83c1-e7e5be1777d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50ed4fb0-59f4-4f2f-a86e-44132b40a047", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1762ff11-96a2-45ca-b25f-b549fb12067e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--507f76f8-dbcd-40d9-8825-709e9b43fd8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0f40f3e-7530-44f2-b289-fd5663be99c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c844d9f-8d4e-4b63-b1a5-10f91bb47858", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7a13143-51fc-43f4-b416-c98c4c9cd9e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2311be75-1eaa-45f7-8667-dfdf110601d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f3ca3fc-321d-4241-a378-d2f031caa025", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--416bd479-9bd5-4d9f-a6df-3b51da3a7a12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--496f732a-a3d7-4409-88bb-bfee15352814", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44a9fa75-c61c-49eb-97d0-4793a3a5debc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--569f70b6-db8d-446a-be1f-d143d660e9f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e53db97d-9f7b-4165-95a5-dfcec41633b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dced0d52-0aff-49a1-b081-5b1f78eab9f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d142d54c-cf79-489c-a98e-e7c2754eee34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0554bb74-281e-4ed1-b211-a4462ed1978c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1df8fb8a-2ad9-4961-bf18-5995c053f3f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bcb424f-86fe-4253-87b6-1d9693e2f48b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86c3328f-b03c-4915-9f54-5d83bc280fdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed7ba0e9-ed09-44fb-a541-df51488be565", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee2ced71-73b1-4d26-a743-0cada4c13d2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--941daf2e-a4a5-4c77-b07e-2268a22882e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6b2b72d-192b-455b-9de4-14825738ad96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54db5aed-1afb-4238-8feb-69f6fa6a404f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28d34e5d-ceee-40ae-95cb-3d342dcf1513", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34bf8b1e-a343-4074-9cb0-b53c3527310d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceddc63f-3dfb-4956-a1fd-d02150dd768e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d9ed170-1ab3-4cfd-8fe1-ca900f454cae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77066100-6206-4025-8e0a-fb09a6f3ff23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--106c9d6e-7b6e-4ee7-a712-fa2fd789be43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ff29bf0-32c9-4e48-b930-14ed09ea4ce3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb8b1922-2946-437b-bb7d-6558a44186ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d6ff799-d133-4712-a1ac-afc9c54a1699", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d07e164-097d-4448-bef1-ebd3d1436325", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45401d43-ef5d-4fe7-9a6b-8b9745988eeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a233139-64bd-4287-b1c2-015dea78158d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea62f8ab-455e-4c02-8192-451b57fe8a7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8eed37b9-67b8-4ff5-bff0-f3814df44704", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1952bef-83ec-451b-8980-fbcfd6e9c697", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bacb6c6-306f-4a03-924f-c31ca98998c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--700f77e1-f954-49a4-8fba-39132b4e56f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f416094d-a859-41ad-9662-ca1429f006dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--766b466c-fbcf-4786-a617-463f5f18db4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdc402f8-a5bc-4037-905a-84139bd6d8ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f173662-681f-4d9b-b61b-b3168179deea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d331c78-357d-4663-82e6-e5ca175f7468", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baccdebd-5806-4d3b-b7d7-d81f75a492a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--145be544-579b-49a8-aefa-6c151121ee90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5b81ef0-293d-498c-bbcd-bed1c47fce5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c470895-766f-4f19-9979-9aac9e02ad99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7a49826-539d-4b5f-b03e-7dd61caff40d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f886689-79e0-4478-a4c2-73ee35fd4be2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a35da38-26f0-474b-9827-3cae8e69c4f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.217.224.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2313fa25-df53-4253-a519-237f6b96be38", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.235.2.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e794e9a3-a613-4e0d-9ef9-d89ef9c804de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.0.187.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--feba1513-800b-48d9-aec5-b8e1062e0429", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.168.201.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efc19208-2367-492a-b373-2cf26069f14b", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.183.111.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f84e4a4-e4ff-4672-a667-7ede7aebfec6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.125.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5a83c0d-3474-425d-b833-382efbb24e4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.133.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd5fd6b1-a8a7-4298-886b-d968474561fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.139.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25b9e481-6143-499d-adb7-2c0ff0e118ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.140.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9b3caea-38ab-4b4d-9969-ff6baba8a93a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.159.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6973792e-bd98-4cdd-a8b9-47cedea10a73", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.58.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--971301bb-5883-416d-ad84-68d685733066", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.81.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2196bece-4a4c-4f49-b1d2-3537c99c0451", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.196.120.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--250f8e2a-6160-4c6e-913c-91cdbcc82efe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.221.176.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d96a051b-1b79-4dd4-b925-eb54ec26cbb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.62.160.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a06b3fd1-1ee9-4b53-a118-60d82538ccfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.14.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bf6c44b-f17a-4fdc-88c4-8b63590540c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.29.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8365cb2e-f2db-404b-8575-15a2b43957f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.56.9.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3efbffb-634b-4c94-9fdb-c1f42d8b08bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b97b9ce7-0354-4f35-affa-8819ed33cf2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e562e195-9b83-495b-b606-89d5d826ebe9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ffa7d5f-5a54-4abc-97c0-07c40d571c59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6f467d8-693d-4031-b471-5718f3d91f58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43e099e3-c12d-4b6c-ae7e-adea8977cdc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7393020-4ba8-41fb-89b1-465a1cf91a0a", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.84.100.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c1b00e2-ed19-4657-b245-1a63b16a5ba7", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.84.100.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c066aea6-34c8-49e2-ab4d-ab6e3114f715", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.45.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f85de16a-608d-48ce-b276-6a62106d22ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.46.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ca2b35b-6788-4176-9f01-0b312baa2aa9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.60.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7e7608f-9417-4552-921e-ca8635e846c8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.182.218.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83dd48b6-823d-4a50-a8a5-34f061863ae6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.198.130.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b2117b8-c799-4eca-a64a-d1f5240e6652", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.222.101.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b813ca58-dbb7-43ef-b697-29501baf4734", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.139.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86cf2a92-7c0e-40e8-a011-8dafa2bd36b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.167.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66511de6-f8f8-4d74-8f52-6075f87c35eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.17.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7542117-6396-4cb3-9fc7-4198ebd5f255", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.67.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4a9316d-a88e-4ba8-bba9-641240421d21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.78.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3715a0a3-0023-4e73-ae30-0ef052d4e046", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.93.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9ca17b0-5037-4d13-b26b-4457223ad286", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.93.40.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--252d888f-f001-401b-bd14-301b712806b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.99.187.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f9bb639-d548-4d68-a1a1-addbf7671ef9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.99.188.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e185bf2a-b9bb-4287-ae3a-bce9f7fd6dc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.99.191.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c854c17-d6d7-4e9b-8393-772f0f056276", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.121.186.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cf9bee5-0e30-4249-9859-cc494d36b1a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.87.87.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c587e0c-6fb2-439c-8346-3033442d438e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.137.24.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9ec1d13-f6d6-43ed-83bd-6ba4787f920d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.145.38.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e85b620c-55b7-4790-bd28-41541009dfc2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.170.168.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6eaf770-94d0-4c0f-99de-82c43688aed6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.178.247.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa81bfd0-166b-4904-9cfe-412d6e6e0481", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.180.105.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d61bdf8f-120e-44e2-9bdc-fe1387ecd09d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.201.246.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ccdbd60-277a-4470-8111-7228ebbbe540", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.22.223.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42136253-96a2-4cbf-98a1-6052e68b0c80", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.227.185.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--048a0ed0-b4a3-474d-88cb-b24a305cb822", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.228.218.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b74b988-69d4-4801-88a9-c80a4fcd07e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.40.167.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c6265fc-50d7-4783-a8e7-df0f637a0fee", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.72.129.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--475bf9db-5a3a-4900-a534-b5684f50a5d4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.72.129.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3556f1de-ff85-4607-a602-6e1a56826aa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.95.159.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63b0986a-cc0b-4e05-970d-ab4723224b9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.102.40.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cefc7ac-14a0-480c-87e0-62931b97a029", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.132.120.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45b1b1dd-778a-4454-9a3b-c69610e679b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.132.127.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9e00250-62bd-44cd-b3b9-4d65cd76156e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.227.145.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--976776cf-2d56-4c9d-a1b0-b2df88228332", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.237.116.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--939bd219-6ff2-4bda-bc8a-81ce52ccb13b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.237.116.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--526bb531-7148-42d9-8ac1-235fef12c1f0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.33.235.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89e146f6-570e-4017-8687-dccaf9128bdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.56.35.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75c96cfb-63b9-49ef-b1e1-3173a8a69a62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.81.54.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b416eabd-e9b6-47fa-bbdd-7416c70aebde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.91.161.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2e9e409-64bc-4a48-9a90-6f9411dd157b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.136.81.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--702c5cda-9d68-4d1c-b79e-a4aa7f86167a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d768016b-8b3d-48f1-a0f6-c093f384d42a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1035a323-b120-42cf-b990-7c5c44388981", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5996eeed-59c0-4c77-a1ee-ebe947c172e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e4eac8a-9fd8-46eb-9589-3c1df82d4267", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09d10b5e-61b3-42f2-8b96-323e6b475b6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1df7a0e6-4064-4f73-9060-ef13f67a4542", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21c830db-a2dc-4558-aa7e-12a8ecfd3eda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a800218-2127-4ebc-a549-0f639a9f0ec0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26d000ed-0ab8-42c8-8256-a90d4a97932b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7c6f99c-8736-4e4d-9eba-3387ade6fcca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71e6ca6e-2f62-499a-b5c7-209cb081cca2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d366b5c-931b-4e93-98e7-52dc256383e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b046c180-ff4f-4971-b11b-a48a88cb3905", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63326449-c89b-458c-8705-81feb5cb3285", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb62efc9-ba79-4748-abaf-40950e4c31e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a720e408-91fc-425c-8015-7521ccc54048", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63817e86-4f58-4cab-b9b0-d652614a7793", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45079d0f-a9fd-46bf-8963-223a659d739f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4d9fe5a-019b-471b-a105-d0863c544112", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--154e654f-2792-4ec0-9df5-92c08d46c0de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a1690d2-29c6-49b4-9b5e-af9ebacc919e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8390196d-5b0e-4ec6-951d-5348bcac03ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c588329-8d3c-4782-95a1-07bd696286bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4e9967a-ded6-4fdd-83fc-c3165fe99ee5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bff0c1da-68fa-4307-8381-8c58387ba093", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc2a066c-894a-48c0-8025-75f1e875bdaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16d1ff3e-842d-49e5-9a8f-29e9ae6eb86f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b98b06b-b2d5-4c52-b5d8-24aea333ae6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.194.155.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--955e4261-28ba-49e0-bfe8-e022ebafaf96", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9809e8c6-8a7e-4005-9122-ecf49d7e9f30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41244daf-1fe6-4683-b704-184e4f36929e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0767b441-5397-4b09-a38c-10c5b248109e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f91360ee-fdc5-4d2f-b29b-6adee6d12333", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22661b1a-4bdc-4f9c-8af6-f607a837cd3d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbb03238-a4be-415c-9c7f-47c419ff6275", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ea2b565-0405-400d-a026-d55e4b7146e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1f7c519-8e0f-451a-add1-7ce74f9553a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.21.239.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2540e2f8-fdb5-4f67-b096-a9678fb9aa24", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.21.248.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--564ee783-dc95-450a-827c-ba146461b7f3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.230.111.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0497727c-c2bc-4a31-bacb-cfdf9f9a5658", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.230.127.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f179f2cc-7e89-4498-9696-77b7becb76ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.230.86.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19cf3072-97ca-4ac9-bcc9-b0220a68d990", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.35.128.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2216e91d-8537-4ed1-802b-21b349b35db0", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.74.191.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a80138aa-a9b6-4c0c-9acb-498ad1dcffe9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.98.181.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61e8fdbe-9ca6-4da9-97c1-4162dd841e0c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.133.145.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea101671-b716-4d63-8fd3-22dbaad4135e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.180.246.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92c9933b-d8d7-4492-b07b-7b162f9f8e9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.180.246.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d50076fb-ed06-48d0-a38d-a041ee2bd975", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.180.246.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff5537cf-1ce1-40e7-98d4-12b3ea0df1eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f1ba8ce-da09-4def-8fc1-6fd2c156aa66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6ce62dc-370c-4acd-bbc7-5fec5450a736", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--decef7ef-3a26-4543-b8f8-0acc579728a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70419fd6-2837-4643-9682-36e8d913cf52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c84bc280-508f-4c13-a0ff-43fbfd18fc99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5101cf20-1cd9-43d8-9a27-515afcfcb6c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a905962-6a40-47de-bd01-c8fdb0bc4094", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd237ab6-215d-4309-825c-9d2bf163d1a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43b96c99-10ac-4495-a82f-b6a96f0a1caf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80f69d3d-5df5-49a3-88cf-c4f8b7f79da9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a895ec6-60f9-4df4-abe2-ed747d110876", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f4d450c-c8af-4885-9fa0-cedf8d56c158", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4316c64d-ca02-46c4-bf88-cc8362f616f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81b27a86-44fe-4bfc-bf56-03621e6fb9dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--464983ed-4422-4220-99f7-1642a59d15be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef9b3ae6-efa3-4b9e-9e57-f9dcd8b3372c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6728e520-2813-49d2-9147-6e4ad075abb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--611cc143-e2af-4729-8dd0-52922d4e34cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cf766f6-57c6-48ba-94c9-1df7d6e1922f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.226.76.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad1a3f99-2adb-4dae-8943-cb454243d639", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.226.76.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3045ae5-96eb-4a25-9d8b-626bd69007ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4d9b56e-24ab-4ab2-84ed-4c8ac6cf7bd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--797e7f35-0c0c-43c8-b894-43140a06ced4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93533b4b-be44-4611-93da-4d2c823c175e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bcada27-b7e4-47e6-b2db-8d50dacb58ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5637f9a-853e-456f-a9c1-24146f2e4004", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--233e7e51-d419-42a6-a248-aa0c05a095f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc4ecca0-358e-4548-8eb7-3425c8476ddd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d3237b2-7730-4171-b5d8-272d447d934b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b0a1b10-43fd-4b09-b538-d2597563f99d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--428866b7-94fa-4339-b21f-2a408d1b1d13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f0cc852-d050-4480-80ce-87cd733f53db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55bae2c8-fd1e-44b6-9386-933ef227d635", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c762e323-a386-4fae-8a45-0d2b84735648", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bba94118-69ca-4e9a-9b90-24036f42b841", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5365a56c-1438-4c88-8c13-bdcc204e2cc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec766c82-01e0-4e42-9a04-a639e69f4b40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b498897-d549-4c6f-8033-443e4d757d94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d626607-2ded-4467-a849-6c9ea4116500", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfc246d3-5651-40c4-968b-556b686a642b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6cc3829-9cdf-4b0c-ba39-15d51a858691", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e51889c-b0bb-4762-9141-dabb836bdba8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--903a73f4-baf8-47c6-b387-a9d8bf7bd58b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fda1562-384f-4867-a0bd-049db6cefb5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4172cdfa-67c2-40a5-936b-97c3cd9b9fc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc5f4609-b04c-405e-b301-c564d82a3d62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--011dc356-744a-42ec-9fa4-2a8d116a3379", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59b0bb3f-b412-4a41-9f1b-07694b44e80c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4766b282-158d-4952-9cf5-570dd37f93f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--473c6f9d-7e6b-4660-a5ff-7b03ac49c1ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fc72986-9ff0-42c4-85a5-2a0f65ff91e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a76213d5-a05d-467f-9cd9-2c36400c7110", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--883470c6-c12c-4d43-af71-8d89c680d7eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7e7dce7-bdc5-4ba0-adf5-cd068ffb0e71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c6ee274-7fff-432c-b3f6-feb8d70852a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47cc6186-3449-4f08-9e59-73b050263665", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ee5cb6a-26fd-4187-ab60-2d4605f1b966", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ef09e91-f349-46c1-8494-871cb3cfec6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eff9c61-2298-4e33-90f3-d234dd54e142", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--defd1d03-9674-412d-9eef-3cf6a325d00e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c0afbf0-5899-428c-b524-e3febbbaa9e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--699f485a-0349-4493-a7ae-381badc89068", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7691b928-da7f-4132-ae6b-c7bb0ac6d53c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92f40fe6-4066-444d-9f62-a2e0655cdceb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be6d1942-823c-46cd-9c59-e2a003732bc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79aa6f3c-3f13-4af5-b5c3-1be3f3a1e0ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fd02e2f-295e-495f-9e25-67206ce15601", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--890ced2c-60c4-45d2-a862-b6efbda288f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5501a012-6f4b-42f1-bdfd-4beeca0b271d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c75707e-fa83-4265-9e84-c375cf713e61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f102e41-ce43-4025-9601-5c21e60f704f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f74fc19c-22dc-4b98-b561-600ea1cafaf6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. CVEs: CVE-2019-5418, CVE-2021-41773, CVE-2021-42013. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.250.116.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41773", "external_id": "CVE-2021-41773"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42013", "external_id": "CVE-2021-42013"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b2b7bbce-1bbc-4171-93d7-2488bceff371", "relationship_type": "indicates", "source_ref": "indicator--f74fc19c-22dc-4b98-b561-600ea1cafaf6", "target_ref": "vulnerability--0658f8c7-3aad-4b1a-a6a9-1721ccbde1ea", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a0bb612d-35d7-44f3-b5d3-af0d80a6e2b6", "relationship_type": "indicates", "source_ref": "indicator--f74fc19c-22dc-4b98-b561-600ea1cafaf6", "target_ref": "vulnerability--63210108-760c-4b1e-81b9-da8400b84cfa", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3ab717bc-8350-4cb0-acec-619a1e8f2cb9", "relationship_type": "indicates", "source_ref": "indicator--f74fc19c-22dc-4b98-b561-600ea1cafaf6", "target_ref": "vulnerability--271a0d64-6d2c-431f-a3ef-aef8b38ee0ed", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f116c9e8-a1da-4e02-b840-1637f4d493ba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.160.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--968c9da3-6832-4766-8fa9-a21fd796275d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.217.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1348a83f-bef7-498a-88da-9ca16e08239f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.217.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6de26366-626e-48cc-8d27-8fbd80cb4a53", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.217.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7718b56b-7c58-4d33-ae9c-a69ac1db5f11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.107.106.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--106f8d64-3242-47d1-9541-af727ff793bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f7d2738-24ef-40a1-85b5-48c7d5d50655", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e785c6da-5a25-4f3f-87f0-2421a6d30c8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a3cf878-33a2-496b-a206-f0669df9a3a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e806b2da-f5b2-4015-afb3-855964643707", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d49aac98-b0f4-4050-bb4a-92f3a3821c40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a1a6891-1da7-4aaf-9180-714b999682d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aabea9a-a4e0-47a2-b630-1bbab8fd010e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45ebbe37-d005-47b9-a42d-e717dfd3b344", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2c732a5-4147-4a6f-900a-fbb8a21660ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9296bd59-a150-4712-a366-82ecfa383ff1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.154.146.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b6189c9-25e6-41b8-8bd6-c83628d3a691", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.154.239.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4ae1a7b-db9b-46ee-acc3-60b130fc75c6", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.199.144.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0a83924-4a1f-4162-b446-941b889b2585", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.210.89.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c7c1152-a3f8-41e0-91b8-74b4c20aac9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.216.59.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfabf4ce-ed21-4330-a90e-4b12a69be408", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.217.248.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5bdfff9-46a9-49f3-97e2-ae7cda5a6915", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.25.223.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66240fdb-d70a-43dd-b127-7910ce731375", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.17.184.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee9eaa93-4782-4851-955f-7097a6725281", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.51.148.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12b09207-2093-441d-b9fa-7d2283606ad7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.59.201.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05d9313a-f807-41ca-bbd2-ba0a572016a5", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '219.151.187.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ba14a6a-b6ae-4132-a81a-a1ea511ffa0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.112.207.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--298c093d-c978-4751-ba55-815e53d83804", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.118.173.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e949eed8-c05c-469f-a6b2-73c2a407e645", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.132.250.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcbba2a3-fa83-4960-b375-ce1810e2b27f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.154.131.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b255fe88-41c3-4e4b-92b6-a9c4671e82d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.158.232.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc9b3e21-57f1-45f7-bc5f-46f62bca3717", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.167.232.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12bd6d4a-b32b-4e02-b4f8-c6031fc1c66d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.167.232.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--040d1f32-2de0-4147-99c3-6e848e93b54c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.167.233.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa2469b4-9886-4e35-8e9b-ba00699cc65a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.167.233.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc33904b-674a-45fc-a507-e30649bc0ac4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.180.49.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e37a8aaf-baab-4b4d-8eb2-94be5a9034a4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b525c35-8e32-4aa7-8615-e42c6884036d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dbdc0ad-8089-4fe9-8925-c3e9ddf1bcd4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5154631b-c820-4772-8e14-7ae81ecbc2db", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd986b8d-0df0-49d7-8939-0b7cdb78587b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1649ed59-1ccf-4dec-819b-16dd48059474", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9076cb31-5a19-4ec3-b394-3a3e8c618755", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.51.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9c6de1c-3c05-406e-8721-02e6af9205d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.185.64.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6e002d0-6989-4192-ae27-3f4119e82368", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.247.235.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3468bc1-049f-4c6c-9276-fdeae24cfae7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.130.29.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79521110-b395-4c57-bb36-f0446f139e56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. CVEs: CVE-2023-1389. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.159.119.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1389", "external_id": "CVE-2023-1389"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5227d4df-a632-4001-aec0-8b8ef9b80593", "relationship_type": "indicates", "source_ref": "indicator--79521110-b395-4c57-bb36-f0446f139e56", "target_ref": "vulnerability--c526e552-61fd-4157-bd2a-33ee42d7f0a2", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc5ce5d4-ebf0-4190-a0de-8d5d4cbd821d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.159.14.1']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--402de88f-f261-4231-a7a6-daab7b51625e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.207.34.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9bfeb9d-ba74-4a4d-98cc-5241964cbc2f", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.229.201.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e26ad72-153b-4ec2-b964-a6b8d28d2912", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.107.156.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f92673bb-4bc3-4de2-b3aa-fb42cf716f5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.107.224.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9a7bfd0-48dd-4b4f-900b-d19eba50475b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.107.254.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf47ce08-2ec9-4cd2-8271-7c50ef015ff6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.108.100.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35e8f5fa-7113-48a9-ae24-29ab06300cb3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.110.147.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b382551-2607-425b-9fbc-c5e939a5dc66", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.133.52.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe254817-73c5-4391-9da1-ac7e63eef4c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.176.200.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfff1526-4e7b-434a-81ad-6cedf3fb1cbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.186.13.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13a1de9a-17a9-4a04-84e6-d5cc1c331c1f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.219.131.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--956d843c-28de-454f-8e2f-9460322241da", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.232.176.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--878a8be4-dec3-4872-be73-ac46a327ce4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.75.122.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6663cfd9-450e-4c98-bb11-caef8e908f90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.96.27.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8beaee9-fae9-45e2-bf55-51f433e4c694", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.166.22.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de1dd6a7-9442-48bf-bb76-5cac5c7d034d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.221.38.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7003dab1-7311-4263-aa03-369dffc37d06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.237.188.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a442d3a-eced-488b-b245-9618b0571a81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.240.94.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a3c9733-54de-489d-b434-e9c19115a12f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.244.22.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20112dbc-9f78-4d37-bb52-7d42a63a7873", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.68.7.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73de7dee-c4f5-47eb-81ac-1c84e7d28ef4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.74.192.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0309f566-200c-46fe-9c71-1612d54f8b2c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.76.158.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c07f7ce9-7b69-4bc9-9af3-0f1b5866c33f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.129.64.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb97ee57-dd18-4241-85dc-9b7105897ba8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.132.164.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c216826-eabd-4570-925b-a33bc6dfa95d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.150.40.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba0f3ed6-235f-40b6-8663-2838b0326cd1", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.175.128.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--889e6c64-6c2d-4cff-8afe-6c42079f8537", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.224.92.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edc79aa4-2420-4241-a57d-f9dff6012029", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.227.147.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b1a46ff-41e7-4142-90c6-d99d6f1ca51f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.239.4.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78ed15e1-e867-4e63-82c9-809a92a4373e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.249.28.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85e621b6-de18-4781-8426-477647109173", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.81.36.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--811c0eca-0fae-4931-b218-61f3df71685b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.92.27.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eca9439-6252-4e85-8ef7-3813d9c476ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.92.27.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a00c5de0-b785-4412-8ba8-6f72b34b7e4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.94.204.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61f483a5-c0af-4898-9d89-67b5466baaa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.94.27.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b201a9d-258c-4ff4-a4d1-4e7f68790f64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.99.181.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f6152c8-3aeb-46e0-8e2a-2a0540c9960b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.144.84.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1803141f-2af0-428b-b6f8-004c75198d59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.190.87.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09a16053-231a-4c0c-afcf-8b837348f612", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.199.95.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e90958f2-9ad5-4c7f-83b7-899014f0365a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.199.95.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21b3e2ed-a899-4c75-a112-e814e2b62e21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.245.198.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d6a8d42-7cf2-4d06-8696-67fc64969e28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.43.161.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83030801-c650-446e-a82a-be43a051ac35", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2600:1f16:743:ac00:b79:6386:a8cb:920a']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d85c101-e170-464a-a695-2834c61c6b38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.102.121.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--098dfe90-642e-43b9-96b0-5c0a1e66e68f", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.118.25.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--631bb065-d81f-45e8-ae98-55d903dec9f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.124.10.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1678ee6-017e-4bb8-805a-fc9e2e0b9d61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.150.172.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6b71ea6-601d-40fd-9db4-644e0807f406", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.22.246.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2cdbbb6-a49c-470d-8e02-2269945d4fff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.47.26.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--564f58fa-f07c-46a4-8cbb-36cab58f9160", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.47.27.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--884feea5-7b54-422f-965f-e35423b3d12d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.72.248.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddc3d218-bfbc-4b8a-9f0a-e7d2e87388ce", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.78.70.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa0eff1e-471a-41dd-bfc4-59332bc2450d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.79.46.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7748c6b7-b26f-42c3-a632-639c91875769", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.97.164.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7faea370-c44e-41f2-8236-1aeb5a17f56d", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2a06:98c0:360b:ab06:f4c7:92dc:7259:96ad']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03d22bad-eb99-42df-8607-b0f86870b39c", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2a06:98c0:360b:ea05:3013:cfe1:dc04:a826']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5111ed0-deee-4e0d-a283-08364b0a2d8c", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2a06:98c0:360c:7274:90c3:ca7d:c602:3da6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1d06576-3879-4704-9d1d-fdfa400c76e4", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2a06:98c0:360c:d541:b755:7cf1:9052:1fb3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35c1ef9d-de7d-4aea-864d-e607492f8313", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.125.168.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee04461d-c889-40a7-9176-eb50372080b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.129.187.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cced908c-5d1f-49db-908c-a047623f642d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.131.220.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccfc2426-d9ba-4faf-abcb-9fc0b8edfb0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.131.24.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b228bc0-0cff-4da2-ac3f-0932e27ee3d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.142.170.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4415bd8f-128b-4244-a623-28295a7ee0ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.150.135.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52d44786-9250-4a01-aaa9-37a199560a23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.16.151.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3bce525-2806-4978-98e4-5ea62138c256", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.213.226.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca842260-dfb0-4142-802b-944a0380d808", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.232.69.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38702222-186d-4730-9c4d-b1832f25f005", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.65.40.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91093fd7-a0e6-4e0e-87e8-d462338139c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.74.234.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4d1c0eb-3dbb-4919-aee4-48ba2b7d1756", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.81.224.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8989ff2-13f3-4175-b66e-1e559c1390d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.83.241.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--612d38b5-6887-49d2-bb1c-e2cab35aa381", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.83.245.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4662158-23e1-4746-8b95-ab54ed88acdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.84.4.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fab7d258-2b1f-4690-b186-c2f5bece0785", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.85.165.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0312e975-3389-46e8-9b6f-5bb455a749d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.85.18.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ca13f30-5d73-4b58-818b-3e874741dc2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.89.226.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90670770-d6bc-4431-8a1a-10cbe1d0af4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.92.180.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--605fda91-b8cd-4a7c-a08f-3d4e2aa2d841", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.92.239.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46a5fe0d-faba-4979-8e95-33e023835807", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d4ba4d7-ccae-47d8-bb55-868be08359e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e64ca40-b111-4e47-913f-7ba0365e5c0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecb76e56-8968-432e-a799-bc6edeb83acd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e60235a-4dab-4983-a048-f7026eb3049b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3323e99-928a-4677-a9be-34fa47ddc3b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8ee561c-2cba-448f-9505-3cae771f31ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89f1b9e8-4623-4f8e-8967-d43af4db0613", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0459bf11-cec4-4d68-85e3-a093561ef365", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d90828ab-7382-4565-95a9-ed119b665126", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72da52ab-f0b1-47ae-b049-f1080897f5ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--581066db-227a-41f8-b03c-8dff85b10555", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46e197c9-c611-4edc-a266-59a70f278844", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90e99e3c-a0b7-40a2-82fb-dd7247568c08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7906ce0-9836-48fc-ab84-8c0d7b02402b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7adf6eb2-5a6a-41e3-95c3-bdba8f609568", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20ea1da8-df6f-443b-adfe-9f65638daf05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b63bf2f-08f4-4319-ae1c-7ffeab3d4861", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fec544f-7832-4e55-910c-43ae33f3daf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7deb00ae-9dc1-4692-8882-5a369c03200f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.146.114.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33422f42-6bcd-4d0d-b5b3-11f9efa9434f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.148.99.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34d6daab-648b-411a-ac11-e8392dfe52d2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.173.247.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b4680ce-8f42-4547-97d5-6be708f31f9a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.179.197.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0aca13e-788d-42b5-8ec0-0711eb418291", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.190.148.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ef5eb16-8ba3-4e2a-9f07-72f8395d8511", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.205.45.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5002990-8329-4266-a015-dd5c94b462b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.21.236.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--984a1e8b-fa32-49ed-bff8-e437a186d259", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.223.4.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06a3f481-7bb2-49ec-9f1c-00ee350027f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.23.69.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed09dded-ac70-4238-a08b-9b9157911b08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.25.138.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98c8d289-373f-4b0b-a51c-c9ef76fafa07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.44.72.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8742d439-7e0b-47a8-bd90-2e2b0a13c1f7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.56.233.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8313957d-0d1d-44fe-b41f-9b140935d994", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.59.89.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fabeb9c8-9d10-4735-aa6b-dbc839e644f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '32.192.248.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ece4fbf-7ba8-4fd4-9297-08c2bab496b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '32.199.27.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89922546-a8d5-4106-b706-2eb52336b9fc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.0.13.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d262f41f-86be-4797-bbff-98d3744d390a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.106.123.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f9d39b1-f686-4d30-ac0f-acd7c475775e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.106.165.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79d92dba-9fe8-4f69-9a93-2567f7013987", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.116.147.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6e670d6-7270-4c50-987b-8e126fabe2f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.13.244.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b572367d-1144-454b-a395-be8823aa7ff7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.136.47.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6bf3e41-bda1-463a-b5de-fb0bb14c04c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.110.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60f2dee1-623f-4b81-b3b2-de76b595659a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.208.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dda97938-27c0-479b-abd4-7131b0d458b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.25.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b089f4a2-a570-4811-bf7f-851649fc6e53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.4.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4434f77-bd83-470b-86fd-de5df30163d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.5.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0eb4f9ac-ff14-4451-a466-05eed9ef2510", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.92.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c90c59f3-187c-4ec1-a7e1-7c4c13c81682", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.143.241.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f75c4a90-15fd-46b2-8e08-903884e236ac", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.125.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72c75cd0-ad74-4f41-9abc-2bc632509aac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.135.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acac4520-b135-47fb-9342-3107e14f5e01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.197.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dfec0af-72de-4379-bcab-7b8adcfb4488", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.202.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--116c7908-0d41-402a-8cfc-4567d22f1d1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.216.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--671ae7ec-7a72-4396-9fe6-196954d74c32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.233.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76edefec-2d95-45cc-ba8b-8f8e65667e2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.36.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d977f276-0aaf-4282-9677-bfd953b1f7e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.69.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3287fe56-2a8b-4e87-b711-93d8f80d9120", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.171.90.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--570feb27-7d58-4c47-87d6-25a6694c5735", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.175.118.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f54146a-9b01-4693-9326-6ccdb306c290", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.181.219.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8b0cfb4-d5ca-4614-82e9-b80c2df19f2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.19.210.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb1825c8-4156-42dd-8706-8cccd44b06ea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.193.242.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed2bc52c-239b-4135-9c14-6a8da12c33e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.195.16.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5d182ef-a180-40be-8d52-28b928fba25c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.197.70.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--847f6375-9b9d-4e09-8c8c-485ea1cf5e49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.201.143.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ed8b604-0261-4097-b98b-af436780d2dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.205.139.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e65ba142-59e9-40d0-af64-4c4533be3ad7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.212.124.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--431aa179-83f5-4026-bb7d-953f0fece396", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.22.128.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3b341a4-d431-4704-850c-51353a8a5e5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.224.57.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90328eb0-eb04-4df4-a409-ca8099d51285", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.224.87.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59e6e776-3a6e-4f9c-b80f-2a18e27d85f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.228.104.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ee06e2a-cc53-47c6-8afb-e06bf446db32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.230.205.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c5bd13c-6e3a-485a-856f-80d243e41d34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.230.72.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48b97c41-9e4c-4835-a9e3-cdbe45d9b9af", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.31.54.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64045c07-a9f1-4e5a-8ac3-bcd7ac32cb80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.34.174.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a95afcde-2d78-48c0-bf42-6d735d696a43", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.38.139.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd485ef9-44d4-4e21-ac33-e5d95541c98d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.38.16.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5650aab9-0134-4904-b35a-86318bb1b3e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.38.195.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae1efd71-c946-4fdd-b3bd-56d17d7cdeee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.38.37.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f5d45b6-f8d6-478e-bbd6-bb80944c1303", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.38.87.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--979fe1be-3882-4db7-bde2-6abfc4b45710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.39.251.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44575c79-fbe9-4b1f-9ad7-58e0871f41b9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.40.145.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4a208b1-abbb-44e2-9160-259b2f3d9d7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.137.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3460052-fd7e-4059-bfcd-5ca698a63a30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.140.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--339d3462-b8db-498d-a6df-bd97c8b31197", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.145.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f725ca0-0ece-411b-a4f2-290c79b76378", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.164.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14fe4b49-9a44-4eaa-82c0-8a336f2654fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.53.192.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b38b62d5-4a8f-4540-94ef-5955695fc28e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.53.194.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--399983ed-6e77-41b5-95e7-41dc66058625", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.53.216.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ee653db-161d-478f-9c61-59fd7cee12af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.53.242.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--515ec99c-286f-44be-901a-69a2de1bcdb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.120.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--910bac9d-fc0b-44d8-90de-f2148202cb26", "name": "Malicious Host", "description": "Observed: FTP, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.167.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:ftp", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5deeb6d5-cdbe-452e-8556-22290771cdc5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.197.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e1a15c1-847c-45b6-81ef-f7ef337a733a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.45.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a362d7e-25f4-42f5-ae4b-35b88be27074", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.71.30.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--123fbc06-e032-4fd2-b568-82a14fb26533", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.252.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c833e4b-491b-46b2-8da7-049c5fb5fece", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.31.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7bb137e-05dc-4048-a6fb-8a7eeb354a59", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.58.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5647ab0c-cb38-4ce0-a5ce-8c2bb8cec2e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.89.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f29831df-6891-4889-8a7a-7941d2b9cb30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.77.166.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79d2b914-2013-4e25-ac7d-3f590a83ae83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.77.182.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cae08f5b-aa65-475c-9315-1ad83db9bdb8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.77.51.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecf0dfa1-46e9-4dab-89f9-8a4b9f76d7f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.23.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48773c81-fd9a-40d9-972a-acbe6e40d661", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.32.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fbbd291-71d1-47cd-8be8-35ae442f9d54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.56.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eba89b7-4411-4f7d-8ee0-de13b755211d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.77.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51afcb4c-c95f-4eea-82d2-81aa01e116fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.81.243.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe6799f6-2fd3-4384-9a1b-6e54e5051dbc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.9.216.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad65bbe7-f783-4994-aab1-eb82885f90a7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.91.0.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a55bf613-db6a-4f8f-825a-679426ac85d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.94.250.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--655d1769-48bb-4dc4-b468-f6c604a5a9a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.97.194.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f11b8235-5862-409b-8c9e-64bab55f98f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.169.206.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53d3b69f-a721-44d3-b9b9-6f604145c88b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.187.43.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18fab03a-21af-4a2b-983b-6b611a74d1e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.187.90.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--876a8c4f-ae2e-4e06-bce6-89d7a19f0cd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.194.251.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89ead486-43de-4c07-a2c9-a3f0ae5dce24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.195.152.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d13d071b-9140-4a6e-8a53-26fad148af6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.196.126.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bf23852-ad67-4abb-89f2-df1678726236", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.117.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3579fa0-647a-433f-80d0-4c8686a940ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66ca3c5e-b42e-4982-b352-911744baf6c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64fce084-55cf-4143-826b-bfb4b44665d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f010b443-c2fc-4aa9-b4bf-d96426fbe93a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e37a7b2-6eb4-4d8e-9d7b-45446f339745", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--617bd05d-6600-4bf5-8025-bdc5f938205c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17bcd118-8259-4b04-9b9e-4feeca1fd6f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c19ca02-179b-4f43-ae2c-d051068ac0f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9a11276-3e7a-4ebd-b60b-9ca6dcd026a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a517a0f1-0ffe-42c3-b965-de1a7907ea02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7256e5fd-97d4-4150-860f-70ae9be486d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--612e2d17-0462-4842-8d26-13cccbc27bcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--541b6cbb-6635-4fd3-8c27-3745dc6a4b3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2cbe4b4-6fe9-466d-8fb9-c9ed3c9c3f9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfb1afbc-e438-4d3b-bca7-0e0df3e34673", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b5580b2-38b0-4c2f-ba08-6d6f72cf8842", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7148a173-6fea-4263-a457-68917d1e9e06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9be01e54-db51-4b61-9aad-94090e0accd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae156ce4-953e-491b-8a7e-699e5f62ff7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e073b8cc-c286-4e18-b1be-44b3e6fe3dc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71a9e588-fbda-4765-b7f5-be01bb753836", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1217a07-392d-47fa-a4e7-f57e01c5978a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b761f65b-54e0-4464-b5e6-24d6b03efe4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00bdfdca-3798-41de-a7a5-0952dc469bf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b406bbb-4fd3-4fb6-ab15-f20237c3e815", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d806389-c1d8-4611-b370-ad5c0f3c3ad8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37bd42ab-6602-461c-8fdf-1d5493841280", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51c90bac-540c-431e-bd22-f60b443ce651", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ae01f3a-9508-4b75-b87e-44ae6be9c78a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c421f9d3-db5b-4eea-b06d-384cfe6c63a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1caba54-f9e6-4e34-9b45-8148f4fbb656", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d8053fc-ef40-46c3-9b93-a3a2a2181e10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b55b57bd-bf6c-4fc9-ba48-eb39617e8fdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a62f121b-6b04-4d39-9890-8e2806b5b203", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42099b30-9509-42c7-96a0-90c129d5cb69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c752331b-8529-4112-a590-3153898f415a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d69cc4e7-76b9-43b4-b996-6b19db6d60a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7174ac05-ca59-4824-a9b2-2adcb3e44d81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9afcb452-1b0f-466f-ace6-c516bde4a288", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20ed8428-25ba-4f51-b620-9ae93c300c6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a8ea976-2a83-4eaf-ac71-b64b9f1b70df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcdc89d7-6623-43a0-9680-0b3c2868f53c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a1f174f-4479-4cf0-80c2-ab213ffe6014", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2085c2ac-d815-46d5-adae-53785852318a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21cda204-57a0-40b3-8e0e-00233bfcc4f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae05040e-2982-4146-a9c7-e435001f2d60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cb18525-d7fd-4029-a018-cf9e34658ff5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da855aa1-0683-4a4e-bce8-4aa2153c957c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6176dae1-3da2-4e49-b8c4-7c7783f846c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bb9f3aa-b849-4fa2-ba95-180fa7160382", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a6c82f1-6cbb-44fd-af9e-ad005ddf3737", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb4f2de6-871f-41fd-8feb-e1634329effd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9a65e9c-ca8d-41cc-ac11-3c050f444bc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--471448ab-5555-45b8-a4d4-4406e39ee9a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53df2494-eb3a-4fef-8943-e8e22c1ca213", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a496245-5209-4514-aac7-1e6d372e0f4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e8433e8-9459-42cf-a959-dd09d38e659d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcfab6d9-b27a-46ea-9c8b-2d359249c644", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b8589a5-950c-4fdf-bbd8-a9b03d7b0ebe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25dadf30-7f10-4c68-9a7a-824028b7e890", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51a72634-860f-4bc1-8d0d-f6a597595424", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1268ebe-725a-4935-88ed-819d610f2f21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dff61b4a-0a2b-41e4-a24f-ca35bbba25d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a94bd68-86d4-4fe9-9f02-c6a207995cac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7449e53a-3dc4-408e-a7eb-a3a3fa07d16f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdaba15b-a215-40d6-82d0-a82c651a4095", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98f6f53a-c1de-4d83-8aa0-1fa35d88870d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf0ac277-640f-45aa-b1ad-865bdad4bd41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc5ff837-c422-48a4-b8f9-5d8c7dd72ce7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--796d1875-9a53-424f-9963-f09cfc479848", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6f94738-b8bf-40ae-9b6e-a4f7a330bc4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5297d3c2-66a3-4932-b0b8-d92d2509626c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e06ef958-6b0c-4cca-afb6-8e77176ca49e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56de1a4a-ad30-4c4f-882e-1d8ab6cb858a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80a22c2a-75da-4998-bac7-56bd4972726e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8df4c8fb-a496-4d69-acc6-59bb9c8a8df7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--521104d4-88f8-4a0d-bde1-1f7a7deae50b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3a3c152-3975-4137-82c2-3bac0a4a4fa6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a9ea7a2-4f0c-4eb2-9a01-48e206b5b28c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb8274c3-d646-4c48-9831-e0575b748916", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79ed384a-95a6-4333-834d-8043953349f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc94f94f-1dc8-415e-b35e-8be13ef4fb3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9a065a8-d8a4-46a3-ab9f-373522d14988", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7a53e4f-990c-4dcc-bdbf-3aebc8d78b41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f845176-c252-4a9f-a0c1-f10cf594ed00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aebaab7a-3567-4d48-b371-10947a976b67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65a1ab21-15b0-4846-982c-f1534210efb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--022e0fb8-fef1-48aa-bdee-a1f069fd82d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a538c7c-4159-43d3-ab09-94e04f9836ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d65d8b1-93c9-4587-8197-3084c2490b3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43c6d3e7-2440-4b77-9265-2285a013c855", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fda23777-749b-4675-89ee-a9b0adb7bbea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f84cddd-569b-4a9b-a8c7-555c5a9f43aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f7d37cb-334e-4159-8285-ab4a2af34e98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e1d9fd8-4f43-48d7-8f45-7f5b918fd965", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17709bd9-cd92-4864-af09-43b9d9faf042", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80bed91a-c231-49df-b23e-85f8c27bb8fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6b1e36e-9c78-4b3e-906d-0273c9ecfce9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1018a6f3-3d7e-4545-a334-fb41b97a100b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88150bdc-51e8-4436-a987-03d56489ed99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2005034-988f-4ed9-8a5c-8e2d8a876f49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--431558c9-c0ed-49ac-b340-30c96f32c450", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12256ba5-e030-4c1a-84e5-98d017bae38c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3302ece-6945-46a2-b40d-1af263e0d6e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b072a833-452b-411a-9ea3-6ab3688fcf3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c90d6f4e-61fb-4533-b1a9-8606caa09086", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c2cd883-c4a0-410d-92c0-c8f5a8b82f76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d96beef-76bd-4c6b-b0c7-701c6a90ba9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed73a12a-924d-444a-b343-8417c4d31b8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e61059a-4d5a-4783-8e31-dab68554cf2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a06f6f8-8dec-4143-a61d-05ffcf331a8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0cd274b-130c-4168-b741-f191d2fc16df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3cbab31-1f37-4d3a-9fd4-2d0d5f39e5b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--243efc51-8c63-4cad-8d14-8f241eb6f097", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ede34486-d523-41af-a668-10bd89a90006", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de90d0c9-d51d-4f08-b6be-9b4d4f5ba53c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5ce979f-7260-4e6b-b3ea-6469a0797112", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--226097d7-6eed-409f-bee3-ffd1b5dd0a70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15773550-b252-4cd7-898a-82300d731220", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7b961d3-2e06-4a8d-addf-b1445d905223", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64f51497-9627-43de-a03f-0d688fe110f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94d92d1b-a7f5-4127-9a8a-9181924862c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b92ed5a4-a456-4508-8d39-e35b70f53ec8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--227cfc4b-41ca-41e1-b647-72648de3d5c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1599739-c65a-4f2a-a439-5e8a6157dee2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--275952fe-e375-4b7e-8b7c-5cd37e90a9c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68bbc23a-5858-4133-8030-f145bd6bf687", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12f6bdf5-4269-4b6d-ad91-7d3735125d0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--895b55a1-4ca3-4f63-b8d5-47b107072a1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14394a1e-fadd-42af-9931-d9f973458367", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3590b67b-2072-408c-8d29-081ad8d0c220", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71964c82-de32-4839-97cb-277bbbb248b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8efc3bfe-eb70-4eb4-977b-0c15ebe3d0d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b61f927-deff-41f2-8982-cebad9c45fb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--275b491d-643c-40b1-8ede-ab3018af8397", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5692cd73-583a-42b5-ab89-333caa1a3268", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77de6173-c3b5-4780-90d0-06dc1d5a3996", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cbb18b5-a28a-4d6a-b6be-d641da914133", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cddb4dfb-1189-4776-94e0-6b09d1e1b288", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76dfa204-e584-4829-8f16-c889b393e694", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--405d0d95-bc01-4efe-bc63-1e42539d6f09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86e27fd3-c172-42d4-9125-90cb7bfbccaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d074dae-fce0-4478-acba-5a649cc6cb60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef94cd51-f2af-4772-b301-acacfa84ff63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19b6c5a8-fc82-4f69-89d2-e309f5f9fcdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--340a79cb-48fd-409e-acf3-d312cde2bc94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c7ba5c6-2514-4781-aca2-16c5510eef44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5db234a-9927-4137-9346-1c9f34707259", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f2fb946-1551-42cd-8ae4-81183ec9c805", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d476f214-027f-400f-9344-f5de2c30fcce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09f9d28d-42dc-439c-9d9d-121445bf87a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4076750d-cbf5-442f-9a93-081c41a76f72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1fa7067-1b21-4c21-9b21-c4fb98c9cfe6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa966f10-39ff-43f8-86bc-407430913756", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13aff8dd-06e3-4e02-956e-3f79629d7c95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5f03280-e00a-41f4-9e80-7d4f0eca8db8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80f7ba70-d458-4cfd-9ab3-36df19380e30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bad2697-6269-4a39-84e2-9fa564750700", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5c790ca-9d78-481a-9c0a-e8e15437706a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61d31077-121f-45cb-93a9-ed7d8bbe0fac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1227b27f-f4e3-415e-901e-c394589ff132", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76c918e1-e4db-4954-b917-910c9efb2a74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1cce385-2440-416f-9c13-9b924eb6e284", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ec82e00-ec6a-45e9-a175-f40fcec7520e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e337c870-9d0f-4b5d-a3f0-9ea259feef0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--037a6c2c-d86e-4bb2-9535-870145933ea1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5cb70ac-fdeb-4a80-b09d-0495d166eb47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1630cba4-ae2d-4be2-916d-22a0aed43817", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74d3e680-ad2a-4abb-a5f0-1541adcc739d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad7079b3-0f38-46c8-8936-fb4dd5cce9ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a431079a-5a42-460e-b470-1dab3bb31f0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62d32230-e708-4b35-8dbd-dc324806e83b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4fb20a1-22ec-4a2e-96e6-18271b54a7f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b52f166-7c66-4566-bee0-8d8784bcf5b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99f42cce-40f3-4133-a739-031610007235", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--969bd37a-23a0-4e7c-9b7c-4c81920e5c90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7776ef8-b821-45fd-a163-5b0f33214ee7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5deb0966-767a-419a-baba-f2763f9dab7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50c51974-7f11-4892-90aa-b0a896c235f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e83d9bc9-ef94-42f7-af4b-9eaa5ffb94bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f5ed339-a48a-4cad-8c76-5efdff24078f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bea13738-8270-4db0-80be-74c3491a1662", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e35c9ec-b5a5-44e2-91e3-409d23b265a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--088defb6-0c43-4748-a892-18d9030d3eb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eba5904b-f42f-48fe-bd73-81e47b8665f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9482ceee-6b47-4c53-8f0e-ea30d3c1cbcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f54f756-d5ba-46e4-821e-9e4acc17e77e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--222c2425-328a-4f24-a1e3-52767a16850e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b052ccc-8962-4f31-876a-a1adbd88631c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15540df1-c6f6-41c4-bbed-a2a588c36720", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf570b7a-63c0-4a60-8d2b-1f31cab4a317", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1374e76b-6ad6-4b67-a195-e669092830b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9cac40a-a799-4ed0-8fb1-f6358896fbef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d47091f-d286-4bec-aee2-621dbb8c6a6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0f4dff4-5b5c-4e28-94e6-7d7b9cd835ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10a6232f-047b-488a-b68f-1d9ff26da7d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f369a04e-1caa-4dd8-a3db-9aedb8f26427", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4187e59d-c9f3-4cb2-8afd-0440207193d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--096c5164-65e1-4a21-bfd1-a2842cb501ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3c91874-86ad-4cae-80f8-838f15a10307", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44c73da3-85b9-4e0e-9427-1c8457dcd92b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ec3886a-b9b7-4a5f-858f-3957744384c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fac6575-062c-411e-a544-d35ef8e02343", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d7308a7-11e8-41a8-8014-5b2e566629dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83332f6d-75c2-4069-9a76-3f3768b36f81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1daac13e-6f26-4967-befe-34bac2ce5086", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--642620b1-4ecd-40e3-9fad-f8db4ad51bee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c565c2c-b705-44a8-bea8-436e9d7a1ed9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84e51216-ab4f-4117-a672-f2be5b36b03c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96129340-276e-48b2-9c40-957a0a6607bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0eb2252-2c6a-4dbd-9186-e5f0ad769a5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ecbf9a9-cb97-49f2-a858-c4b46e855394", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--534508d1-388c-4167-99b3-984283b7d928", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2734df3b-4628-4587-a7b5-96565804b5ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b3c86f7-bd51-45c2-984b-f7210cf3e82a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f4f4525-a845-4849-ba1f-b766cf219665", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0258449-aac6-4313-b8b9-3115307dcea3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c7d05b0-df21-4697-b5ad-742673565186", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8c91456-4e64-4411-9376-da8d4ca3b618", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfec2464-5f04-4291-a65a-eb2dd9d479e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41c617cb-05a7-436a-92f5-9db42b720647", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0230ff87-5a6f-4f14-9eb0-95d78c622493", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15d102ff-6bfc-4b97-ad05-341f8d3595aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40e52e4c-765d-42b2-952e-c3ed46153ff9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e46cbe4d-0222-4b78-a4b3-ca75bcdbf5b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04e1eca2-9d30-4c94-b24e-c5467e42c1ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a45c0f00-1d9c-4d5b-b5c4-3d5d6d57da04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f2b9240-9d3f-4b9f-a47c-c14bcc61a4c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc7a3a2a-c50f-4abf-9998-823f2638054f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--009500ac-78be-47ed-ad73-d0974211c40e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cff27df-de2b-4032-a154-90d910877f5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5960f34c-f94a-40d7-ac7a-67ab83a616b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9094f308-b91d-4564-a9e5-027a640b3095", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3bef2f8-d7b1-43f1-9292-0cb550ef5d3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25c3560c-2fa7-4889-8060-e5b5de8a429a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0383f967-e79f-41d3-a231-a2a537f98222", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aeb26622-736e-4390-9d10-669a79ff228e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5b10c84-5389-4678-8ffd-943e2b6e1fdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52422ecb-8301-4ff1-b80c-fa80654dbeb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32825a4f-0447-4a74-8cef-c7b82c943996", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41cacbd6-46b1-402f-9b98-be80e7d37ab4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ce22869-46b8-48fb-94c2-039010e32575", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--056d659d-8543-4993-bd56-ce49a88ee338", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4a03059-3e7a-46d2-8a53-295fb4e74508", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9eb4892-b392-4750-908b-76be34a17903", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fb2510f-b8a8-4c56-ae0f-fdd52192475b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a8a36b6-5a1c-4738-85a2-5199a9f4f40f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a3b68f2-0e92-46df-8045-0967891c7861", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b446af34-df1c-425b-b39f-3c212576400d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d49c01a6-9fe7-48f7-b65c-9e2b961e1cc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1288ae7-b53c-44b1-8bc6-9ade73396668", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0adbbc8-3bc7-4b6d-a921-215b13994343", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c1206b0-1c4e-4da8-bc8c-7799b2645107", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7279239-a613-40f5-b08c-657353d9990b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--083e945c-37dc-4657-ad40-10385fda57a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56853dd6-835d-4150-bae1-0a18164cfc7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2581cdd-cbf5-434a-acf2-7c8c7b6509ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f7bb9e6-49fc-40e3-afd5-42dd5df6c01b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.214.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dad05d51-78b5-4b43-a771-adcdb2949e8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.76.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f09ef046-fb1e-40b2-872d-29c13cddfb13", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.210.61.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2461d5ae-1c0b-42f3-a746-cda44d2aa247", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.172.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5056fcc7-15fc-41ba-82d1-1f9908a3314d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.195.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4329167c-4daf-4bda-a444-6e1aa591c557", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.201.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--397effd8-4bb2-4285-8bd0-8d5e100c3aab", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.225.56.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3ffecd9-168b-42e9-8e14-03d33056e7da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.225.57.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f3649cc-9da1-4098-99b3-33da1db54caa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.231.116.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5aa50f6-14d1-488e-b88d-b80fdb5c489c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.233.54.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b93bdd4f-88a4-4d42-b3b0-6d0f127110eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.106.166.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58127fe1-73e0-417c-b591-1aefba51d9f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.112.158.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5e72856-01f3-4427-b79c-85444afe2d1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.133.45.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--874ef453-08e4-4881-96d2-49b32acd5d06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.138.134.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--224c3ee3-ffd9-4774-bfed-c1423457ad19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.139.138.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aac72d9-4356-488a-9b12-def9e5993f0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.151.144.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cfa81f4-60af-4198-81e5-16558ecf2ea9", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.25.16.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d45846ae-7040-4ef3-a757-243bfe2d37ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bee20fc-354b-43cf-984a-036f90af5292", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63650f8d-395d-4348-82d3-74b0cbb5e3b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25bf5208-a3ce-4e9a-82cb-7a7b23018086", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8aed2def-6a8a-4bce-9adb-4a0a9723db63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65634180-857d-4d7f-9b3a-7f9d651fb135", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7a11423-de4a-487e-9d60-301538655728", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68d3d8b4-de35-4c5a-840e-78d7bfe1f155", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4425365d-99cd-4035-b26f-b0711bea3a2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a30e2fc9-f41e-4fb3-b8ee-cf15271477eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a1c3f0e-a377-4f38-a07b-06b154e4ff5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d721ab45-dd86-489f-bea5-9855c36dcbc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7b0c9e2-48bd-4f14-a478-aaf8b4fc2c73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a036b10-229f-4f9a-abd1-b5ff5937ae83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1458e26c-e93b-4932-98d2-0dd794f5021e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26db0d8a-f435-4ae3-876c-59e67262c61b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed4d9675-42de-4ef8-b9b4-ab6b2a30a778", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49e003f0-6375-426d-ae1a-9002d1aa0450", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bfb002f-c1be-494a-927c-06cef7da920a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--898c5d16-69a6-4499-865d-d574c1b5447d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3226fbe1-4199-4475-b1cc-8bf1edb76934", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0f09533-0865-406a-8ead-0660255ccb69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f41edb3f-a491-41ed-8442-95d29b281972", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16c40a4a-a1f1-453b-9329-ac4e5899877e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c007e442-7691-4a21-9967-81b760a728fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--261ebf77-910f-4981-a933-295dce2d86ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f268bcf1-acda-4cec-bd55-cb8e404d87ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b20261f-b5c9-4960-9f3f-65933a54d6cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51c4b178-8127-4f0c-9e37-d6c1bd21199d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40b36f57-19ce-495b-9836-55189819631a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--632e3f4b-9178-487d-920b-cbfa06937145", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c56155ba-1e02-44c5-b61c-a6f8981937e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.41.186.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed550a38-3815-421a-b3cc-7a472c8018b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.78.106.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--947a3c00-86eb-4bf5-88ec-42a43a8deac3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.78.149.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d56a5132-8c75-4fd8-a1ce-1a892f1f2db8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.83.113.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--588fc6d2-940d-445e-b602-19aff4ef158d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.92.240.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8fa6b46-9e4a-494a-ad26-854690993dd5", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.93.144.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48002e97-93fa-4f23-8aee-83b7052ff269", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.99.140.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49cddc0e-8560-4901-bebb-3d60d2b148a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.122.152.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa04705c-90c0-4506-b78c-3474c2a28861", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.131.200.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95821586-5785-44f3-ade6-477bdd74e8ab", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.140.216.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09de7537-3625-4834-b1fe-e49bed7399ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.142.204.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6baf603f-2ab6-47a6-bedc-ab71507fb03f", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.186.114.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e42336f-756f-4ff1-ad55-d571d48aa184", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.186.122.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2234d5f1-d6c0-43ea-a20d-cf87a8954c78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.27.217.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d11d6226-afb5-44cb-8fb8-26d9fd7df6d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.59.160.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--181951b6-9637-405e-b9ea-a38189ab4263", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.60.248.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aee351a0-0071-4b2f-ac79-17ba65a19e5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.77.53.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8b85619-a3dc-44d5-889b-bb547e51fb38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.8.51.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79e6d8b2-ce51-442a-a919-c7e1c5de7390", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.129.40.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48b0bf9c-3c8a-42a1-ac13-9bb20944edc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.132.109.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--316c376b-515a-476a-858f-29781c96ccb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.132.109.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28a54dff-90d8-47c2-babb-34c20b027c2e", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.143.151.1']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dce3e294-a1c1-41ff-a078-55c432a80407", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.143.151.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7c84f68-f2c5-4b1d-9ad0-8792a949cedf", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.143.151.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b12eff3f-2a50-4c1c-a3a9-8a27cc479fda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.143.151.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a7fcd21-556a-40df-bc6d-038bc0445de3", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.143.151.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47259a2f-0ea0-4ba9-90b7-2403c6b224bf", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.143.151.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--219d9f1f-5ce5-471e-b896-0f11ec8af9e4", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.143.151.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49c6b041-55a4-491d-9b0f-478108da0d3a", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.143.151.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b8f3fb5-2744-46e9-b61f-abfebcfb1a8d", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.143.151.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--480f06f8-890b-4894-92bb-fca8e7d78686", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.143.151.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--534334c4-8d06-4e50-8084-548cfb761017", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.143.151.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7d66e7b-38cd-4fc6-866d-2193d2451b36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.145.191.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3885955d-998b-48fd-835f-98992625f24e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.147.153.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--035c26d0-401b-44d4-a6be-441cef11033e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.158.202.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a68e38c8-35bd-415a-8c59-8b87ac324680", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.159.55.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acc12193-f6ca-4985-a70c-27e9ab4c3870", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.159.57.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40f29435-40e3-47c3-bd4b-f3651a5c194b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.159.57.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f5cd1b0-aab1-4a27-a20f-678f5545d712", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.172.182.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88f96203-c64d-4bed-a6b2-d6f8dda9a38d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.172.182.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a2c1afe-d1eb-4311-a1d2-aea794bd43d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.172.216.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb140e71-6cde-4d9e-99b8-0f803adee57f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.183.213.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef8a4a10-c1ed-4315-b1f3-6333ab15954e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.183.214.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ba19f73-f5c5-4e85-a652-919768d31616", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.191.81.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f08bdb54-94d6-452d-9eb8-15f0562ca682", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.194.239.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fe1b9da-3b30-4b92-b06a-f64ef15229d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.196.152.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4714215f-afa6-4bf9-af12-baf07cddf3c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.196.221.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd2b30c0-b673-44f0-88f9-aa0e5150754b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.196.246.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26ba232d-1151-4fd6-9c94-5b4dbf9a0a2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.210.183.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47542150-7a7b-4085-9a8a-7f7fabcdd502", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.210.185.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf4a62a6-6a4f-4ec3-9a36-c2dd4520d3b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.224.32.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a59084b1-7741-457c-9cd0-6505e9d11795", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.226.139.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81a9d109-fc05-4069-8b2d-c3c1bab808fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.226.160.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b6b6b6b-d64c-4ce8-86f5-dd96be7daa9c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.242.147.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79feec42-46f6-4c2d-afce-17f0ed07937e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.246.245.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee547e7f-03fa-45a3-aef0-56646996898b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.246.59.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ad01898-7cc3-4748-83af-14cb228bb301", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.247.89.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4370af1f-3c99-4065-a688-432df3518e4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.248.176.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59223d13-2bbe-4e1d-86e4-fb105406ddc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.248.177.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6752fdcd-5885-4ee3-93de-ef35e17fb212", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.248.80.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04db8469-4fce-4b2e-9563-c20e634eef78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.252.184.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1ac4fb7-dd08-433d-8cad-571cbad35aa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.41.40.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7648dfe5-90e3-4449-85b2-346b1e06b7bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.43.205.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25f6b61d-6f9b-462a-8f93-22228fe7dfb6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.60.91.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54fa4027-59e3-435d-b743-a4bf6fe030f2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.61.143.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--015c1137-77b3-451d-963c-8ed715eb8321", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.61.197.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2ab6cfe-ac6e-446c-bbeb-fb652e304f85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.61.207.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b0a479b-f7a6-4044-bb27-5962064c4db2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.66.207.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2737b14-9f38-4ddc-bf1c-1b3c55455282", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.70.51.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b65f0584-c94a-4b0d-91eb-7ff2e3555a53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.76.197.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e82f88b2-cc7f-445f-ba7b-bca1b46ab295", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.76.202.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c780f42-9a20-4963-98d7-e7629e4c0e5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.76.73.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e7bf45e-a58a-4586-91cb-af9aaefdcf69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.77.249.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cce4daa9-7803-4830-96cf-ceee2289375b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.78.150.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1afb4632-73c6-4f24-ab40-f8a7130f748b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.104.64.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86e601b3-a69e-49ea-9ca7-aaf1bf4707c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.105.157.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3846edbd-4ec7-4ce5-93e8-6bd8ca666221", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.115.195.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a313795-162f-45a6-92c4-4379eee41fed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.171.240.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02a58d6b-c24d-4816-b46c-cc1de069a6fc", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.194.1.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4ad0f43-c841-496d-8620-8978e988639c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.78.141.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e9dd5ca-f813-4162-8e21-6d397e028c3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.81.82.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6ca52f0-c753-4aa6-bea0-996459eea195", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.206.92.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02ceaaef-6815-42bf-8e6d-2f5b15b82810", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.211.84.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f3d357f-8ee8-43b2-a81e-147192afde8f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.213.160.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a99f7f6f-5e73-446e-9b7d-98a48025c214", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.236.161.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf7776ae-3902-4cdd-bdfb-5cfed223110e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.246.231.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebe116e1-d551-4860-9d01-5f368a741757", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.119.29.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--806815c4-3484-4d61-acb2-e948f052f4ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.119.43.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc78ca56-92f7-477e-834e-7f8665d4f37c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.127.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc0baeea-c6e3-4b4b-bf99-8a27c0478f49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bd2bd63-7f9c-4ae5-bf8b-d5a1934e1c9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--867bb80f-ae67-4fc9-88ee-aca625c3537b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e70bbef-9b9a-43cb-90f2-1fb42a0e5b05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5b57f26-ea20-406d-9f6b-cccf364ef215", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c78240c5-c79f-4182-97fd-c3b6eba36fa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.174.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e0b0c10-8715-4737-a3a3-df9925ebdc4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.174.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99ca6a7d-78b6-4872-8e47-7240da55b0fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.174.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecb30146-fb8b-4ead-b2dd-63bad1eea6db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.174.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f16fe1bd-c8c7-416c-a1ae-761d88ab5cec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.174.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0aadfda-0681-4d10-8542-4e587d3151ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54163131-0b06-4622-8692-fa4ec215ec60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de6168b8-3168-4f1d-93f7-f72c91903e35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07a6e8ef-cef3-4267-bfec-9955953a26b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--745ff4da-9584-48bf-b5ff-cf85072d7744", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--893b2ee2-a7cb-41db-97a1-2e10fbc3f8be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3963bed-fddd-4fd7-a7aa-5698181db7b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.184.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c949a5b-f59e-4f23-984e-062f72f28110", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.185.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05a29a5f-3750-4324-a83c-a5ac51137d49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.185.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75631093-e25f-4aec-b66f-3ff58c2b61fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.186.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a7ecbcb-387f-4488-a0e3-e83da52edb10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.68.94.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae381806-3a28-4477-9cfd-51e0e723db3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.116.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba753104-7747-4726-88e2-5f9422662965", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.116.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4451a46e-74c0-430d-b609-7e416117638f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.117.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e54f791b-0e9a-49ba-9087-9cd4d0d8da23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.124.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b310605c-244b-46aa-a238-4d15a13378b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.124.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--450034a0-4a3d-40f7-bac0-ce751d254de5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.139.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d44efbb2-018f-416f-9d41-23ecfaa6a0bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.248.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31d5a240-b188-4347-a9a1-e867c9579fa0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.99.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dde6c294-bd0a-428c-b8e6-4ea83497a9e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c1480be-a7b8-44b6-a80c-04391c70a596", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e38d809f-8f29-48cb-ae5f-310511406896", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09611f9b-e82c-4551-9584-986185e884a1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ef22e81-b7de-4861-91bc-c855e1985f58", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7763008b-a7a7-4e10-a9df-61121da6f66d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--646a4883-5cd5-4016-a43e-55ee3e3acacf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff6bfe4c-e8cb-4f4b-8ad9-67899165c272", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8623b54-d0a6-418b-bbdd-adf1aed5a911", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31f7298c-f837-40c5-96ff-b6982092ff46", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e25754e7-c02f-4df1-bd2e-1b964ad0f100", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a1ed725-d7f4-41c8-bbfc-ef03d71a7ba1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4803e44e-a892-4793-bd9f-5bdec4ebc74e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3cce005-5a83-4b1d-97d2-b45b459984da", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83f54295-1e59-4473-84be-58fc295d8b9d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0afbfae0-92b6-407c-9265-95c3c9072211", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6914b026-bc70-4597-804a-7b0b9ffee3da", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f6813f5-943c-40e5-a0bf-5c869d23d556", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4459788-db52-44a3-8b5c-cc17babccc73", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34a4a8d4-7a2e-4dfa-8059-5e4f7442c82b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ad29fc0-d2fe-4c45-a5ed-6487f5dcc9b6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c9ba414-e099-4473-877f-b3a37b8112e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.80.207.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a6b24cf-d71b-4c66-8766-fb43520a8f8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.123.17.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb26b4b8-a7d0-4307-9c8c-7e1550b91eff", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.128.181.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f29e51e9-f96a-40ac-a386-50ae5e8dfab9", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.158.32.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09a27cd8-ae58-4273-8ebc-8c9825233b2b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.214.44.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d7ed037-6932-47d9-93e1-f827519c4b14", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.216.177.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f11c6da-4bef-4ce0-8cb5-c546e228980e", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.216.53.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56480d92-2f5b-4417-aa75-4ec648b67091", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.227.71.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63e36571-c61a-4a6f-9db5-0391f4065072", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.242.115.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2871de6c-d8cd-46d7-90a5-f05b98eda862", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.242.162.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1afc64ab-307d-4f4a-8629-f9603851cae5", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.242.163.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c8fb3f9-add4-4db8-ad75-529374e5735c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.251.20.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f2f55a1-7af9-416b-a2e7-10259a9e2618", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.33.91.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89094d48-b6a4-43ac-b038-9398914236c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.35.142.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1198bb9a-abdf-47da-82be-6f0008f32adc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.46.54.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02f92268-f5e5-423d-a6d1-258139f558d9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.63.62.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44e4d624-9d65-4e5d-a44a-543241fb401b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.72.96.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0b16b9b-a382-448c-b2f6-b5a8e6ee1ace", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.75.70.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56b51ab4-e464-4243-be5d-fa207d1a2987", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.82.69.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5df7f4f4-a236-4550-878d-a1b04f1e4114", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.83.164.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac4b308c-becb-408e-8f7f-ffa2bba86762", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.90.100.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfb77a1b-3ffa-43e5-908a-78ae338e86c6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.93.28.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3142f843-3a16-4f19-aec0-b720571b2bac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.1.101.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--411bb5c9-dd1c-4140-8e85-99f8e05b3a60", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.123.124.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c67ab225-4237-4890-88b6-9c70e7ee82c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.123.72.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78433a31-20c5-434c-aab5-a5db59bed220", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.200.78.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--506a3980-be6b-48c3-ba62-66d46d0da3e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.81.126.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f697129a-0d55-429c-8a38-e7ce067848b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.96.33.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e122acd8-1624-48e0-b6cd-35818d31b644", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.108.19.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa3190b4-9866-4194-95e3-2d031929f732", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.128.120.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--607445f1-c71d-4e5d-8f2d-c57955b51226", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.128.237.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--deb10dd4-6740-43d8-98a9-ec12ae6eb614", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.132.227.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e46b6d0-398a-4b4f-8ffc-0b2dbd278b21", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.14.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa165925-55cb-48d5-9db7-fbe8f25c66a4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.191.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1eaef13-385c-43be-89a2-202f92a1e01f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.194.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21be1101-3bb2-465b-9c7c-c0bf05b95149", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.69.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e736517-0a4e-4bb6-bbd1-f1f31181aba9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.144.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a549c93b-e7c4-4c37-855a-541256700496", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.122.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b60f64f2-6306-4bca-9498-a07ca1d9cd93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.135.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df3cc6d1-0d59-4537-a94e-707346f719ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.96.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--790a6121-e85d-49a6-8311-dfcb548018a6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.155.40.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ad25842-9efe-4aa4-afca-15278f7fe13d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.180.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d385eff8-8563-4c0d-b603-05ea8da4c60c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.43.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dce961d-c5d5-4028-92c3-48856b43ff2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.50.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3513328b-db62-46a4-8487-98a711dd1d22", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.170.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2cb3ae4-2627-400e-8d49-5e31bd920c98", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.172.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14b037f2-5ebf-413f-979f-dd21d4599b44", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.181.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c308a88d-9041-4950-86cb-264ca79517ae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.38.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e9ebfc1-bcdb-48d5-94a4-f5e531909bcc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.50.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5678ca8a-1f79-449a-b419-e890054c013f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.52.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ba78cca-0252-41fa-9119-d484f597fa2a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.82.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--204aae90-7100-42cf-93fb-6508e50ac9e4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.58.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac5c7a46-3449-49f7-b523-2714b07e73bd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.160.233.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f3bf0ee-04f2-494f-be57-ebd92c7cc812", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.161.217.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--967fdc4b-3172-4e2c-9248-057d42bb7704", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.164.0.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36889021-6273-450f-87a6-2cde71fb9937", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.164.192.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7793f399-fd34-4fd1-bca5-02a287f200d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.170.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd6a2b6c-797f-40e1-ae3b-6cf4d23b2f37", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.185.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fb01a3a-7f4d-43cb-84fd-f2fa2b9f89b6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.198.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e68ec8f7-e3c4-492d-8e25-0ae1ed8fdaf8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.3.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67b2e2f2-dde8-4146-8a86-b77266a64b63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.65.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44f7e463-72be-443a-a19b-84be051ec684", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.244.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--746181ee-8b39-4782-a030-a9943ab82da6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.194.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--000113d3-fd76-4d0e-9c6d-70756263ff46", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.194.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcc72612-cfad-4ad9-8065-aa1036609098", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.195.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2538fe5-e8cd-4870-965f-3f6182720cfe", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.174.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40deb03a-c1e7-48cb-9168-165b5a40146f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.226.36.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5450c4f-8521-43f8-a63c-76e04dc551fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e44782b2-4b4b-446f-9d39-d2b99e0d6e29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86bb7b52-b620-4a62-8785-916525fbf55f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a34395a-23ea-405a-b68d-137745772467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6be5e8d4-5e84-4ea5-8393-6f46ef70e066", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c3a9931-3d84-4525-8723-59529595d20e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dee1adc9-6f35-4894-98c0-01a69f628bf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ba51d36-6279-4384-9fa4-eac5725b9e88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce844da0-e7a4-417a-a26b-2aa5ae8b2c98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d71ad53-b68b-4583-9d8d-15969dea16ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb000f53-5833-4400-95ef-92bc284300d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73350137-aa91-411c-8343-553527a70d40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36e1853d-0f90-4f85-93d9-5a45b38df208", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5ed2345-135a-4690-bf7a-8b81f7486f97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fbe64e0-96a1-4408-9e58-570ffc7ee276", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3469a29e-3d0c-4b47-a818-ad4090f0be97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ca49304-202e-4bb4-94a5-7acd6b912d92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa072f94-20b2-41d1-9554-e67c4e59618b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2e65cb8-c7cf-4ab5-8b9f-ac98a1f7b586", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99eeccd4-b373-42f9-a8e0-b484db3f8b4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cbe8d6c-d4ba-4daf-90a3-dc833fa7631e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac0ad7b6-6769-4f76-8a86-c8be392107f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06b5d168-c543-4ebe-87db-c66210613c71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a084bdb6-4c69-4b83-a149-b8658e80e92f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bb6a12a-1026-4bfa-90cf-3a5b6eb47833", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d281000-7a49-4798-917e-7ed48adbe535", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdaff357-f20f-4cd4-9605-942dc29ab55e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--028074d5-c552-4a5e-bcc0-ccbc6fc77ece", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fba8d07e-c369-4c97-aed2-18da365a6ed7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25943499-ed40-45bd-a1ed-3d33e5f9e3dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc8ecff5-8aad-4a3e-9525-14500d35b4ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f3ac927-7683-4653-881a-af00ff80fbab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc6ee92c-54f0-4238-af3d-5ed4d9495ec8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9af7193-e4c7-4a36-9bff-f626335a1d16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1d53912-9a9b-44df-8ac3-9ff1cb304670", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8148ec0e-e58e-413f-850e-eaa499ca37a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5961c3e-5622-4e26-a4cf-5eee0fff939f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--922ac969-9211-4aaf-a589-16f5074332fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75dbd7dc-dbb1-4b8d-a71e-9f407345cc16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f900b849-694b-401f-b887-7cd503c5b2e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f49332c-2579-4aed-b1d6-9cb4bae8ea79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--446ea14b-b60b-4efa-b4a6-e41d32d69f88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--541c5f20-d18d-4629-9346-7d38718fbed6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4437b1cd-c428-4222-b5b6-fbae558c0579", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a18f59a0-b41e-4ba7-817d-04b9c062c80a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c059f769-094e-4fc9-8dcf-b722def438f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14f299c4-74b2-4f60-b45c-a7eafef7ca7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08ef9dfc-414d-4179-a653-643c1664b847", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78460bc9-d5f5-40c3-b066-7ee32b316ea4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aabddb69-3118-4612-bb95-ddbe8a41be37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7f72448-58e2-43f4-9756-5df3531e7f50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42e7d06f-4ff0-40df-bcf4-49d0765506f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b56234d4-f0af-4160-a428-a127b3ae041e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--381f427a-5ed5-42f7-838b-55ccd329ee78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3a449eb-15f6-421c-9328-219119253d87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5862595a-a764-4203-9ae0-8f30aefd98fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa4bb615-a71e-4e50-bfe0-1c7e58a6b0f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20ae387c-ffd8-45b1-b1e0-6299dc6b522d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4959803-ce75-4ce4-868d-1fd202d7e988", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dcb37ce-dd46-4f0a-aaae-c5378324c955", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7799d458-9490-4245-a8d2-58ba357fc7f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95136358-6b6f-4aae-86ac-6b1151f672eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3819678-8dfc-4bc8-996e-de2141302635", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2907c24f-1044-427b-9830-bc3a6c7a3fde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad42beb9-6f3b-439b-a4ab-753805ef5c08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41049c23-3671-46b5-ac2e-0b33880cbde3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--346b6592-ed5c-4ca8-ae13-23c5d6e52b35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4560234-edd7-4df0-a14b-8d55dbecec8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--668fec59-0476-432a-a83c-535f1bfdd65d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82187daa-fc9c-4864-92cd-3743b389d845", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--654090db-e634-46b1-92a7-43af2405a188", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92b4994c-dd91-4f9b-8cf2-f1b11fb3e888", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44bc411d-1477-430a-baac-0edf84a98fdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21da6bdc-b8ba-491b-a623-988733c538aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e408ce4-6642-4fad-82d8-8f667bf5fd96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6139e006-5f45-402c-bd3f-c280b6b59172", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77d47f79-66e3-430f-9f3a-085812d0b27b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eea1d22-af32-40aa-9ce0-4cfa6b2ff78c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d1a3b7f-a9df-47c2-a8fc-53f16ac7510c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe22997d-8c39-46c5-b567-365fd7541be2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b07e44cc-44c0-416a-b0f8-8a24402c39a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9a8bf42-49c1-42a9-93df-e07761407dba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79fe3641-575d-44d4-8e94-3dfa5efe9d4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8063b3b0-3f3f-4a43-98fe-d72c793bfb8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19392b5f-b355-4911-8451-16321030ea8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1d9163d-301c-4cf0-8acd-b6492f228c54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b0ee646-c89e-4f1f-ba86-a0a0fa2ca7f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1698ffc-6adb-4ac1-9d9a-ebf2da051eda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c28ce7c9-a272-49c7-bae5-a73b6c3056e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8794588b-8cba-457a-9cd5-50ec803a61ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a387294-5489-4be3-b70a-e657b6900775", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa3da78b-9d35-47d7-b656-cea18e2a6166", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01c0ca5f-fe4a-4dee-ac59-b182c98cbd44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aced1914-2f81-4f69-bafd-3b0522be1fa3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ef182b6-f807-49c9-906f-906b9084742f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79f955b6-8b46-411c-a8d3-3598ffdf18a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.240.55.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7a4ad6d-5d26-42ae-bbcd-8003a06fe1d5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.245.97.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--800f53a2-6e06-4e5d-855e-37fb0b50ca56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.248.109.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d39cef7-42b9-4626-983c-35845e83ee50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.248.109.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beea56ec-f317-495d-beb3-9dc9dd450226", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.248.99.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db52f17d-7757-4584-93e5-73ef83b46d87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.201.103.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49dc4487-8bec-4811-83a2-be313a1c8f28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.201.161.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3be1f3a1-a8e6-4e8f-a4b1-5893fc1f03bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.201.164.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dc8f8ca-051f-4aa7-99cd-15ec0b2c0e80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.202.13.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79d946a4-1edb-4886-90ee-3ca91d90216a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.202.144.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dc153f6-f3cd-4e2a-be65-51f0f4431451", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.204.184.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abb3f1a8-b7ae-4809-bf75-d4ad6283e522", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.220.188.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b59ad771-bd3a-41a3-aae4-1b152d1df3da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.247.181.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c4d06fc-100f-4104-a9a3-9e595d88a473", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.252.61.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51ddd5fe-9117-4b3b-99a4-00adc62ede57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.112.149.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aafe728c-39c3-452f-b238-3cd9e989f211", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.119.87.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1ea8af4-4a85-4b61-b3ee-c88a6f9e5102", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.120.115.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--539bfb06-5440-40f1-8f19-5979816954b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.120.126.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6b3e0a5-a605-4442-a58a-e4993c296c1c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.123.110.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1862e846-5b61-457c-bbf5-bf1537317a95", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.130.200.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc3b0be8-9249-41f9-95ea-aab5620e1352", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.132.92.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c385033-67ff-4c06-bec8-c6ba6af852b8", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.134.9.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--347b4952-651b-42a8-88e6-3da6cb2490c5", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.134.9.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--288d84c6-63dc-42c1-8232-e928caef244b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.135.161.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e03fe5a-b0d3-441b-a00a-c0998e88e0c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.135.193.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bcb72df-cd37-4963-acbb-7bb008c451c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.135.194.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65088f92-1839-4d82-88ed-69721de51c26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.135.194.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bbef49a-474c-4fb9-8e6b-eee89f527b4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.138.16.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c74b83c3-5ede-43db-8b75-bc6a5edb1120", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.14.28.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--628c4640-b392-4fce-9d80-19dc938747ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.141.233.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40fa1dea-7d2c-4272-9030-4e25d853b27f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06b97eb8-00bd-4a93-be74-baad3b21eae6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc1bc39a-ab87-43d4-bc39-a04670e2fbe8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9271e08-d3aa-459f-91a3-4ed40bec87ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2319228-dcdc-43f4-88c1-76a3b82da57a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bca7d52b-fe0e-4c2c-9f98-da6df4e30155", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27f563d1-d05b-4c69-85fb-82bb256d6e96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--230a8b08-b81b-4a0a-8b06-2d3bc7de0eb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1ae5281-111e-4dda-b6c5-a7754cff779a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d305bc1-8be0-483c-9aa1-ce255c38683d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89ba594d-7ca6-47cf-b9d7-df93c7714b6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4768787e-4787-4185-9c05-c4aeeb1dde46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7511dbe-947a-4553-83d6-f7f46e0bf861", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--134b2ee2-2e25-4245-b9a3-ad73029886f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50f698b6-0d08-4915-9b8b-fc4f7b951853", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68371870-b5d6-4640-88a6-932b36c8f62a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76e551ec-491f-4f6f-81f7-5c2e9138acdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0d4b3b1-3ba9-42ca-ba14-c14c9247e4a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08c24edb-8b0c-4691-a8c2-fe1413aa6727", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0a30613-a20c-4810-af72-e5b5b18e3568", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.42.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a37db9c-cc81-4820-8a65-8f49f47f486d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.144.212.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22dacfae-eeb7-4187-ac51-0a7385776a65", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.147.249.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2083f2c3-93db-47f3-a9d0-e5345f8513af", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--516c6a0d-08a9-48dc-aabb-07d75bd3458a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75d9eec8-fe0d-4f5b-b13c-7e7935ab980a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f544206f-99c6-4845-aa97-ddeca1429567", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcfe5bec-7e42-4bdb-a046-d9252a399a50", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de4b7903-eaa5-42e6-ad16-9a97438ecdf7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e34a978-5c6d-43de-b091-a6ce513da4d4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ffcd551-ef22-438e-9009-253d588a1b58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91d245a8-864e-4d60-b750-e4f1e3dda891", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ab59b61-d53b-4f99-8505-9f18a7e5baf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e1fb9ab-bcd2-4f01-a52f-5372d08693e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd0e9964-2c38-47b7-8837-bc2e4c928756", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf8cf3d3-98ed-4a8a-9d0e-c5ca40491f63", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95fdfde6-9703-455e-8aa6-049f1ea7e1a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b16de27-94cd-4d21-a3bc-b124d03ac8ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f6ed90e-95f8-4a0c-aa1b-3406406de541", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.102.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--808fa081-8078-47fa-be44-c2bd355ea4be", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df39c178-f38a-4b46-98b6-74b34e5b67db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--665bac74-de6a-43c8-9e7f-4d768197993e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.154.244.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d92c211-e10a-4b73-b653-91ab388fd273", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.154.98.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90e2560d-ce68-4f32-a68d-c94371205b6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f328cce-797c-4996-a296-b16721363b18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b6cb6f9-1086-4296-a4f2-62f067c68fc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad81fb89-3fe2-4f06-bad1-ebf5c6330db0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2aa532e-4753-4b52-b02e-6b5d0ba8a3ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98b72442-5be3-47a1-8b93-5bf43ab7c8a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4709957-98d9-44bb-8cb3-9640ae3ad0ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e81923c5-07b1-40d3-92d5-9a12daf5848f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99855d0f-a250-4bf6-af8e-8b1e3f00c8ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6181930e-75ef-4fb7-8940-d6bacdf425b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6c9cd12-bcb2-4999-b37d-10d6931f7c13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b40779ea-6a01-4995-b7fe-a10d01a9555d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2cbb7a8-9275-4119-bfb9-9010f8ed9bab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb49dcb7-2020-4a9d-9164-85239be618a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcb1a1dc-5686-4455-a132-91ddc63fcd68", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1802bf46-8749-42fd-892e-d042bd77608b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f30c774-c633-42c8-b5ba-402716fe6492", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fe6b0ea-9edf-416a-8f70-b4e5ff028989", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c8f08ff-a3e9-4f61-8ed7-4c6b931af871", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.157.53.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e66f83bc-acd5-407c-9cfe-20d6744c7955", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.160.147.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd7d532d-e84a-4121-87a6-ba22d81501df", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.161.237.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09f06f00-144b-4712-9c9e-2f0096291dd2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.162.36.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81ec2eff-2dd2-45b5-beec-72a51353e512", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.162.38.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a706c8a8-be06-4038-8367-afe434a3f7e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.163.44.0']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b58cdc94-869f-4201-bf6f-010e8ac72079", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.164.39.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1968e84-30b7-46ea-bb3e-ede740e5b2ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.167.151.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84ed05a5-9a19-4a48-8d18-9c32d6b3be8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.167.244.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--608d4f98-b3e2-43e5-8b8f-fd1d575e4901", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.169.98.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--003ebc92-0a05-4071-850b-5c7b6540ad7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.170.168.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c50017a-6787-4fce-97dd-9586c5758d95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.170.224.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c99c503e-4367-4827-9d6e-00d3955da9fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.172.19.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--718ecb5c-f5b3-400a-a921-f1c891850ac1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.173.197.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18fbdffd-8c94-4d42-bda7-9e71fddc6825", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.173.214.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd0556cf-4807-4ced-8c6f-7eae4059e671", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.174.38.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbce281f-dce2-45ab-9210-bb703223b737", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.175.143.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb256a65-f4f1-4f60-9782-370df88430f8", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.175.143.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fad74cf-4bd3-4066-a57e-bcf7aee7a00b", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.175.143.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2618adb7-b38e-45c9-918e-2ce1401935db", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.175.143.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f81d14f4-2113-4dda-83fa-fa2ec390e92f", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.175.143.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f5604fd-0bfb-4776-b6e8-75a7350d75c4", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.175.143.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ef49f54-d217-46f6-bde5-d35630f68391", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.175.143.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09e347d4-720b-47e4-a0d4-691ae2c6aad2", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.175.143.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81da266e-197f-4514-b9c0-029bc8db2cb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.175.143.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02fa172e-90c9-435c-85c0-27705a4df66c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.175.143.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb3ab7a1-3635-4fe9-aa22-52178cd70322", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.175.232.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d16089b7-bcc4-4eb0-9a1e-484ebdde5ed4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.176.66.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c2ecaec-8501-48fa-a23b-3288271ad0e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.177.184.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66d42d87-9695-4cbb-9da0-98f431978b66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.178.168.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb11f3a5-1552-4ff6-985f-4fa181bf6d46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.178.68.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0058acb-15dc-4b56-81dc-db65582b6082", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.181.112.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09658de2-5bca-404d-bf92-6b6d1a5bc687", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.181.132.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9a6eee2-11f5-4c58-9331-ac7be6ddf960", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.182.29.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06a3c8a8-af24-4d6e-8ad5-b0574de0002e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.184.113.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2ee9bc0-db98-48b0-aa5c-5998199d3369", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.185.11.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1706868-f811-455a-8ce3-8c39226bace9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.187.6.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fa7424b-691c-4f92-918b-65c346909907", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.187.77.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4673397-5b54-42b2-87c8-97b239beebfb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.189.154.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b8b7bc0-e129-406e-9c08-142326a2b500", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.190.6.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--016b697c-77d7-4a8f-8da0-a351ba3dfbbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.192.184.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d1435c0-512d-488f-a910-325d784bfaf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5590beff-aa78-4230-ba41-e0f500e1f158", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dda9609b-64f1-4d03-8a7b-3c1a1830cde3", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.195.250.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b5e1d82-32c4-432b-b1bb-1493e49948bb", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.196.236.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cf65cf3-8ae1-4a0a-8335-0b6460b8953b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b158905-487d-402e-93f6-34d1be140717", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f724796-67cf-4ae1-8567-77b2d976206e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3a49b73-f1a0-4f7d-9cac-78329cb7caa1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b827ece9-c57f-413b-894b-8cdcb6308609", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e3e359d-4b84-4cab-b77d-9bbbb2784a99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c390adf-92fe-4709-b1e1-433875d7f0de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--650595c1-8f77-4110-a54e-663b7a42c89e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1b748ce-8ef9-42fe-ac68-b094bc973be5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74452bf8-83bf-46ae-97d9-879c9e05788d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0a53da4-7893-4fa9-86eb-58c933b691ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70f36b6a-4c1e-484b-b02f-d2d00d08e077", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.226.120.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7eae9bda-4406-44cc-a946-3647a9e4a9ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.226.191.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71fecf72-dd10-474e-93a0-af2836366a1b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.227.254.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93f8ae90-4c66-4332-80be-39ce8c299ada", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.228.17.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a05d63a3-8fc7-4546-bbdf-cd3b82116eea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.229.220.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91e33daf-4679-4489-b1f3-370b4662f986", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.229.86.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5efd8f08-defd-4850-ab69-fac5e1e11d9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.230.212.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b036778a-166b-49a9-9291-c02e1a8981ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.230.8.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ed25736-e208-4d4e-9f1e-1297285a0b18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.230.8.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61d47154-72d3-42c6-9321-8910fa5cf750", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.231.59.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb336682-0a45-42e8-aed3-3e3e0f6986df", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.237.116.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5491bad5-b5b9-45b4-89ce-ffaaee7aa5a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.237.165.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c058d2e2-425f-4c64-b4b5-994ca39f5ef4", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.241.215.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db0a72c3-f3c3-420a-9a90-9c8ae25f490d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.249.244.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9f6fd7f-753b-4e24-be77-e5ef2c638535", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.249.246.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ded0480-b5ce-4b65-aa57-f95073c017a0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.249.247.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90d13c17-38aa-4efb-a343-c601e3774863", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.105.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--527fe902-9328-4cff-a8ae-afe52ccb56c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.105.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e32c87c-e383-4f06-a738-bce1664885ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.107.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5db0de7-1cbe-4308-a98a-1907b2f8b9b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.109.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b2627d2-3e0e-453a-8c8a-cba49d2a3c8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.109.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--431d3b9a-e8c3-468d-8a54-5a39de4e8c4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.110.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c433192-0d6e-48c0-a739-dabe3bc8108e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.113.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ea624e9-61c5-4287-a5f0-80bc3bc6835c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.12.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--694cc15d-1496-4fd7-b5d9-46e19f22c1a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.14.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bffb069-b752-401d-af50-aead056563ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.40.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4aa34864-b92a-4cab-a692-d22e63c00563", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.41.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3cbd131-9f52-4f29-a07d-2093a6ce2542", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.42.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a49a721a-a4f4-4e26-8a44-67e1f8c23f25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.52.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b020ac79-6203-41ab-90c4-305b04bc536f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.78.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30f95efd-49e0-415f-850f-9981687f3de0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.84.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--603da803-51d3-44a8-aece-416843254c10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.87.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e33f9401-987a-4997-b4b7-7c9a7bf102f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.89.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acf1dd4e-cad3-4e3d-9feb-fabd6c84c4b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.94.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--083f9279-f355-4e03-8974-6ae21b5c1611", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.95.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62a2481d-08cd-4bb0-963b-b764ccfd7f77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.40.57.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0724df32-9a24-4b44-84be-88a37a624236", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.40.57.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d665043-7973-44d7-95e8-6c3379cf5779", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.37.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5e264ce-5175-4768-85a1-68a19e545b32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.57.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06693d52-6e4f-4b2a-b171-420075c0e06b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4ca2b2c-f89c-442a-a22b-b550e184325b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df0db88e-5bea-4236-af44-2b019c3be44c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b09a4ea2-201f-4e68-a9b0-580604707cbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.62.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b558a3f5-77fc-44b3-ae74-5852967bb299", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.63.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b383c185-a332-472c-88c9-33a40a024d63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.55.77.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7f58bdf-d757-4bbc-bc41-8cdf24082d25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.55.87.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf4f3fa1-6adf-40a8-8b06-602202ec8c47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.111.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--134749cd-b68d-4e6a-aac3-1c67295c33ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b750f0e-2dde-41f8-8313-ce89fcfb505c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a289919f-643f-438e-bccc-52f793090c1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c2671e3-2d7b-4bd6-8d26-a503ac35d62a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.84.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c732aff6-0f11-4c19-b85a-d4eaba4ea055", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.85.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2de6d1c-a90a-4785-a4fc-25f998b71f3f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.61.184.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7e64e65-b2cc-492b-b359-247295abbd34", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.64.74.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83f2ce44-e38b-4cbd-ade9-da1c467b030e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.65.233.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cdec18d-d944-4c89-966d-e9dd5fcf0b35", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.66.52.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--517c7bd3-5cb0-4fa5-bd62-3f3fb1f5a322", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.7.17.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--494326ee-5b12-40e0-b575-958bac7378f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.70.84.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71960458-876b-4b71-afc5-faf379cf93c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.74.59.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b311721-5b7d-4733-9e99-8a1717feb954", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.104.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b6dc623-2e8a-4baa-a39c-66076ec75772", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a66cacf-31e7-4722-8ce7-ecbb4b365f59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--144ebfd8-3bde-47f8-aa3c-f672761c7df4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a13bd97d-210a-4317-a464-d7b1266c07d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f135a91-6dfb-435b-ae07-5a3c75a0dc20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.114.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca907f0a-7984-4a2f-a323-2377349b4d8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.115.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b33a479-b32c-4c37-b99d-d38d4c369e5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.115.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0997956-f2dc-4b80-91a3-751f3c07635d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.132.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4a61514-04b6-4289-8ad0-eb579ba19c4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.153.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11ee4843-2cb5-484f-94af-ae43d0dde573", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.153.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02b018ea-88be-4a36-ba08-6f1032d00da3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.163.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93a0b4e0-b07f-4fdd-a5d8-50a8ec78ae8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.168.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a7c232f-f316-4ea2-b6c6-91cc6894fab2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.172.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9f63119-c411-43c1-ae6a-ad4bf5797320", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.177.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54b927b6-4dcc-47d6-b7d7-e4c5ba807987", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.186.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bb96e54-1d7c-47c4-88f3-bd2cde3a1241", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.191.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e009101c-b102-4777-8ff1-a6098d382b99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.207.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e6c0095-5e8e-4480-ad51-640144567b81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.207.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95a749a4-4798-469e-87a0-e926e5cd87e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.225.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acc6aa3c-8614-422c-9d32-f9e7515f797a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.8.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b35d3b67-24be-434a-bf96-d45472efc966", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.82.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f97336b9-3fdf-483d-a6db-11eab0816d33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.92.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7864865-adb2-4c8c-ac82-7fb9f99bda5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.98.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--526c363e-7647-4b49-8533-e5154d34bef1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.85.11.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e906c6ea-2880-4727-925e-d87396f099e5", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.89.63.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddec955f-a857-47ef-bab9-ab093565a057", "name": "Malicious Host", "description": "Observed: FTP, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.91.64.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:ftp", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eda2110d-8362-4741-ae6c-150548ad1277", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.91.64.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2193ad66-f583-4822-8029-f19d95ab18ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.92.1.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--512a1519-3bae-470a-84f2-c7eec62e8755", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.94.31.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0459c861-125e-4945-b2fc-e9abd4f0478a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.95.233.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6aca3a85-fe7b-4f68-a227-ea20e0eda823", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.167.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db65315d-629b-42ef-88da-a52872e4bb29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.245.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e883a6af-2a5d-4f69-b01a-34e5f5f6ce0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.149.191.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f1092ef-f6f9-457b-a99d-e7e840aaef11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.151.178.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b91136b8-33c2-4b86-9ad2-a5160a7d5b5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.151.182.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c589655d-de5c-4193-8359-55d2d457e849", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.163.144.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c146176-04c8-4224-9e7e-1b0eb66db06b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.19.68.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30c92c20-cc3a-4d83-af3e-1ec7dbba44e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.210.37.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c102b2a-55e3-4f1b-823c-c062dcf40936", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.23.108.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--754a61ac-b6f1-43af-be1e-abc7d168b6cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.24.204.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e375169c-feb3-46f4-a785-d14acd7d5ba9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.252.2.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40d693e8-1a07-4d9d-9b5f-8829509698a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.43.119.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61098c68-ae6f-43ef-aaef-cbf8302acb19", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.110.71.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ba8a88d-de97-489f-9bda-b9603f809015", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.116.41.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e5141f6-7e4a-46ee-bb32-c39b05e87c3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.117.173.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a450ebd-fe76-43eb-849b-f5116cfcf99f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.120.68.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d482a9d-3337-4aa3-9783-c73b43508e74", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.123.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8473de8d-6279-40cc-8f6d-70b0830a8c20", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.123.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d75da4e-f148-4113-8aa7-1e0a8f3fcf64", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.180.114.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b883a881-3f60-4d04-bf28-982be0a3423a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.159.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d594202f-87b7-44ca-bab9-bf03eddcac1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.183.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1651933-c17d-4081-8805-79e6d719d5b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.184.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa4a5222-638c-4d76-b632-1f55f371f3cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.203.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40b13e97-dd17-4e1a-94f9-1a6c27429cb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.204.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddc503b0-e585-4c5d-9d96-61b7ede8ce36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.233.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e697a26-7902-4c97-bbd5-a498a1d8f121", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.192.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--212c68a2-9cb7-4f8e-a8f9-5a2d5bf42119", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.207.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ddb6d5b-b773-47f0-9a8b-11e2f2d42372", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.238.121.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--955f9c8f-1d78-4ead-96cd-c3f6208f52ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.103.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6b39d84-5234-4c3f-8355-81f12de65175", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.133.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb216be8-3f98-42f9-98f8-1a10fb11a08d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.133.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bb162f6-2261-4e8a-b009-073333436fa9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.135.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db33b3af-9665-4eac-a6c0-1d429528500c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.137.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee4db4d7-dc8b-4baa-8dd5-258d3f7df5d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.137.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75ede0ff-34fd-48da-aa98-49e2eb152243", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.138.1']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac73178d-e462-4977-a89c-830f28cc786e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.138.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7e461e7-1a83-4a74-9294-88f1f3257810", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.138.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f4ca961-2403-43e0-a052-c5fc7fdc8a8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.139.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99661d29-c62b-446e-bbf3-be022b9f30cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.140.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6747771-f505-41d8-a8b1-59a454d5bd80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.140.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b69e48a2-e5ad-4978-9348-79c9dd4480d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.140.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b3feb6d-3ab1-4f1d-b910-f6f6c042b1d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.141.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a314a770-e428-495c-8170-ed3d8b3d3467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.141.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed1752f8-3d63-405e-9616-8505ad6523eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.142.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d73a838b-b5ad-4b4c-b981-6a8ca3a31630", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.143.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1d51c48-1fb1-4f81-aa3a-28a618a5e284", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.11.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6659a784-76fa-489e-b8a5-fb0cd1d3132d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.114.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8cf3353-be7c-44b5-9183-47c8f174e121", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.12.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3a1ea09-6660-4dc2-b3f2-5992c84782a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.122.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85bca866-390a-4ddf-ba56-653dffecb70b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.123.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52894173-fddb-4fb1-951b-a470676b1828", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.127.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee121470-4121-40d9-aef0-a4affe26cf44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.133.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27370543-655a-4fa4-aa99-122e3d48f223", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.136.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52c05932-b9f0-4b42-9852-a53666a4b42e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.138.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b6401ee-af75-4e67-9b69-15cfe14f9ba4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.155.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3183943-289f-4c0d-a762-d56379d28047", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.159.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5278dbf9-3d7c-49d1-a487-42adbab54460", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.159.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65b98170-e35d-4afc-9094-a6cce3ce16fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.160.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c255269e-8f39-4970-aa5c-611c69b56b54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.160.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6e39561-33ae-4cb3-9913-5fa64c44f41f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.162.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6c519cf-1c5b-416b-a8e0-2b8420c7712f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.171.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d00e57f2-840a-4c05-8da3-e1712d53cfc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.172.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b81ea65-8644-49c0-a464-ca91cd8afcae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.196.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfff8171-9382-4076-9964-849c0a62ec9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.45.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--292f17f4-e77c-464b-8739-d23284e2f5d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.51.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e331f8d1-624d-48d7-9295-73b43695d807", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.54.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2650a9b-a541-4760-9763-5aa893a2d4db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.55.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8a60452-657f-4383-aabb-9c22cb8b0617", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.57.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c138c704-5d03-4ee0-a4aa-4ae63ea49c60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.58.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53d56c42-a989-4914-b83b-ccee393c0113", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.87.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e19f298-40d3-4c14-8445-fb993436cbae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.89.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0462120-4431-4178-9168-a46e93cce37d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.95.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9161068d-eaed-4c0e-a297-ae4b224251f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.101.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2d2f965-22c7-4ac3-8a84-b086ae7eef60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.113.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0925fcd9-6561-405b-b9a1-6b8b0103b480", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.118.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b1f235a-7462-4976-bf18-fde164bb0c7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.121.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a09ffcc8-10a2-4dc2-ba39-ced196192368", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.121.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03c78f8e-1d05-480e-b068-b6171f1e9b01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.122.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca8866ae-9f4d-4eec-a290-f12cdc570334", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.126.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d3ef2b8-b8f9-4643-a748-ebb25ec60ade", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.142.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10a6c96c-1433-445d-adb8-8539df1ab054", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.142.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e81a392-63b6-4a8e-a62b-d4b1c3b19e42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.160.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--406ca4a2-3af4-4f87-af31-5a2cc81cebea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.165.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b35d080e-7e86-42bd-abaf-9e8ed92b2964", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.165.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f7ece3b-9244-4401-93cb-6bc507f1430a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.166.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ade6376-189a-4acc-b5c6-e164283efa9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.168.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7163a6ae-f6c0-4b46-90a5-c3d8ab8d397a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.17.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf8cb857-dd71-4a19-be3d-d46c86e3ae9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.179.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3acf6034-5436-46b5-8247-10c34c74a31d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.190.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7726a480-7b32-4802-9a86-561ff66161fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.191.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8544f561-810b-4202-b9e5-e761909576b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.191.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a25c3bd6-b3ef-4e11-9ce0-53bf8716a233", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.20.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c4e2fc0-aca0-4acc-a78e-9f0bcea6d0ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.241.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--668ff378-896f-4aa5-a2c3-5a07d78e9fc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.242.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32ff6eac-cca3-4a6b-802c-b2a49b6974b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.246.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2c44c2b-fc5b-45cf-9068-62e3bd5d719f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.248.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fa2083e-8642-4621-a76e-3caf7f83e3ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.250.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31735148-fb01-45dd-be4b-20f8b741c161", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.28.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c86c529e-0daa-4bd9-b917-da2c5248b7e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.30.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36fe9106-08bb-4d08-ba5a-60dcbe118eaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.35.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf917696-b40b-4fbb-b410-f03b31b0c978", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.37.0']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07f3bddb-defe-4a52-84f1-a42e48566f13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.38.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--132aa48d-f79e-48a7-bea4-067d7251a887", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.50.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79d08b58-c061-4b00-a920-eeb287f83f51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.52.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2e76367-1b86-4b76-9809-18bc9c176ee5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.53.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b35b1eb-9f92-485e-8394-8496aaf082dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.55.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f23951a-88f4-4e36-abfc-5ca2ba800ff8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.56.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a57851e2-f3d9-4bb7-9ca8-1ec48b2e2094", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.61.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ae58372-bc9a-4364-9402-4f58b215ebfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.63.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--629cf7a4-cf80-45a2-ba5f-10b6f723e5fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.70.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d1f13db-eff7-449d-a8a4-c851f4cb8254", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.70.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e3b8098-0d70-40d4-b3fb-77307ce7a348", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.80.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b947c40-b600-4eb0-a829-29f177fbf702", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.81.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--189aba1c-fbd6-4cca-a477-578f18b5da97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.84.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c74def7-acb4-4aac-8c0f-d7b5284c47c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.86.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75d8d621-b073-49b4-abdf-00ecaf38b844", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.89.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c0b0afd-b6d3-44ca-825a-c75efa7589fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.91.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b7abe41-cf65-4ce1-b982-c1068591161b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.92.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cb72b31-23e2-450b-b7aa-70dea500819b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.93.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fa88fe9-5c99-4283-9e0b-2c2394968df0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.94.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bac63f6-e568-4215-86ba-719661ac05f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.94.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ff867f5-85d6-4fa1-b953-40fb6ea0298d", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.253.151.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc7e1084-b916-4d95-9c12-57ed4e85d56f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.134.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6da237cf-4b1a-4b7e-8ffb-afaa37c18910", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.143.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1514e2f-a78f-4a1b-af08-e989c79f6259", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.147.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb51a316-7fc5-48c4-a200-5c6057cb4f4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.159.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2132964a-ebcb-4674-856e-457b467cdf72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.167.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e23e3d8-dfcd-4383-9d80-2bae9193f425", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.170.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23d8b853-aa70-4835-b682-08517a680e2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.173.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57230b3a-3ea2-4400-9353-63f6b16d1981", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.176.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87889366-2b91-4f04-bc9f-4088bb7a621a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.176.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dff73a37-b36d-4efe-83d0-6c5efc6a3ac4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.177.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88eaa116-066f-451a-9647-748885137220", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.181.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--519ebaf2-ae29-41bd-9387-fd5842574ff9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.193.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbfbfd54-5ed8-4a27-a39f-7d8012189b2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.197.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe95c744-b947-431d-9962-0341da8a167c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.198.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fcd957f-d7cc-4528-8772-33236c5f64fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.200.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1f78d1b-657c-4413-afa8-eeb179ce0ebf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.204.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--860fb3a7-5853-4ad9-b893-b4a997386534", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.206.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--145069c2-a83a-4fbf-b5f2-14afdb0b078b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.213.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8712462d-53a4-432a-b75c-b8cd3e8cda9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.229.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f5d5a15-af84-4cd6-89c7-20de07c86588", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.231.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99002551-f66b-4c67-bb1b-2d58cf6b2d96", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.231.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c21b2f0-f9d3-4b63-b130-662790372d2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.234.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6afb78e9-ea12-47ec-8473-73fb4e2d9f79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.235.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f49cbe20-e148-4509-bfda-1a54205594b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.24.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dfea0bd-8ce9-4506-92e9-57411c0c6ce3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.248.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e15b52bd-d8ea-46a9-b367-70c0ef0b5c72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.253.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3fb884e-13cc-4290-a172-02890bba5d37", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.30.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f68132f-8823-452f-930e-03f05e2ed1ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.36.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c38f258b-c41a-4f1c-8c47-7188281b13ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.38.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7900ab0d-516d-4954-a473-6851b1f25086", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.39.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff542112-b53e-464a-9a6d-b66a84765092", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.46.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5efe9681-e24f-43fe-a9f5-eafe0cedebab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.76.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2d363d9-ad4e-434f-b4dc-2a4f718c2294", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.84.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8b02502-8ea3-4a40-8516-ec1c06bfb279", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.95.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6c2936d-43ba-4032-bbaf-e6b861d364e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.74.13.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8623c16b-28fa-47c0-9133-3eedbac692ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.74.15.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9e63f87-da44-4d14-a844-35509f80ea76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.74.26.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--799c1fe6-d605-4106-b83b-2a2561baece4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.182.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ad2a704-1d25-4081-bb88-c24793346cec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.211.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96552725-1034-4f28-ab87-91a27b4569a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.216.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a3f25b9-ed87-49d4-a6d0-ff2bff7a7603", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.218.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17c69a3d-5e2b-484b-8fc3-df4e41a2a221", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.219.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--249431c6-5822-4c98-9e79-991573b2a9d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.219.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--648007c8-b0ff-4917-ba46-1a69d62bb9d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.220.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef419868-0965-4f26-8ed2-3412583ae01f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.225.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8134d1b3-2911-4ea3-92ad-8bb1a0c82362", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.225.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a03bb7f7-b142-44ea-a022-6c279b35d8b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.228.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--611940bb-13dc-4c82-8426-22b87a7d3efa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.229.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d82b19e-118c-48df-a781-721ef82db81a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.231.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc078b18-f580-4c78-946f-efa6cb319828", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.232.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d3b1e92-bfa6-44f0-82a1-f28f85962e1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.233.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--881de263-cb60-4d29-af0b-f7a678a7b1f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.233.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19eeb1f8-7aba-4d75-acdc-2605b4b7f26f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.235.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--302d0876-6c43-4055-8f6c-0273ba5f6a54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.238.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05779171-2570-43b3-a70f-d6aa18bdaee1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.80.17.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9c92ced-c7ff-457c-82ca-a23f416ead31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.100.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--210f7e90-9832-4730-85cc-dbd7b4f2a8e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.100.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c28c71d-aaba-4136-87b5-360027ca219b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.100.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63675b25-1db7-4096-932f-1ba96cc0cc4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.100.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6367f0bf-00ba-4582-8928-b0f85b8642b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.101.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab70812c-aa3f-4cbe-a8af-25064ecfb1d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.101.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ce6c26d-0e91-40ce-959e-b83a32e0b97c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.101.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd946ac6-863e-4f8c-bfb9-84cf0b4d9455", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.102.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c5bacdf-a7d8-4c0d-8a6a-57aa8b6208bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.102.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4158fd27-1437-4994-9078-f8dc9913ec70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.102.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f8bed67-6556-42ee-8349-fffc320e89a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.105.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4ce41f2-d4ea-40bb-89c7-eb5282ad47b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.106.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2856eec2-3994-4fdd-8b31-e4fb323848b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.107.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06153f2d-ea27-4f88-92b2-33839dd7f604", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.109.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--628638a3-4e63-4d51-8d60-0502c9e5355b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.109.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e21e2205-879c-44d5-b76e-2716699d1721", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.109.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66ec8abb-e975-498a-aa8d-5f9e2fc26e7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.109.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18c6afe9-8f5d-47d5-b384-f72a16cc1f18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.110.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec20658a-8cfe-46f0-99b6-273859ffe7aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.112.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0518329c-8216-4873-93d2-6e23e45eb441", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.116.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16b0bf34-da57-411e-a244-3cf13c984f71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.117.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54bde0e8-91ac-4914-96f1-96713f419be3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.128.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b23e703-20cc-4665-9a59-3b457ed24b67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.134.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddd733b3-cd68-4443-82f3-f857f80c4853", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.135.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1970e6b-ee25-4d2b-b3d5-85ed3ce0f3aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.135.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19b60eac-b8e2-46fb-8b4d-ecb7f4601861", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.135.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5228776c-cc1f-4f1d-b466-524c6337d73b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.136.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6f9788a-00cc-4804-881b-4de96224f9a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.137.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af93706d-6ded-4cbf-8448-44065c20e28a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.137.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbfce593-6a01-462e-a768-19325537e3de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.137.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e3b5307-b9c6-42a2-bc06-8bf629370b50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.138.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c20b98f0-4427-4671-bfe5-b3ca549bd72f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.139.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18147a43-f887-4be1-9a08-8d2882b7adc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.140.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--433b69b5-2642-44bd-bdd7-3d2e74808d5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.141.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54505420-df17-4efb-9468-887b2ec6706a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.141.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2113028f-40a5-4925-a3ac-0c655361641b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.141.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0508f443-a112-4db7-b558-8df9475d8a19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.142.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32eb2d0f-a30b-4823-b834-74b797fe15f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.142.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fac1bea1-9e7f-456d-ba0b-a7412b2eb882", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--582a8922-ec0c-41e5-9a75-bafdfab903e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0190cea-c964-49a0-8f1b-c70a06b8517f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07affaf8-9e52-44b1-bc3e-1f67f1526b6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e981e36-e77c-4c73-afda-1fc7fbf64cae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e527c38f-682e-4f2e-bfff-fd1c3c2a8698", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--242f0ad6-f0f4-4eab-b4dc-283f52885769", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.184.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5834e683-c0f3-4f73-9fda-75da418d4c6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.186.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--138aba21-a0b6-4ad5-a7bf-794bf38b8fe8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.186.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92c20bd8-26e8-4f04-a9eb-bcef22cb3f2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.190.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad01c2b9-61fb-40d3-be4a-5c13f1e5fb9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.191.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86510f32-986e-406b-8ea6-b43b433d0ef7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.193.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ee06dd2-b510-45a4-84d3-acb7301773b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.193.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b369d965-420b-4abe-8333-dbe24dc53e12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.193.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca12a7fc-3c47-494c-b862-aa417973caaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.195.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a30d8963-f809-41b4-9b9a-b0015cc32dad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.197.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--850f93f3-5766-449c-abba-1a29c0e9865f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.201.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a233ceaa-d7d5-4e3a-b137-a5608264c3f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.201.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25c73e11-155e-4176-affa-b18c8e51af48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.203.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0519d77d-a7a1-4265-adc8-e60250b6fcf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.204.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7050696c-afd5-4088-a09d-ad0c494de850", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.206.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--290eb6f2-1f01-4164-9098-6f3de112427c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.207.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea10acbd-e4bb-433a-9d1a-85e5c985c65c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.207.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d396106-0830-48c6-af97-08fe52746d8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.85.193.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cec2c6e-2e96-4b7d-8143-0ac1caa39378", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.86.11.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32515f35-2893-4c8b-a5ef-3ae68770404a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.3.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7050c133-2396-4df6-b93e-d0f381855d2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.5.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7d77f1a-f441-4f2b-b421-31afab5ef51d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.55.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e297655-545b-445a-b500-2a6093255473", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.58.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13676bf1-274d-4ccf-9797-70645158e2cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.230.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05c4ab7c-da8a-47de-8c6c-4b6e725aa970", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.244.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d9eca92-a7f1-4100-8c0d-5b0d411b8f9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.18.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd7f4942-02d2-4f61-8692-b678fa87d688", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.25.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f7c682a-7d75-48ca-8d37-252036763a4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.93.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fc5c5a9-79f3-45dc-b5e5-dabe4ba050cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.94.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c888e91a-a553-4a61-96ad-dd6f90040fd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.216.242.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8bb9300-3cc9-4663-bb32-b4f0996c0160", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.216.242.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b73a1597-7b52-4a40-ab9e-a8c03e8cab66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.216.243.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0f6e0fa-1c2f-4ce2-9eb2-74edfc0a1c97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.217.64.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9e9cd50-63d9-4a5b-b1ae-eed4752cbd0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.0.26.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14dfb7f6-84a6-4ac8-ad06-24cd70cf6afb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.144.1.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b30613d7-c0a1-4e26-818d-6a2becfca6c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.144.147.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04767397-2b1d-4460-9fe9-bebcd09024b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.145.59.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0bfc3c9-0c8d-4e89-9e9c-328aefb21403", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.148.43.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--babcbf10-f42b-483b-a695-75bf49474df1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.206.243.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc672149-d88a-4d57-88eb-75a81b9fa227", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.207.40.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9de6b0ef-6ab7-4bcd-9175-58ea29579ca6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.204.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c88200b5-840b-40d3-ae5a-f910290992b4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.228.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6ec35ed-8834-4b0e-becf-aa5c2c27b802", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.245.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38c98ef9-27c4-45cb-8247-d354ddf180a0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.75.185.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce54ad5f-a90d-4fcd-934d-3dc7eb85dc32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.90.147.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--939f9bf3-9b9d-4940-bf1b-b1483c8b50e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.107.78.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad858f41-4623-4a1f-9496-4f7bc4e264d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.110.219.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6462556-d8ca-4701-89b2-1bce775df3c4", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.135.71.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d8fdde4-9ad2-4c55-acf8-56d5d667ceac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.167.214.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aed4f67f-708e-4de7-81cc-894f70f59d6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.175.169.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5dfc482-c33d-4767-93ac-ec12d4acc06f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.181.124.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8de6662-bc86-4a21-98fb-967f617315ed", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.181.182.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0db3671-250c-438d-9ee2-ed8cef5d1ea8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.187.35.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a4722cd-b77b-41c6-a06f-9dba73485d3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.187.35.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--824ea30a-20f0-4f78-94e9-067013d06d73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b87e62b-deef-4bb6-93ba-245f36ef16da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a764eb07-f4fc-41f5-9362-2d81688ed49d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a53bc211-e8f4-4552-b147-ba7d33953f3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9cd631f-f9a2-4d07-8245-210b13f12c52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.189.130.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50586c18-5eba-4254-a66d-afa929d7f07f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.189.189.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--522ada28-37c7-4612-882c-3790a87356e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.191.246.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3121f02-ecc2-4a45-b78b-75d6ad978d3a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.195.226.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d74084e6-5890-4c06-9be8-03be19c8bc80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af1fbfd6-ac0a-477e-8307-09b57ba20e16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d82e44e-9079-4eb2-b646-5e4f4ae4ddff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1be61eaf-b182-45cc-984e-2caeaa5f2f2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6df325f-7c10-47dc-8fae-b6a6e29412a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b93165d4-0c55-4f67-b401-6157486c3a5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2095a35-0193-433b-8d69-157df2018b1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57d46715-1c30-4ef9-9c70-65eef27c6db3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d8aeecd-5425-4136-96de-8c5542dcf364", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4df302be-37c4-4210-b6bb-74c475ce4d05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fec9d3a-c860-499e-aaf5-cdc4682c59ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3baad22d-572f-4eec-b8bd-9b0b89e41eaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--146c1a77-3f89-438f-a3ec-a9633c406452", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32a00c03-7bce-42c8-b0d8-f4863590746b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b87ca772-561c-4aab-ba17-571619af0cd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75dfc02a-673a-400f-aabf-131a7f6c8e17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef54e3a9-e72a-4957-8696-1029518c90ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f3ad5d4-b9a1-49ca-a99c-3f5b8aabbaf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--852d5a5a-55b7-4006-a99a-def73d74ec05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--600c5382-2580-4692-9f5a-4bc2a15f4371", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07bdce58-a5bc-4e88-b061-a68680a9fe32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.251.35.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3419cec-2776-40e6-93b2-67346ea451c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.254.85.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da18aa2d-fb62-4b8c-9bee-426ddb7020ba", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.37.147.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f9bcab5-9ff4-48e7-a2ac-9fa6fcacc7db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.61.209.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0930a7f5-1ec8-406d-8beb-57d3604884b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.61.209.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7fd2a07-a83e-40c3-9ff0-a9eb43935745", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.83.143.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--912e336d-3305-4cd1-b233-b12b3cbd6c99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.26.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65134026-82a3-46e5-946a-8e099daaae3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.44.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94b57d33-2e8c-4b25-a56a-a2a16f5d22b5", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.123.78.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bbdc83e-5614-473b-bc89-5e9fa40a3119", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.187.96.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80c606a9-21a1-4f17-a56e-8e099b86601b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.6.228.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18861d6c-5790-42b4-a211-39d95fd1942a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.6.248.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4c99e72-ae29-4394-ba15-d46b4191b3ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.7.176.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaed2580-f77e-48d5-bd10-a6cbbd58bb98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.15.19.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9805cae-f165-4584-8d9e-2da2dbc04503", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.158.205.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--825d6137-d156-41c9-9ae8-930167578179", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.158.205.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--945c0d3e-93b1-4a57-808a-6f38dfd80a69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.110.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac83f647-e9fd-4119-8956-9a838832740c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.111.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--512d8ede-eecc-4d02-8905-9ada73ea930c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.210.97.1']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--686f1a3a-7de5-4b74-8313-4e59695d5c07", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.222.30.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17489a88-d2aa-494c-b9b4-56ed3c284f4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.235.160.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b39a558-f290-4979-89b9-947b1f475f4e", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.252.236.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b672c80f-cd41-4e48-9759-bb730facf647", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.255.66.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c84c5f1-754a-45a5-9830-605cbd6b536b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.38.12.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7db0ff10-2160-4c04-88f0-f6c2629f373d", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.38.165.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdb49831-4a68-4a16-83ed-8bfb92c4e26b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.39.232.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16cb2442-36a0-4d2f-90e6-de1033ccee8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.39.243.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa4ec894-456d-4612-b019-3deb6441b1ea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.107.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f925d4e-87c6-4d6e-8092-c00f1111287b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.107.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48555fcb-14f8-4c9d-bfb3-136848ede4cf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.236.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--759a7b97-282c-4077-8bea-ca5317e182eb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.236.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b23700d-901a-4a6c-b345-ed08a242da65", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.89.192.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--692214a2-2743-41dd-82da-fa4b5b304def", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.146.21.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac3c7d9a-0491-417d-8145-4fd859bd3acd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.15.42.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6009030-0c48-4d67-b7fa-bd195097e184", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.80.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90cc1e6e-efab-4ad3-a8ba-f000c8c91e0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.82.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f210e3de-6a7d-440a-80b6-fda0bdbd0611", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.88.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c355a85-77f9-43ee-8d71-1c9b2d52465e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--336c24cd-4619-4afd-b079-516ed2fd6c7c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58d8a2b7-f57f-4541-a39e-fd7dd0d39a2b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3662fe64-5744-4843-a5a9-8c652828b1a6", "name": "Malicious Host", "description": "Observed: WEB activity. CVEs: CVE-2021-31207. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31207", "external_id": "CVE-2021-31207"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4de70f80-2cf9-47aa-8968-f6b08d1d4ccd", "relationship_type": "indicates", "source_ref": "indicator--3662fe64-5744-4843-a5a9-8c652828b1a6", "target_ref": "vulnerability--530d0aee-6039-42fc-9da7-d36f84529692", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f38955c1-7695-40d1-904a-09035fe6866c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8309b1eb-e070-419f-bce9-ccd64463caa1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--169c2440-93c3-4f28-ba7f-20a0b6faf0c6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7bf0c0e-6a17-464a-b241-f26c6933ce24", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.191']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b42adb19-ef56-4222-adb4-6ebba9abcc6a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39f1b687-9c4d-4ca9-9bbf-42f92352ab27", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75ef34f0-dcb7-4a5c-aa47-c4381bba4411", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4645644f-6289-4648-bf5e-dee18c09a9ae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b19bf3dd-43dd-4b3c-8f0d-7709e431fcc3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a074efe4-a4f3-4898-adf5-7a2d5456150e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--017bced0-735a-4986-87c4-85a90a011640", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34a19faf-475d-4176-9b21-73bd3a878fa9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b74cfa63-5d8c-4978-be7b-84c4cc96ec96", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c1113d9-2d78-4588-907a-0b1790057d04", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a931d3c4-8843-467d-97cd-5ce5ae2949c8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ba26ae5-eb65-40a9-bd94-c6b4f55c8821", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7969405b-60f3-4c88-961d-5c6ab87c5fac", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.176.211.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--accecf47-3b25-40c0-b61d-a11d9921c931", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.177.169.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--476a8a82-612c-4586-888f-2a960c967803", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.180.144.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--569d0f91-6412-4969-94b1-57351edb513f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.180.145.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--456af398-c5d0-4308-928e-99fc1c46c4ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.180.157.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f77b1fb5-6775-46b8-86b8-0f64f3d9ba7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.186.170.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98e7b95f-5eca-443c-8920-c88cb5a4722f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.186.178.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--411846a1-627b-4c35-9eda-24fada9ccebe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.188.185.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f105c36e-08ea-4f7a-a372-c09c2068a83b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.188.231.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37f47edd-01a1-4d0f-91cf-26910a3e4efd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.20.198.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a203633-8ce6-4a12-a312-c9656e9d13db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.203.245.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43676b68-c33c-4606-a697-41627db7a51c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.207.117.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b636a65d-f5a1-44f6-9cf7-e2ba4a466c49", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.233.193.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4cf6058-6e46-4a81-9069-116f4a2dc51f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.161.61.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc273c7e-72a3-4a8b-9d04-0ea89bb604b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.163.9.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--196994f8-60cb-4c41-ac0c-5acbc58b5c6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.164.79.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3bc6612-9135-4250-b7e3-478c37913d2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.173.72.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6ac68c4-5494-4021-8935-886a4ffe6ead", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.174.186.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95015fb4-4b6f-4a20-9978-6fc3d1d74a77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.197.72.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--624ad3f0-2c0b-4b24-adbf-5956223cca3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.205.241.255']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fad74be-0fb2-4eb0-a614-ecbd2da9b898", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.226.114.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1842115-2639-4c19-9ae3-2daf855c139b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.226.167.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2675f78-c031-497b-a705-ef73092526a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.227.126.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--951e2e9f-7f76-456d-aa1c-6b811c2519e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.88.94.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--935b8dcc-15bf-4c5c-a9c9-b466596f898a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.89.202.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9ca460e-85cc-4873-aa0a-d89742692e32", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.129.41.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67f97fb3-8775-42ac-8a4b-cc82934059ea", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.134.215.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a84cdb3a-274d-41a0-8d98-e728cc160782", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.151.105.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74ff5132-2532-49d6-947b-7ebe958932cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.151.98.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0575c514-5f57-4f89-a918-080a4683ba71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.152.33.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a003d193-2863-4c15-b41a-8406940e1993", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.154.241.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea385494-660d-4ba3-b2e6-723fe89e3a4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.159.30.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12a45367-83ef-4815-805c-5e47900863fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.19.104.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc2bf1f8-e169-4047-87b0-9e8d59146116", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.19.76.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d5c7625-2249-49c0-b816-0aa51a66875d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.19.79.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90a3a892-7bda-4db6-95cf-6fe91f4e0404", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.221.146.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a313cc65-cab5-4985-bedc-4492b66993c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.37.48.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d3f3432-cf15-4922-8ada-8a4fb252403c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.97.226.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a5f5abe-0645-4f79-b3b1-d70842c0646d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.15.58.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb1b5db4-8c53-4901-a45c-33aad8eb557d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.18.222.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eb84ce8-22d2-45bb-abaa-62f8f40f0028", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.23.93.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11814db7-40c6-4e6c-b216-e6ebe6043809", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.24.226.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e0f9d42-3c4f-40b5-9969-fd5bd7bc1bb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.44.77.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbc83397-a7ef-4d3a-ac57-64eb33b1e592", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.7.135.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00e27ed5-6a9c-49ae-b47d-dfa1625fc203", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.13.6.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31e7005d-3784-4455-8106-90671ef6eec4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.13.6.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff2911c6-ec4d-4c89-8c50-4bcfbed8e683", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.182.118.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--761c75a3-5bb1-4bca-bf66-b90576c606de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.186.24.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15772ea2-f960-4f9f-85da-8a4a94a8982e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.186.32.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dde98d19-285b-4ddf-9609-18839ceaf718", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.188.247.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85d4c930-bf71-4031-a6ae-cfafc7f2e7bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.191.125.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a3b8da1-232b-432e-91ca-752beff6c8aa", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.199.224.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d020b64c-94a6-4cee-a7ba-a225ac6acc64", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.199.224.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e988c353-322d-4ec1-b030-929ff3dc0c18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.49.130.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c29e951-6bb1-41b3-9c09-37ccb380b22b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.129.70.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--589a6fa9-fe66-4c4b-b368-9940c47ac1c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.147.209.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f59b122-73ae-4dfc-bdcc-dd25787b1359", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.173.160.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a720b0da-b72f-4154-9dcf-a51a1e9619b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.244.180.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b50b4e81-6e91-40db-9020-a8e94f5d547f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.245.29.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40abe9f7-7653-44e0-b0d0-74257efa4f8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.49.60.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86076189-2d7d-4b47-bdbb-c66c202d9b67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.52.102.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87692e2e-d6b1-4246-82c3-a47c58cd2b62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.53.91.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff0cf83a-dd72-4843-b35b-73348ce3e458", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.10.234.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59f21e16-df77-444c-9d66-3cb2e9fd9d59", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.132.18.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6622f47-8d11-444e-9364-1a2cbb6275f1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.132.18.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e9408d5-2e10-4962-9656-dbe699fedee4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.162.143.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aced7e9-a669-497f-bdd5-9bcd8b4447ec", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.173.38.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21ac689d-b76b-4126-bb05-7c0a7c116a51", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.84.183.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--608952db-ab53-441d-8cb3-2abcf4eedecc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.225.101.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--120e4271-8636-4b00-a6da-517c2b02d2b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.226.124.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6145bf0-330f-45c1-9d57-4bb0b6fc7969", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.102.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45b3f50a-31a1-4466-b59f-7e8000e0b95a", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.107.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d22bd1d-1490-4467-8206-1d543a0e7a8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.110.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cd27151-c4a9-4d9f-846b-2ae26f3d8520", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.132.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19d79b40-7c12-4eca-a83e-e2df5157e97d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.150.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95834799-0ebd-47fb-aacb-0892c4978fda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.164.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abe394d0-d0ff-4109-82c6-048a1cef7475", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.26.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58266c6e-f073-4f8c-92e6-14bebd9dd38f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.29.1']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efbe5360-52bd-4726-b194-de278bcaaa31", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.49.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be220537-f498-4d3f-ab45-58dd33e62f10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.72.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a5b052f-d016-4127-829d-989c4e96380a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.23.137.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dffa12b-b176-4b03-ae0f-59fc1b95b793", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.23.171.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50805b74-059a-4180-bcc0-f5034d17eff1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b574c4dc-840d-47a3-8400-064f878385ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bd41bab-3ac7-4e41-9aa2-d06aa1ad0d7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45a97ecf-8330-42d3-8b25-48b801370538", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74c83798-c200-4773-8c80-feccf8789ed7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74800272-a2bd-403b-9299-b1b02bbb9024", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f6bbea5-7b50-4b21-ba65-e02ea4f4ccc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5698f50-d1f9-4de4-848e-49fee96c6724", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ecbd6ba-f91f-43fe-900e-8a9ce3e1d25d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ef461cd-76dc-4384-9480-6daf41567f33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--206b34ff-7eef-4bf8-862b-13c1e095f2b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f561603-9f98-4e98-9426-2496dd74b4cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7eb41f3-1d5b-4b6f-b54f-0763ba8a124a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99fa0b80-16e7-49c1-8933-011c570cbd15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d727592-da17-473e-ba2b-0e20db38de98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac39b08e-d485-4c4c-9e4d-ebd93154a83e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72ed6253-eb0a-41a1-a242-774d1dcfa27d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bec2b07-76a7-4a0a-b878-b5d95b466934", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39ab4f7b-5f23-4e3c-9ccc-46472a8266a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74cf421f-6180-4a6d-bf01-7a722e7e34dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cefa417-774b-47e3-957e-3022b21408a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--569e3db3-a851-4631-8200-d9c11ac43e03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dcdc60d-d74e-41b1-9a97-b458c673f26f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--635e7ab6-3e05-4411-aefc-efabbf012217", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dd3b0a3-054d-40bb-9d77-bc9ccbd8fbdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ecc86a2-f062-44b2-9b3f-b2988b44d2f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d727985c-c209-4afe-84ad-1fa428e9f138", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc4d2827-6d8f-4627-9850-eaafb4ce3522", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc51669b-070b-4ed6-a9f7-1749734dca9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ea26c5c-12d2-4f91-9a0c-0d87ff3bea15", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dd40469-dc2c-44ba-93a0-ea29526ba124", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--059e2b53-3e37-4aea-bf29-71434027c336", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e91c076a-0ba3-42ae-96f6-84e4b4949160", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41822d6c-7fa3-4234-ac6c-f5acb1121fb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34841f07-2b18-457e-a131-6e9060187fa5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64bbc253-2526-4806-a323-62599f3aa9e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7902efb1-1241-4043-a86c-74dc8c366cd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--365e7f15-a388-4b58-bbd1-93136f7f57ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62c15f54-9e4f-49ca-8132-b8f9fa0b93c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.181']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--265a0d73-7f18-4e75-81cd-d859c5b63008", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aca0dc27-ec41-451d-8d6f-f921e0336a49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5d1da51-3e04-4073-bb52-8fdf6ced85ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7ee6b78-844c-4ef4-98fb-cc2cec6e9381", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33a4f88b-cc84-4661-98d1-9277b6489d2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d238759-5fee-47a8-bf84-19189f143663", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccc57def-2fae-4be6-8c9c-844e2a34d721", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6d80018-8ffc-4bda-9de7-c94f8d606627", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cb12d34-3c53-4e67-9be4-db93242617f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1ea394f-93fc-4dd3-9bc6-c156e258d290", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d2fd2ed-6d4d-4189-861a-d2ab4d529045", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c67716a-fb2a-466d-9326-a40ea306fefc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9d619cb-8ac4-4974-8a12-69d9cea9ebf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91dcb179-911e-4e76-a6b5-32025a5324ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8c56d5f-4640-4a1b-9e16-948fcf8fc3d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d014602-4016-44fe-a388-88c5142783e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b83a399-2062-4f2c-896f-02e067a58782", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7eec9e06-3acf-4a89-aae6-b1888f3e4684", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddfdb9d8-009b-4877-b75d-0fc9261a76d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2a6d81f-1b98-4194-b831-7d971f32145c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52a47a29-5f46-4e6c-a831-f761b15ccc27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7852b44-cf7e-490f-bf1c-8623cbc8e7c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fd819ee-e4bb-4317-96f3-d27859695a6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c713c1d3-1a5f-48c1-9b9c-ddf9057e0083", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23973299-fe7e-486f-9c20-7526a56a2a81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.217']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2aadeb8-f6f7-4e53-8694-97013b2ad822", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--652f5952-f2fd-45d4-8423-ad082ae7a68f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aae66467-6091-46cd-9bae-8e5ef17e68bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb813ecd-6370-4364-a2b3-c724c932a409", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bb1028f-631a-411d-95ef-73cb64a2e0b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec79592e-8750-4777-a662-b87aa05fd9b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f64c92e-e6b0-4eca-b5b1-c6a437f6c13a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f83a00b8-8e48-4d64-abf7-e28a32df6d30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4cf1785-610b-46b3-bcb1-d37c4387e5ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a5315d4-6604-4ca7-ac73-4b2e88517c0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72af292c-00c7-4e88-9e96-3816fb79fcf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--625b6560-2512-4cde-ba83-fda6f20bb2f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c31e170-fa2e-4299-88e4-874bf5f1dd17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66bcfd73-1c7f-45e8-bafa-4ff7aeb45760", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31ae3a02-0728-4ed8-a91c-202679df6f53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eef0fb7a-63fa-43ce-84a0-582cb826f2a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f23c113c-6350-4ea5-bfc7-7e788e133a0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd3024a4-91a3-407b-b453-96818fe3bf04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47a40d64-29b4-4a6b-a645-112f1f9c75a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3715f38-71b3-49a2-92f2-15afa10c4111", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3440ed8-7964-40f4-b92a-49192cbc9cf8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9840dcdd-4bf8-46e9-a480-b6ebc62c2fa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72ef5dfe-dc19-45e2-a442-b9009f618bdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07b1deb9-194f-447e-99ec-119fe44fe464", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8ff817f-3c1e-4ba2-ae2b-fcfba57f734e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89303efb-34af-48b2-b8b7-d545abcf1922", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d0d12e9-3bbb-41f8-bf0b-76c6e77717c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--321128b7-965b-4854-b9ac-863f6e9cb9ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67a08e24-deba-400c-bb2b-fec5c648854f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce2bc827-c6bd-463c-8c8e-58474af3fd97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe1f5c82-599c-45f0-8109-9a50b9d8338d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--495d92f7-d553-4659-9a68-c175d74e06d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--060c662c-4870-450b-b869-5426a0861875", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62fc953d-9bd5-4758-95f7-a270724dee25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5978756-862e-47b4-86cc-a3b2a19d5809", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--342d4bc7-28c1-412c-b3e0-21fe5e545c34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c86adce-a68a-493f-acce-20be74ded979", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f41ab81-2b34-4d08-9af9-143419e986e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2662270a-38d5-4579-b1b0-2c6525158ccf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--796f21b4-5f35-4d97-8a89-14bdec136815", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.103']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a181ef83-8622-4123-9935-6080d6af0c2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccc1ad90-3c2f-41c1-a97d-f3a65c6f2912", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e28b85f-4bb7-44e3-8847-405a9c9b278b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--018aff11-bbe1-4a11-a61e-7334be2cdb04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fe0ec4e-7a71-4e6a-9ed3-654584a0f5f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91ce8956-7661-4042-b2a7-8bf122523225", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--001460fd-4175-4453-8671-39cbbfc98d89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2732c6bf-0de5-4a40-a539-9ded9a205929", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84aa8d99-8b42-417f-b645-3e4ed7098dc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1321cd5a-3c1c-40f7-89fa-665802a25279", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31f8ca9a-440c-4f46-a166-c7cdd07db722", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90b46909-377c-4758-86f5-3c1449973457", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbf58348-4cb5-4b7b-a156-418e14beac9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2799a80-107e-48b6-b61b-8cf180d04a86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--094a41b0-62a0-4b1b-a8bc-bc81b4c262d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--072b1a61-7854-4aef-a906-ec86e0749240", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0035e5a1-4a13-4130-a49a-b682ff578402", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6be5f500-2928-451a-a03a-0460d713ef76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dd9a6ec-564d-493c-a729-8c4ba302bdf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e5627b2-a7d2-4230-a8af-060a03d35fda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1559468-2656-4169-b098-d5b04e647580", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6ba5c59-0c80-47d0-9652-ab67dec560b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2ade95e-98ae-4e0f-a48f-1a927a11f35c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16fe7757-9aa5-4c42-8bac-401fa6f9b487", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5af78274-0ca5-4ca6-a034-e405e2e73297", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0729a21c-1b53-44f0-8662-216da662a039", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cbeed74-c88b-4a52-a95d-2b75db8396d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd8d2073-b81a-4e07-bd35-d35a6aa0c65d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df28eb0b-9ba1-4280-b3a7-ddc14416c5ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14999506-fa58-4941-b686-ab43d5842e45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--996ca740-21b2-43a6-82ad-0970abdcc2aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e04236f6-2115-448a-bd22-a80c539e5d15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64b85c02-3322-4234-8661-80d2947e2a4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f24c689-cabc-478a-8032-24f52350ae8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd963344-72d7-42e0-8417-746ff25c6ba0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6527ef57-aa2c-4e43-b0d5-448b393a8528", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2db678b7-93e8-4507-bdd1-81d125a05ad7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.189']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b223a40-8c9f-4228-978f-872ddb0a5fdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03eb6c7d-8bff-4611-b1dc-9badc6d56ed3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed3637ea-22b7-4a3b-9297-94345b741e0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be931a99-583f-461a-b926-152bcd2132d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91396955-f454-4c6c-914b-3b088cb8712a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aecc4373-5891-4262-ad26-2b7683fb90cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00e8ea60-fb3a-4aa9-9648-4029ee63c4a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47ebd7cd-f222-4a17-9741-57081404a77b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc529ee6-f568-4219-8c8d-e188da48b2b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae17535b-9ade-4396-825b-47559057c9ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8ef31e9-8051-4fb3-a6c5-45c72c57c657", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--900b9d69-aaf9-4e73-b19d-863ab8d8aff6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a196cc03-b556-46cc-8919-b67ccf6ab66f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43b09e05-80de-4c79-941d-7a56ab00203b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d1dda72-c1f7-4cd3-a227-07faeb7ab42c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d24a06fa-5a16-463a-ae49-31177e602fe2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d3f5da2-26bb-4b10-b16d-02f85e4d19f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8732e0b0-0d41-47b4-8ee9-38076f62ea42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eadce634-3107-4e33-9057-30304c4a5de9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19acc078-7da9-4ae1-8910-7d223167e2b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6c25c12-bcf6-4f40-b643-699e539bd91b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0e765ed-ee0d-418c-b69b-61097a972900", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd9ec6ee-89cf-4ce6-9d30-1fa3a41a84d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--669205ad-0276-4598-9a54-ac62440dd939", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5b18675-9e7f-4e97-9241-ec6804b11ba1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--779aa51b-81f6-404c-b513-0b0b728f4339", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22fe0302-babd-4eb0-a296-526744014f9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e85603dd-8e9f-4ece-a072-045fbf20ee48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea3978b2-a2bb-41d7-92a3-29e6336a7f7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7afa57f5-c142-4d03-a57f-d60db57b7653", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9b17b0e-d237-4154-954e-adee93ee4506", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--489c82df-48ad-4fd9-bbd8-aa3cc028d9cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bab1ed6a-bf17-4910-8882-cd86dbe9acc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc1c6d63-fd0d-405c-b1c0-cd4117555623", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--848e2c1c-9ded-4f9f-9de3-98a962a4d0c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acda024e-d4df-4f77-8117-334db9367cf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd99c1eb-824d-463c-a88f-64612f8dca9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccd5f264-0492-4c33-8ef1-aee294b0df9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88ecd74d-7288-414e-a2c2-e3038d098458", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27b5c144-257c-47f7-81b5-271397abaf82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1fb7a46-6a4e-4697-9ade-dc310f5350c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8558e9b2-cfc2-4250-a64c-6957f0b49461", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de1a341f-ff64-4c3a-8695-f27ae4584bb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0578425-4ac5-4842-ba7f-a8f1193db36c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e650abf7-dc4d-4190-a3d4-61d6f10d9a7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff939cc2-f70c-4406-8eb2-5991ce19f197", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92589479-8872-43b8-ae1b-0cac3bbd1535", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b5ee8fc-b66e-40e5-a149-e4871a3d4257", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5f2576f-2fbc-4203-bbb7-d1cd8dbe962d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8988c45-53b0-479a-bf07-585920d4ac59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35302ea7-b84b-4b1f-9153-f73805708ace", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--912ab37e-fe09-49cc-a3a7-85b286705545", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbda96ff-a3cb-4889-8e55-c6903a607466", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.82.228.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63086c55-ba8f-406b-86a6-4c6268d38d45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.160.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2efc24f-b67c-48f1-97e6-9cf4d3806ce6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.160.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81fdfbd2-5d29-4470-b150-2cfa69cd2a84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.161.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9194381-e79d-4be0-9964-96334570d9f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12258ba8-1b24-4505-bab3-8da558dc5e5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c157875b-23db-41cf-a8d9-ed612878cd56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5162a52f-3f40-4ce2-8b9a-ae4ac756f8ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0d938cf-c23d-448d-aac2-0f9bf4e3f57c", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84ec0593-cb3c-4089-874f-a2b08dc6b7ea", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff7a31c4-43d6-4cdc-a223-5e8721cbc349", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b49068f-d830-49bd-8a04-3e6f9ed2fbf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43a0505a-8de7-4d3e-926c-565d08b752f6", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31e14b47-e075-43f0-8403-6feeb372686a", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2548af7a-e13e-4d7a-a78e-4f02f67fdf91", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cfd1ce9-102f-438a-b363-a18b93b6cfdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--686c98fb-72f0-4c97-93f7-31240e30aa4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5d50776-c214-48e9-9f65-4edec3fb404c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b53421ce-24ba-4b02-87c2-558a5558feae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adf85152-8daf-407e-8453-409f30322fb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6d34c43-2d75-4f96-9e57-f2bf57313bb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df2923c8-3c4f-41b4-94ab-52495cccd9d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dd0b5a3-991d-49dc-9568-b48c2e749dc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c8e9bcf-92c7-4ff2-959f-a5a02410ae82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cddcb28-2e0f-4940-89a2-2237655f3ee0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.100']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20ab4bae-a281-4719-bfd9-84abb41c3146", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36cce09f-760c-4487-843b-9839a8475275", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--262ba158-e753-4d24-8430-162ede05c96e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a58d93f0-9079-40ae-9489-9489971c87f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--702f8923-7496-4c3e-831d-28a19f3c67ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48cb9b81-1078-4533-a17a-f645a1fdd4f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0350609d-dca5-48c1-9dc3-9de3be715dc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cec01108-640c-4f8f-95dc-1b2ece2fc1da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dadfde82-c998-4782-97aa-68e47e534d66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1f988c6-517b-4d7b-acc9-dc3f92033feb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d91afefa-a261-4c16-ae80-d7cfa105b65b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2561227a-590d-4cfa-95cb-d0fa4c5b87bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4ece524-aee6-4a71-8b6b-d8adad305d00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e6d5138-6ff6-4444-960d-175bdfd39549", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95002fa0-a5d0-4935-9e24-fea65b387068", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a012447-e14d-4c06-9a95-a390f5c2c505", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bc2e011-85fb-4fae-82bb-1f8a453f293d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--189f1793-2525-4593-a846-5720448364f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed517bb9-992e-43ac-badb-dcdfdfdd6086", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ddd78d3-11d8-4d34-9ec1-dfcc1fd035c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d36e1ed-c39e-4708-be9b-f35ee4232fa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caaafc9e-aa5a-4441-a7cd-76d5ad589f3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f11b250-db7e-472d-860d-4031f21278cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2f17f34-6766-4961-9767-fc6c10b30d2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36e3275b-dc92-4bb1-a680-a9e1dbffd807", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33569d01-7272-451b-8be7-387136cc7a3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b9de306-c077-4d87-99e9-f5331259d1eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a75a6fe-f0f3-40ab-b610-695f3449f385", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8825aa2a-7428-4cf8-b30a-635141e4f7a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90559558-c153-41f3-bb0d-a74727ac5aae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43edeede-c4b6-44dc-a6fe-dbc111d2f148", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7da9826e-ccbf-4265-b4c3-953a50bf8cd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1d9023b-983a-45b2-9dba-d22ffe6fe8ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d535755-8118-46f4-b2fa-d694d72c96e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.172']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b50d666d-8728-43a5-9979-a8b17be2b3bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--400ee570-7953-4577-adfe-312f4f96dfd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36e8779c-bca0-444c-8f8d-7f8d735106e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13c654ff-5900-43e2-8102-c7ad68234ddf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c47728b-477f-46d1-bcdf-d75dd00c69bd", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--205a852d-a032-403a-a740-d6a6d8732994", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--193a85ec-70fc-4930-9e6b-79543b728a41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a575faba-6df5-41cb-bcfb-256ad6ba3b8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32c87afd-8689-44a1-a0f7-47040c5ed676", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fed3420a-f02d-492e-b5fa-8aaa2bd50c6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--446ef716-e51d-49e7-a42f-cb8db02c1177", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f074b8dc-0f4a-46c7-93fd-e201f54bcb62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7dc0c9f-d40f-4faf-b74e-63ae5a16df7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2a15a38-778b-49d6-a4cf-474c2729db99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ed96e8a-7c05-4455-8a18-3de29b66390a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4730b2a-6370-4ad5-bbcd-6105c0d499cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6e3f13c-36cf-4b49-9c48-cd6dda20dbc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6549536-b478-466f-a641-bfa43228ac0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb219ff5-8240-407d-a34f-f46516a10010", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef6073f0-b5d7-4be1-b7d8-15be95d7a60b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f96ad29-7c0d-44ab-9232-018e8c0634dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0608486-e4eb-4730-8b4f-bf136186766f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dde8dcb-5d3a-460c-9371-53a1e197439a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8641421-32a7-4e02-82d0-1ddcc3ff6051", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c23beb61-b65c-4cf5-9153-b8b9b9df94aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31a7cd86-f60d-4b71-98df-374128d5aae5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b51d0cf8-6369-47c9-85b6-ecb438311446", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbc75a68-84af-41ac-a1ea-156b9191e663", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1a2764c-f5a2-4dec-a67e-ad32b1f25eaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fc9cb8f-ceea-45db-9f73-2c5c09afabc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae342acf-983f-4be3-9f8e-eed8e206929d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d218ff25-f1e6-482e-87ac-2a8724cd56a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20454424-2170-4c28-be9f-1aee8e5a9020", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fc61972-215d-4fec-86b0-3a1b150315b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--810a0535-fe27-4749-8838-11eaaa7327ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24d61df0-dabb-450c-a2c1-6ef41ec31336", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2945898f-dbd0-4979-b3bc-357edd116068", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8b2af88-330c-4a1b-9789-c68047396708", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27bf510d-5178-4f71-8e0a-3b4621d0bf35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--766cad04-7e86-4739-a794-efd8bdd4662d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d02ac0a6-4edf-4756-9473-27106713ba0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63a36276-2b66-4c6f-9cab-b6f4aede65e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1d5eda8-7bb5-4405-9149-55e17b3f82c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--276df8f4-e8fd-4bde-904b-5498d90e73e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df8fcc54-f9f9-46af-897d-876ebf8eab1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b87ce143-ab2c-4134-9d61-171e04787568", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6547e5a-b466-4edf-b8c7-9ab09e8a4d13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c07d53b5-0b1d-434f-874a-477cbfea2851", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97ddeb68-985a-4437-970d-0de256b0b14d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d546246-7831-42bc-aaaf-3f4e10433a40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--153f9a74-91ac-402d-adb0-a24986f2b981", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ace606d-2bec-4a3d-8e6a-4470140bbc16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d1ad89b-7e9a-40e4-b640-b8de80ca771c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f349f553-8c94-46c1-b9c8-713df7d4fe47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eea471bd-b6bc-4fdd-b8fe-2d312fa82e80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0bbde1f-1818-420b-b637-1ffcc2976459", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ff4ad0b-20e7-432f-9a28-d0ebec650c85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc2bd36b-90a4-4b9f-8197-e6c3a7047f1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ae1a791-c9e8-489f-8f08-b8a53f251d92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da8b9950-2c82-4831-aba5-68c6a218b429", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b269f68-5a94-41b3-a359-40420ad7c39e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d0bb418-1a93-4f6a-adaf-6c24f0976fe3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6821a096-8f63-435e-bed7-21ba92cac341", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b73b7007-375e-41ad-9ecd-acf57a851da2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f50481d-d499-4d13-9284-0d8bdd0693a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ba77e68-ffe6-43f6-915e-a5c9dea12e6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cd954c8-9510-423e-a343-a18a53c50fb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4362739-fd66-46c8-8d7e-74d3aeb66719", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95c43449-be38-4cbf-9a3e-ddae39e3ed9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53bf92b9-24c7-447c-9af8-82195ca6a7a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38bfca7e-df19-41d3-8d19-f204784f7bd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74cf6b40-9e6c-406f-9d64-2596b6a25aba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67c44a2a-8c5b-43d1-a886-4cdd8dd09a58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca5f6d04-3f0b-488d-a87d-e84aa5f730e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e28ef72-317f-4e85-96ee-b1f7f77263c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0933755b-de50-4345-8b2a-d78d49bb74d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d9c7361-95d7-4d74-b21c-25a765f1e8f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--454ab707-51bb-4bb6-b7be-13cd2e9b7fc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf9e9f5b-b2c5-49cf-811e-cd26b8303113", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b000468-aef1-4d62-b79c-91b30f9939cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--884daee2-6663-4a4c-bdf7-255f1e7dbf95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db7cdfd3-996a-43f1-9792-17e2b55ca4eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12f8cdf1-464d-421d-b6b3-6b92cdecd6c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23674fad-29ca-4a1f-8bb0-83f6955ba211", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d9f003a-d4c8-4f66-8deb-761c514283f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba59e261-a16d-4551-b8fd-0060c5b2ee1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe93a6c3-18c4-4930-9d3e-d9903aa84dc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc8dc813-8e28-49e1-a5d4-c974dc188cd4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.116.205.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--407b2ebb-a50e-4b57-ab6f-869d921a9e0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2797ef8-244f-48a6-b379-f0e141eb70cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72c3a604-094e-4b7e-8181-c0c82fd8629d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b181bead-4cd9-47ab-8023-914821e7e419", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a618f4d-a5d5-444a-8cf6-39ce96419c12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68e103ce-d980-4688-9a5a-87b313a03a3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--792e07f6-66b6-4450-b666-11654c96c39e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a3f86df-b300-47fe-bb51-af92f3a31a43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b206463-5978-41dc-8136-4d7dd2e090ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--476c6715-ef37-4285-9fda-12bc2e2fe523", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e90d5dd-c899-4a81-a2d1-21ea4d19ab58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e475ce83-9b23-4844-bb48-24937fe11c0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--457fef1a-9e54-4493-b575-a2dca7adbf35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e767188f-c85b-4ebf-8b14-bde7fc6213e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8e8396f-8f60-4526-98fb-307f8d36427b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.122']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86c2e4df-855a-4439-8fe7-97977e9cd2ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9efb4129-d68e-4864-8026-4ff5615cedc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.124']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f788ab58-c58e-4efe-802e-a5a256c9862b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc850a25-6172-432d-9ecd-41cb39123aa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5aa88b5-8a5b-414a-8eb1-f8f3a86d437c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74b0da5b-16c9-4754-92ae-50615ff5fa65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05ecf514-334e-4607-b8c4-ce0e013566fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8074d853-9fdd-4685-8d78-a0ff110b6f1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--703b539d-b2de-480c-8c35-8fd2cc8d445d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6c67712-04b8-418d-bee9-c308effe9169", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc78b2bc-15e1-43e1-8c59-3e881ae8c576", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0eb4782-a5cb-4abb-bd47-adf59cb8f5b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d54720c-7e8e-4ee5-a8db-fc361ca15db4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdd1f1aa-5c7d-4515-878a-ea38cd2ebc1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a8f50b9-6fca-4565-b47d-3ca81936ce9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8daffa65-55d7-45db-bbb0-4ec5777a5823", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3959bc5d-b8f1-481a-8b11-fb613d2a31a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f30bee7-cdd0-4e40-8d23-993f5a5d03f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ff25c32-f537-41ca-b697-e292da23fa97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edebbc59-02aa-4539-91c5-041d59b47cb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04b7e9b7-6953-4375-82f0-4d967775ae4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1aaabbf1-2e1c-4f71-b6b9-be762c8730e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8835a708-1d5a-4455-9163-9c937282e469", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bdb8714-787e-496a-92aa-7aeec4530807", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--998f3fa2-07bd-466e-83ce-44036156f7d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89e3f1e6-f13a-413b-8c30-7cedc64cfea4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbe52e12-0531-4802-ae06-94fd9499a9f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ae8e007-9e4f-4f75-a4d5-ed6cd36d774a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd4ebe77-fc2c-4df3-b473-bf9524367adc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--701913d6-9d88-42b6-9fb4-8b1a84689cc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f7f6a1d-a156-49f3-9152-7f9941ed42d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2058050e-9e55-4b86-8e83-fcab79666cc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7652df80-ffa7-448a-8ae8-7d99c685624c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2274256f-0e8d-4747-80ab-0871dd36be4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40bb3d7e-9c0b-4596-bc76-ce796d4e2592", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17d61bcc-b560-496f-8adb-03bd2298fef2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--303ef234-f7ae-4d9b-9c85-a7efcba63562", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c21a8d91-8a8e-46ab-8be7-5c8c8bc4d4fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd8fdf5a-3a88-4445-9231-8bdea419757b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49e371ff-65bf-45cf-84fc-b0fadd371257", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85fefa9f-2544-4524-96c7-a4440089629c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c75e1c77-c86d-41e8-be14-68d05dd0807e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c98936b3-14ea-46da-b42e-f3eb96ec3ec0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2702e9af-19d4-4eee-978e-a29ea1845abe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90633898-8c75-4b40-ac1f-0cf21ac91392", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--367f9e63-e3d8-4131-8036-a88af09fb998", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4538f7b1-0d17-418c-82a2-ad6145bd3356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f6a8e6e-71a1-4adc-8339-6a1318df5e2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--367b405d-061d-4dc1-b974-e384bcf03b40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e481afb9-3dbd-4436-a146-36a05d677356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74546581-e6aa-4c3f-9322-9a7485e9ca07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c88295f-9e7b-4012-aede-28661f93e35b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60c558c3-d0f7-47e4-b914-ad8a4282c28c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3020c22a-1c38-4339-b579-21ba86ae56cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dea501cf-6aff-41e5-a451-48fb0ca3dd1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e36bc00-6843-4dcf-928c-f9eda8f24489", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--699fba34-3436-49c9-bd8e-35043f5a581f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.128']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cecfe01-c10a-4e6b-aa5e-a2dcddea5aff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--533ad446-524e-44ad-8e48-ec0c0ef9f6b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fce4ee2-cc3b-4127-9f6c-d76802e38275", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8276d74d-40f0-4174-bdb2-9f69c2b3ce12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8922b179-e9e7-43f3-a93d-10ff19653136", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65ef809c-e790-4a08-b004-60caf038871d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a386a834-1f7f-45b1-a16a-f385cd6f6cbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c3e221f-677e-407c-b1ec-3a9e857cee80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc07cbad-5a5d-49fc-966f-96ae30f6e79e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49045145-baec-417d-9ecf-253b6185c9d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--882bf5d3-1883-47b0-8e49-60b407e7fb0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1becd5f2-f073-473f-9cf0-d5ddc7440a13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b95289c-a5ee-4185-8839-1e1311943eed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc1379f7-6671-4e31-98fc-047c116b1881", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afacf239-1966-4988-881f-19173f6f1407", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c223f212-d812-466a-be49-dee170322c93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4aa231f2-38c8-4982-8585-3f3270fe0c9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15312c8f-8e40-411b-a333-13ea0c1baaff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78c2cdd1-754d-4301-ad57-4e8380315d19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea490fdd-9c39-4955-aeeb-83a13cfa1a49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b320c2f1-8aa9-4f8c-9b50-4e15410ca233", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c07e8bf6-fc43-4c0a-9125-28a2d87c9158", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c3e7327-4969-44f3-a5d0-699553c76b70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--722bd142-35e3-4a7a-8653-aa2d06add33b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4571bd09-3664-4e8e-afbc-4bc86c61b437", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d0515a8-d2b2-4ae8-af34-1cf8ca3d588e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a60d55f-f370-4146-986a-cd2785c9288e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dbe7496-2207-4171-a075-b181fa6931a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e914dc0a-7f1c-4c72-a945-a2b4484a9531", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30d0f0a6-cb53-49e6-a810-245692635c86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4db99947-9747-4a26-8bba-825cf6946e9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4cafba9-dd55-4729-bfdd-cc11aae1ea97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8806789e-7e61-48a4-b6cc-949f6bd9832d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe6cb25a-fe58-444f-895d-5657d89df61d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e48f0a3-15ff-4efe-a007-dbfe200d25ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df34a288-1279-445e-b048-1eb9a7b03b60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--233aadcc-fc39-4b27-b061-4e49ecd61e4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f28b7b60-1ca6-4b5d-989d-c3370bd68238", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf37e164-9627-4a7f-8f88-0ab46b23d194", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.216']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--265f9d31-accf-4e46-8576-7cbcdf3e291d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce2d306c-c946-48f8-af73-063239b551ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb28fb34-9e59-4e5a-9289-c038c388ced9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89a41499-f268-4e39-9a04-87d51bdd12f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.222']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4e19369-560f-4c7e-8467-9b66c8d24061", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f033e75e-f7ea-440b-864e-df2ad1ae0832", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecae62f5-edd6-4663-a82f-48f72e7754bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.225']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae7b0b90-0bf2-4882-a486-f32e190bf628", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db4774e5-2861-4034-bf6e-8e5e6948c506", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79aa017a-74a2-4ceb-9f6a-09553e0c00e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba091cfc-1e6c-4c7e-81ab-d863a2f447fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.234']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1656db0e-e862-41bd-bd8c-da7056b0118e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd5fc64c-898b-42f2-9c29-a6414cfbb506", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7598fdfc-3024-4889-9794-dec4b70439c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07d4e4b4-0e80-438f-8d86-2d180a0da5ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.238']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a8d87b9-2a4f-48a9-a194-af8184fb317e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfbbd2a3-fd3d-46bc-9908-b5521d0ccbb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bced9e31-e25a-45ba-9ac9-1f1006ad1fc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29ab8ac6-af99-438f-b11c-93d5d2884f84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bdcbfd5-91ec-460c-a14f-2548b13018a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58fda294-3054-419b-8469-4bfe9f9edf57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60a006ab-a368-4887-8bfe-3d1d0f46b583", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3a29f64-c31e-4928-8f10-a6d84a279df0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ea5694f-012a-49e7-9229-43ac08f2324f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.247']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4583c694-bb89-41d4-ba8e-bfd4bb93670e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27e2132b-45f9-4e50-bb76-def0f6fb2bbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c71996d9-ca9a-4fd2-9a11-5711ea14cd74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b50edd7-441c-4bdd-9b9e-421a52dae0c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d26ea1f8-054e-4975-8bbb-4138cd3c1871", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ac6a205-1b50-432b-a937-a6a1af421276", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cef2c1fb-da6b-4fec-a930-618cd8e7e25b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf36706e-c5ae-4575-b64d-a2a2caef3287", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fef57bbc-97db-40aa-9683-0cdc3a5cb3ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--284308f7-377e-4dbb-903f-4a1be7fe4dc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28f8777a-0d67-4bde-978c-a153b3a865ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cac54b1-c3a4-4e38-bf88-901a4d2cf121", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52fe11ed-6fcf-4c8e-b6c7-2679ba5e691a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--443a9bd2-c7ae-4f84-b208-97c029ce2e63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68c7e083-99dd-401c-9721-96ec1b2b4f82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c77b725f-d7fa-470b-ba28-2171e0c4b140", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00c9376a-c15c-43fd-9b86-7445da40ddef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b72a176-6474-498a-935e-109ef7fe7bff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cc00e08-2812-48f8-99b3-0094cce46141", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a05d074b-abb5-4eb0-ad10-37993b00f3ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--223fc0a2-f0ac-4b29-abab-de86f69a43e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d11827c2-9427-4c50-9ccd-5d45ec4abe97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--016fee0c-8958-4a4a-ba96-7cee50363157", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c2239ac-2479-4f46-9a50-0bca8bf828b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d2bb406-be4c-485b-87ba-5303cb5ba896", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9baa26d-49fd-4d3b-b727-2785d4015226", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--075fe4d7-0c23-4001-bc21-9001bbe7c96a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4f46a2b-15ae-4e2a-b812-99ca766df61d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65974d96-f188-4503-b431-b22d4e9caed5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb1d7cfc-cbd7-482f-9d9b-d7c06e1173e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12d8f27e-d833-4fe2-82d0-727b181cfb43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab970d37-46e7-496b-b56e-24da95ddceff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1280393-2cfe-42c2-a904-e51c495c7824", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b2f5d6a-61b2-426d-88c0-3067f5dec820", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c0c6787-bcc3-4f61-9720-7c3920933c77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e130dca-d3bf-4bbf-b375-cf756df22cc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a566d157-dc0b-4439-8fe5-c7fba34f4a1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13519a0e-a02f-4111-951d-51c206b19c27", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d15fedd-d4cd-434a-ab60-1f8e402c5bd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f1304c7-a29f-4595-b8bd-7f1342dae81c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0883f62c-c13b-4daf-84f6-25ee5959f347", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffe405b8-302d-43f6-bdba-86dc2360882e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d95be460-8fef-4f1e-91d5-2a4895af7b27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac19a801-201a-4b14-a16e-e795793c416f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ee58868-6578-454a-b71e-6865e5ee4368", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4f3b51f-eea5-423b-829f-f1fce6de4614", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa344b7d-d358-418d-a2d5-493b2d885ee4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61a97cd8-56d1-4414-a8d6-21ecc779ef5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--338d431d-7e41-47e2-9d7f-7b35b44547cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e52e4576-65fd-4b11-b6f5-1e33b05aab7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--377d5769-97f1-45a8-a377-eb34175ebc9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--354a275d-944e-43f3-84ad-f5728a87ff3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--252b1f85-8c44-4756-b71a-46e656ec30b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09ccafa1-7116-4d7d-a174-0e71548a34da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8d1730d-0148-4188-af1e-6b3d679d4799", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e58ebf49-8b50-4dab-b5d4-179a9d05d1c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dce3412-3b57-40e0-a4fc-08c6543d8dbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e898b6de-c26c-429b-8a2d-7c322d5234b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a025ce21-08e3-492f-bff1-58da0fa0715c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d70e166e-d25c-48d6-91d6-0fd47364b59e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--521f439e-7d40-4a0c-b298-f47493beb797", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.229']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e994ad6-0f86-4587-8a6a-58f28c0db4c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63afbfe7-3701-46c7-9f1f-eb9a677fcb58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1db7a3b-9634-4196-947d-db370edb4da2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72b722b0-b329-4ffc-914c-3f49bb0c66e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83c65616-4788-407e-8801-412106dd98bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4b1297e-fbb1-43ca-91a7-3ea6e5484df6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae214441-5de9-4661-8f4c-a337fa4aed15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fda3f5c9-83c0-4bee-b9c8-e82fd34ea0b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96353cd1-3d2c-4478-8d62-4910be0cf9b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d17a077e-d929-4fc9-8a36-20251728be99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea8bed3c-ebe4-4635-8aad-0ece92d6e35c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--485008ea-950b-4db0-9f61-e2ed4966eb0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9df22b0d-c47a-433b-b8e7-0df368bdf582", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70d1b31b-45b8-4b34-9db0-109e728d8ce1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3338e02-fb46-4789-992d-da8faec2ed7d", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.165.253.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee7b16b2-8460-4ddd-8967-5e3e42a35a44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.167.169.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41522016-a440-4579-b3f4-c59ed38461ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.167.169.180']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba191ea3-30e4-49ce-8fd6-7402ab09cd41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.175.220.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edbb2769-1c3b-46d4-8217-d4a55066acdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.198.225.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c13b554-e94d-4fa6-b854-3764c99d8f53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.40.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a4c69ca-9c96-480d-8c80-a08ad7775a8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.45.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a706fa2d-9fc8-43b0-bbb1-d4310e1f6516", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bec6051d-b171-4393-a411-2ded3fb8ed97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34d65e3b-b2eb-4fa1-972f-09c6bbc13eae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1235342a-94a6-4442-9225-f5f930435c47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.62.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2eaf1c71-e3d8-4f68-a8b1-261af73275ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.192.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a33cb3c-5e81-4f8a-a03b-c6d4f72da000", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.192.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc63d8af-dbb7-4cec-9163-6376045183d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.205.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea5e095b-9921-443a-86a8-2db05f24358c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.236.119']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5705f04a-4410-4045-9add-adbed55a74a5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24d21a57-341f-45ac-a479-5e84a50b0257", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5425bc29-e571-4efe-9f25-ac11a1078402", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e845e370-b6a2-437e-868a-380dcc505c0b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.63.169.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--044a5efa-13c7-4940-bd3d-51ca5addc1da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.8.6.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84fac8e9-f374-45f9-863c-15a356b445dd", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.9.160.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--468a41fe-6001-4831-bf36-f333bcd086b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.96.195.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b918f63c-d319-440b-b0ee-eed4afe577b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.149.112.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b39cfe8f-1d33-4901-aa6d-d4a551d47c24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.205.131.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4237bdb3-9bc0-45cd-bc26-51b3ac52350f", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.205.183.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1bf9aa4-d680-4604-b6ec-c6b066ed2367", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.52.95.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47a0e6a6-3320-4ca3-9f70-26e9dc70a9b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.134.247.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9857817d-2952-472c-ad0f-0ea0ff77ead2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.104.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32e92fd1-38c2-4f2d-973e-a4aadda85faf", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.155.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--970bfe5c-00f4-4e95-a44d-42fdd2771570", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.229.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b05533f9-0da8-4681-8952-b946528673fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.234.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8c53bac-7848-4bad-b526-84011aced080", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.236.1']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa67235c-1706-4003-9628-0c468ea2c4f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.58.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--237fbc65-ca09-4316-9de4-b02b330b2065", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.62.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7d5e78f-c0f6-410f-b7fb-c97177ebadb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.72.82']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eef1a5d-a5a9-4880-ace6-bb47e2e1d4ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.64.170.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5eba141-674c-411d-bda5-52a4d46c89f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.10.36.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fde0ccf9-8a36-40f2-b070-6538a78e4c4a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.157.68.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34791432-d6e7-470a-ad65-6bb41a44fb0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.164.214.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a7dd36e-b234-4590-aac8-2ada8c4318ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--533ffef0-c48f-493b-8e31-cfb74f8c2d3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--368d54c4-f962-4d18-bed7-0b5288108cb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e59396d9-a254-4e3e-b5b9-7600d2451739", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b231cd22-fa21-416c-b936-ebc5b8a55f53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f93a9ed-02ea-46ad-943a-db5e749161b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3382a9aa-eeee-4ffb-a7f6-ea0bceff0558", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e14ef516-f6a3-462e-935f-946972749c80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6941bfc7-b6a3-4d79-a450-6c0bf9cddc45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3448c4e6-7e9e-43c6-bfaf-83d034ba9ea1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28d56305-b81f-4125-a0fb-69a18c5b5558", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e56ad94-f36d-4822-906f-555aefa15362", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20650e22-e931-4b6d-9469-14c993718c05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae9864cf-63c3-4c6e-802f-41fc28c62010", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--875abcf3-ff62-4584-a716-3e9f40e717e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--286d4f5b-cc9a-4c37-ab19-d5ea2701112d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--398c2513-7c03-4e5a-8272-06a940c3eb06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--943d6563-7266-4a3a-84b8-03d4b8aee2ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25317f74-ab86-462b-ae16-6c4d5222c5a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5a2f639-8f74-4720-b0e3-46b015d59d80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01a57ea7-2757-4ee7-a408-76255423ba91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8078e8b7-eb08-4dbc-9675-41991a22a3cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bdef2ce-3682-4402-bfce-c6ec973e9eb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e4074ea-ae78-4201-b341-ad0fc14fb509", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1ba492d-fed5-4c65-8264-5d2302d16452", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71db581f-e1f9-4817-b568-aa9a77aa765e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23d197a2-7cc8-4aa9-b238-7c615f4b7949", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d91d524-fb23-4ad7-b0a1-da68643f4840", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de34277e-301a-4c5d-b2df-ed5d2cbc9dba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eb843ce-23a6-4781-af2b-5d1dc63f921c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb70cac2-43c1-4890-b629-1355f650db22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90f208b6-6a92-4c12-8cef-f21688931ec1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--507acd6a-7fbc-4b15-8570-d04b677c58b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1707f650-3f50-4ee5-94f7-5498f18f9624", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a5e5f70-d53b-42f3-a110-23218330dfe5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--348e324b-d2e8-4b25-92b9-1e01cbd43da7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d11fecdb-8d49-4075-8033-b197b6dd6c0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--513b1c43-ade5-4942-8f2d-b26d8f1bcdc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.89']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3be79b83-673d-45d5-b0d4-59b77da9c79b", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4647c96-87b4-474f-85e1-62f02b578b05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b828fb6f-37d1-45d5-b4a9-7709ceba8ef4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.6.207.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2906b66-1a9c-4e53-a328-b30ffadc8110", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.6.251.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff07c411-70fb-4086-ba55-f015f554b6b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.63.64.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64b039e9-f0e6-436d-95be-ec9b6f838063", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.63.77.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8496e19c-f77a-4be3-bf08-553ec649757d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.73.187.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5290cfe-2b0a-4cea-84b7-b251f093b884", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '70.190.184.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5de75201-f674-42a0-b58b-166ba0fe3746", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.183.143.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e2d3416-bfd6-4490-9808-60572c1f4564", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41af972e-2e2f-43b4-b8fe-c5fc2eed1cf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.232']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4131ae0-4fa4-45bf-8f6a-690a217188bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.135.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afc54c7e-dcf3-4030-ba38-5db0ba8149cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.146.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e79fa6bb-42b7-4d27-b2eb-ddcc038804dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.147.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe3777e4-1d23-4be2-97ce-c69b9b327a03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.158.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bed8e47a-a210-4d4c-a9a5-b1bc00755990", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.165.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8a5d70a-c9a3-45ed-ab01-68aea1840170", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.199.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5fbda0f-bd83-4b90-826a-b4d50fdbc9c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.14.178.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f35939eb-3f40-45fb-a0c2-0767922335e7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.167.226.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cab0883-433d-493a-9d36-be5de2a88d55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.49.194.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6be30e5f-3bff-4e6c-bc20-1023fa7b1530", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.56.64.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cd963b6-d19b-4078-a189-8927384106f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.69.215.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f9331b8-344c-4e07-85cc-a275b1569c0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.74.45.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43380112-17c1-4351-86d8-70a723831585", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '73.158.135.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e42f056-34d8-4827-8057-7587a5a9982e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '73.36.177.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d5e457a-f28f-4b7c-8887-49e82a1b62ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.207.253.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1904d02-c79f-426f-b370-e5b80c0292b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.121.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ffcc03d-c6d6-463f-bdfa-4dd2b0f01b0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.122.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0a9777e-9d53-4af0-b145-a93bd2d8b372", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.140.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b532779d-7c75-4211-8814-afa945ae5694", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.203.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18779310-88a0-481b-8c01-b068db691661", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.243.239.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e530844-6577-4c11-8b1f-ff7a8e7dde9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.128.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--353f11d1-c56f-42aa-9f7e-3a7f12138b33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.128.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dcd59bb-f869-4ba2-8a6b-8231b46612ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.129.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af5983e6-5138-490c-a45c-56cf93bbb472", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.184.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--606e8dc4-ff88-4a75-b6e5-7b6b23b568f8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.241.148']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd340744-823e-4add-9f07-917e8a15cbab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.243.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d6ca652-2c49-418e-b19c-22aeec9d6d26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1bf9ea2-b35c-4245-8fd8-5fa5d3356925", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6335718c-17bf-4075-9fda-3e9c9c28bbed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d3f0d7c-d314-4659-b598-c100ea937d17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71cc76a9-7ede-4d7c-a496-8bd58f3fd850", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30677f0a-e209-459d-9e57-02de7fd62ef4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08ef4d38-6f47-4fe4-9993-b4fe390e45a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--185993c6-5173-48cf-a19f-568b69ada4b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1565b883-c6fc-42f1-9ec8-3a2d2283036d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6555ed70-1f4b-4558-b1e8-27fc72886d56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a682916-a66f-4eb0-ad7c-ad2bb5f9c63c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10b9ff7c-152f-4292-993e-de81d4e3a3f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a9077cf-5f65-424b-9918-bedc6226871a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de4eeaad-8ed0-419a-8e5c-74be9301fc60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.91.194.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77f319ce-6f06-4372-95cd-640695e2b4a6", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.137.69.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4621b2a9-18c0-427b-90ef-4ddb2c34fcaf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.239.111.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3bb480a-8df7-4e3f-be41-008bcf5ee44a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.245.156.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c22dee42-9111-4b2b-8c5e-c320719644d9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.42.69.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc7cc18f-387c-405a-9ff0-63b90d45adc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.75.31.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--466f9a22-04b9-4f33-9d06-5b62e34572c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecb8238e-b145-475f-9097-abc3b01008d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da4f13a8-4272-4e01-a869-35420d94865a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83163cd8-a43c-4d34-b776-bb8ca1eabc85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b0727ca-48f1-4bea-989b-ae4699a05f8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d551707-e70e-4dc1-a408-9c094fce5ec0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a426eeeb-849b-4390-bfdb-89c40b293948", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9fd3ad6-868f-4142-adca-b5c7b565b12b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.118.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e4a78b1-feec-48e4-bf07-90b3f577ee28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.118.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07f814ac-f52f-4c2b-9d52-5473f4db0bf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.157.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb870bb3-c054-4ef9-92bf-7f026f9183d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4c0f586-49b6-4315-8822-d21d7e97b206", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c934be5-8593-4533-bd9d-11c125ae5408", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac827907-bd6b-4623-8f68-62e5201ca8ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f9c8c30-00df-403f-9b1f-23e64b73a2ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f6aece5-96fc-42f5-bae9-1bfb4dfd9995", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.99.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--751f7b5e-78b8-4995-867a-d55ae50c9844", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.112.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a32b78a-db0d-4b94-be9a-82ea214f682f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.112.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb30b8dc-10f6-4d2f-9f7d-4e552cd6c3d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--898a4367-0436-43f9-a223-81e6eb075c5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e01b8f5-a33c-4b1d-8554-02313b512666", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3407e368-26c0-4200-bc0c-736bdef285b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61f0005d-0e08-49d3-9121-42af44243844", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92be8578-2380-4083-b9af-ca0ba0fcd0d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b0fa374-9b15-4986-b308-3a88a191cb99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a374bd8-7ce4-4cdb-9070-a4f012979b0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15e20f8e-41be-4ab1-8505-61a043cf1eef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e636bfb8-a9bb-478c-a194-88a9caf71dbc", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.135.2.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c8e335d-3768-4912-8253-ce8abceb6fc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.153.139.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13510a2a-4517-4b54-a1c3-a143027faef6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.159.131.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20de7fb6-f196-4406-943d-3fd1f33628b5", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.173.117.129']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c21faca-e138-4720-8817-dec925505591", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.188.216.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b023e351-b136-463f-aae8-e3a01ddae265", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.42.241.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c86e357-3003-415d-bd7e-0a0a46d22d19", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.83.249.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c54e8fec-24d8-4a61-9c08-e42821e3ae11", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.117.28.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe26415c-3cba-4aca-881d-e816ed1190bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.110']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d101828d-82bf-4ace-91ee-774d3877b6b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7df497a-1c31-43a6-af69-f030298e577d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. CVEs: CVE-2021-26855. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--26cd3638-7f41-4ab3-baa8-2f6e2c5663bb", "relationship_type": "indicates", "source_ref": "indicator--e7df497a-1c31-43a6-af69-f030298e577d", "target_ref": "vulnerability--c49bc997-a777-4d72-a03d-4f7af0e75fd6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c37d7061-89af-4889-8858-3dc88bb1e23a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--761233a3-db30-49ae-b67a-bc94b325743b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc4d65f0-3ea0-4cde-88c2-5fcaa23b461f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9b988eb-8145-4a0c-b021-74a1459231b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd3a8b43-0d01-466e-9feb-40f41dfcc9b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.56.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2092de39-96b3-4c9c-9ebb-d2f6284544d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.56.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b28eaeb8-13c2-47e1-8646-bb75a1e35622", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.56.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7b71e82-ab7c-408b-a513-2d91c51cb92b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.58.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b30bf974-6310-48c6-83ba-3e82bb71b4c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.59.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9eb1b6c-991e-44dd-aec0-ed0b83981acf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.60.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--051f847c-7aa4-475e-a00f-9500ed8db997", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bedfb3d-c6df-4bf8-915e-5855dfe8824e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--757feefc-e414-40ae-a89d-3621d921f9ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f54ceb11-c597-4836-97aa-9f8df05933e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72095bdb-0939-4890-86a4-12ca42278b83", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.137.34.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff717afd-e6ad-4579-b8e8-c2e0cbf7dc04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.174.63.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a5df5e8-f87f-4281-a54f-e817c581b024", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.62.207.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a05fe2c5-c4a7-42c8-a9d8-2f5cd9e4244a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.135.29.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--693b18b1-f55c-45f5-917b-c96dafa8b68a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.138.154.105']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27925bab-4453-4cf2-abdf-5776e474becf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.140.232.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fbd210d-d2e0-4a9e-9ae0-fe9bff02bc2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.148.10.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5234521c-d93c-4499-9c85-cfb640720b2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.154.0.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7205bab5-96c9-4681-a03b-b7d93d63d658", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.163.108.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fda2553-87fe-42ce-94ae-1eba7b1b5950", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.102.92']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--899959b9-9882-477f-8d59-afd99d4fc760", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.108.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cc18b46-7ddb-4aa7-8dc5-e3971b1bfeba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.119.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11a18b74-6d18-4f2c-be1f-770ccbc1de28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.119.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1859b310-e3c2-4161-94f5-97222669f9b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.126.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7280af9c-6fcd-4f83-821e-b1969bc9488d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.208.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bc8d39a-b168-4c2a-8457-b32acf61f996", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.212.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e9a0e1d-ad21-429d-b925-d600679c8604", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.233.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0936f79b-2640-40f6-a7eb-384a35651970", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.70.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30a39ae0-7a64-49b7-bdd1-73a83ab0d589", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.74.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5ef40b6-a2f5-4bed-9b22-c13c07d81b0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.82.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f0f341c-8afa-4982-ab1c-379ac16e83e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.83.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a96756a-fb74-44a6-be45-730995e413fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.11.111']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bfb2f91-d944-49b2-9dbb-311bea33f8b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.129.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19b4c83b-a400-4262-b24b-d9b406ba6f0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.152.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f7fa2bb-8b76-406e-ba67-1ce8c179daca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.19.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77956576-3dc1-44e8-9bfa-a1b1f5feeeab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.21.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a64def3d-fafd-4385-ac24-05d269dca642", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.24.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15888acb-854f-42bc-9111-94ab00d286c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.27.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--136bdc35-a9ba-4f4c-b19b-dce8845142bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.31.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef235141-0882-4f07-af88-cf4aad192a38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.38.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6034255-a797-4d19-9b13-9bcd1f1d1a2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.39.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b22dc229-0b8c-4dc2-aa37-c6f44ec33ead", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.43.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e28b169-1941-4d9d-9f3c-9b9c35bb31ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.43.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77c87022-64d4-46d0-a88f-2599210fe993", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.44.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76c8682d-eb06-489f-9c48-3da3443fb1a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.45.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--205f7ad8-0fa3-401a-bfd1-3f7f97824711", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.46.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26b5cf9e-0999-4b57-8477-528c2d91d4a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.10.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de055a6e-781e-46e2-be46-94da3ddc406b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.12.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d833c44e-9d2b-4fab-bc47-4c7ebd97412f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.13.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e56f304-45a6-4c03-b342-5e017ae8ba82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.14.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6441f93-b96a-4bde-9872-b165bc7d1528", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.16.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd5d28a0-0e68-48d8-9187-4c89f2fc63e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.17.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afd4ed5b-fbff-42c7-81b2-2dc1f643fd05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.17.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b93c95c-774b-4ade-834f-1a31a2643965", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.17.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eab13ef-be98-419e-9079-e9f7dc145145", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a5f4309-f7c7-4832-95f9-e50a38ac3af8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--610a5544-1edc-4fd4-bc78-97211c36c7c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1c5a2fa-ba43-4bb3-bb33-7e24855359c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--621a789d-fdc4-4ac8-a732-989820e78bf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4ef6274-73b2-436f-bff6-f9eb8caa8680", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--841e92df-7464-413f-92b2-31462bece2e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f7091bf-5753-4019-8be8-d558e0bbdc8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ac9261a-042a-4f54-9923-5a31082215ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6375344e-eb21-4a82-b8fd-72d1ac0f1be5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--128c5dbd-74c0-4e7f-9b1c-393bbd908f35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccccd2f4-e056-448b-aba5-3ec96c942878", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5e38149-cc03-448b-9f81-75cb8fa4582a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4952a93f-bf9c-43a9-a6eb-c9f3336b438b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.132']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be93b073-ebe8-4524-b4fe-233aba136bab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c16ab0c5-a7e0-4a50-b74d-46e9c9434e2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fda945c-7fcd-4bfd-8547-3b7b756df01a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--687aee26-156c-45de-a7c5-78a52fe77f92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.6.115']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0455fe80-a975-4de3-a650-867287f29c59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.6.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--881f08d1-fe44-47e6-a499-900e88a1c64b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d115586-27b4-4a03-9479-7bdc66b5294a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.215']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9732ad86-cb49-4ce3-b3c7-bdee6e31db3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5cbf01b-4845-490f-adec-8a66b7b05cb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86ec5162-230f-466c-bab9-cae200b46b8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a9f9ecc-3c99-4614-a2f5-b040a1825f7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.108']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44eea611-88a1-4b7c-ae99-bffe7a984af4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8dc00a7-a533-4c9e-837b-4989cbbf3d71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--812b9ff3-2dcc-4d32-a647-9848b25bf10a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--552262bf-e30f-425f-a52c-c5e67fdb3255", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.179']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--842f3f0e-a337-4d84-bbeb-2e740f51f397", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.223']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4866e506-f7df-44b6-b6ed-6c4cb1159304", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.107']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c665ce33-6de7-4f3a-a61d-7b651046e600", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d882a41-b308-4a8e-9a2f-d526bc399207", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.127']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecf81182-6fb7-465f-ab2f-8caa9552d175", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8be05856-36f2-4849-8ee4-8753197d0584", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.252']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f7baec0-9eca-4b34-ae97-d4d59bc9c77e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.104.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39cbb1fc-a62d-4bec-b471-964b50bb1880", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.119.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4126a76b-1b45-4343-8224-462272bb5b5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.238.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83c0b2f9-0353-46ef-8379-2fa67af0e162", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.68.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5872d07-050f-4025-9998-1622df34ef3f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.7.77']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7a86871-2dec-48c8-b809-7d00c2083808", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.84.81']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9748ac0a-34be-41af-a13e-ef4a0e019b2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.222.230.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--877d0a2d-0b36-40e2-baf7-f2c4c0ee8919", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.243.69.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4593f5fd-c566-400b-9e2d-909261c56f4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.13.153.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e8f518f-335d-435e-97a6-ba90cbf7d682", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.158.109.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f09d0a00-65e4-410f-831f-91d14bcf8590", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.66.83.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ad82a20-d101-4cf8-bac0-876f2c48e5c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.66.83.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e9cfaac-8655-4885-9f14-b80c084f3497", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.80.90.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b85444a-a6ac-4e1e-a706-d947cb2b1102", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.70.133']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b086658-95c2-4371-b3f5-504860578452", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.70.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13ac4d61-24ce-4bde-9d87-4f0cc96a593b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.77.139']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--679252ab-3d4c-46ac-bbc1-5a87a68a76c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.77.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c837e305-38c2-48ec-93d7-9e065ef186dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.93.123.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28612105-3519-4043-ae10-37880cb52029", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.164']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--017720cd-6337-4bd0-a42b-3acde46f14bd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.165']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e30f0b6b-202f-4ca3-9bdc-52a4f7639895", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21d71e34-3763-49b1-8872-d1f2e47bc26e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad1aba45-936e-45a1-8f33-6c379b210fe4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30ec6769-7a23-401e-8a2e-de96cd6f7be1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.169']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a549b5c-e633-4c35-9ef3-e02a96df7078", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.171']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9118491c-3545-495f-89d8-e74ae74e4cd7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.177']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c896c45-e9ef-4a1b-9f10-345ede57c862", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa9ac5a8-66a2-4cb9-90ea-2072590deb7c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbfcb5df-c19b-4a38-8973-6e11842ba1c1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.186']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8b4c6bb-5937-4f0c-9bd0-7fbfc9470427", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af372c6c-987b-4f87-a8ea-f19330e9d878", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3c55dab-9a8c-4d80-a812-497f502c04e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--358cbd3f-9684-4f82-b35e-ce26affa50ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36a74141-c2b6-4a7b-80fc-879251237939", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d90ea7d-76b7-4538-9c80-731ab832cff6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.17.101.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1bdf1fa-faae-4400-ace9-badc8e88d15c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efd7c2ee-80fd-42bd-ba39-6de1299e6712", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.102']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7e1eaa3-2774-41c0-b090-9b71ec0ff13c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d630f2b-1ab8-466b-ac08-c38d7d963cbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d670bf9a-95d1-454c-96e3-e17398fa95ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cdfc9e9-468a-4f7a-9ec7-19812d73a090", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8e35cbf-4432-4b84-9cff-88e9ea36d3db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.116']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c87c47a7-9a65-47a1-a4bc-c3a35f025ea6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--759e51db-d1c8-4b91-bb7b-3c1ac45dcd6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.120']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--247f5453-69be-46b0-b0bf-8c173aa28768", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.121']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a901b6c2-03d4-4040-8761-e2a463f7fbd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0b952a2-3fdf-4509-9d40-7fd300b996fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.126']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e1750d4-03d5-4af0-bd1c-7db6e302e506", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edc2cf0b-1026-47f7-aec1-d9608a00b8c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b84842a9-a3c9-4756-9c8a-14b39cb3fc24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--787e5470-76c5-4dec-b34e-2abe294cca77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a00edeb0-af2e-49f8-953f-2f6bf920bd0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27834796-57e7-4e8f-aacc-e21a17a90ef3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.76']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c8d7ceb-ff1d-4130-9e9d-cbfa7bacffed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.78']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0ee727a-8596-440c-ae29-2ecaa0ea7633", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f661a781-9c0e-4974-b574-69e4fdd996a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.80']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30da26b1-1ef1-4354-a6ca-b0eb9f104815", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d039686-9c78-43f9-b38d-ee4ba65e91e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.85']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c15f4379-a383-4500-a713-336497f51685", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.86']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31c2d0e4-526d-45a9-b437-bb3e9806c3c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0d198cf-2dde-46c3-ba51-9b885f90d4e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.91']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4a52507-b0c9-43ee-a468-f269709d325f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de586cbd-11c4-48bf-b743-c715df7384fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.95']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb905c68-cd99-4fbf-bedd-1f35fee6e0cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.96']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ae4d162-de9a-41ec-91a6-d1d0d0707160", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.97']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a42b3ca-7e0e-4059-8ef6-087bd57b7e91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.216.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06b69e5d-7d55-4020-83b3-31e2285325c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26a13a40-2bc5-4471-ae07-963f5d3a0f1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.228']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7b0ed45-c18a-4f9f-b7d5-2c712db442be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.231']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--054e9269-3a25-4c02-870b-f91b2cd034c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9bb2fd3-2f68-49a8-9199-75c90adee955", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8eefc1a7-ebc9-49f5-af98-539cd1a5a953", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a61db3b2-1b86-4854-8e8d-e9b39833bf86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f753ad74-144b-4e5f-9cfb-8ec418e4d26f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6fc6822-63ed-45d0-8021-6b4c67dcd40f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.249']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d874103-da06-471f-97a7-bde083957bc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--134a22b6-482d-400a-85d2-3c7dafd49f11", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.193.159.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9879504f-b564-45e5-ae61-eef8e5d9ebbc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.211.72.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e79bef3-93ed-4b40-bc1d-08c4cb89e5c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.248.235.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6520e377-8e8f-4206-a0bc-c7089e477fa1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.27.243.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15e31c0c-2cec-4ca9-bcc2-254ce0bd3144", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.57.15.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6a24f48-ef2a-4fa3-bcde-d4bc168f6fa3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.10.135.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7af0edbc-a941-463b-bce1-fbba9902b025", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.115.17.167']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae04c7fe-fdcb-4760-9d93-c908de8b5de5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.165.121.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c5bc298-95d1-4624-99fe-138477cc6031", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.197.58.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7365ec0e-01ec-44a7-a6d5-6728aa892cd6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.22.175.192']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dacd001b-7803-499b-982d-eacd61818fa9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.31.57.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92614552-d959-4ad7-bf04-76b6cd557fe2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.39.86.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32189ba1-7f8d-4d63-9d82-4915d151d0d7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.65.73.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47faa61b-83b3-44fc-b5d0-a27c1b728469", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.66.224.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29b51828-9f8f-4f99-b7b7-25ad58b6e920", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.142.209.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b4dd6e0-f27c-4d15-99d5-e247215f9f6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.166.246.113']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53fe4077-eeb0-47c4-8226-1f492a20815d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.224.141.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--641abc2b-f76e-4ad8-94f9-880cf27a32fe", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.235.21.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--564aa57c-1813-4b2a-955c-9e0055e3b28c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.9.123.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55debbef-1270-4565-a983-d2b0f0078ffc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.108.109.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53591e88-1d9c-4894-95df-bc7acc5230ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.201.20.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa0de050-49af-4112-8a55-ff28759b5ca0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.247.138.235']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87d19749-fdc3-4aa3-b2d4-5648da80fc37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.252.92.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94b11708-9915-49d6-b466-ada67aacd008", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.102.15.112']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85db5294-00ec-4677-adcb-ed5d89571234", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6d6fa97-e7b1-47cd-82f4-aebbc5f4da77", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c38b7d2-570d-4c1d-b440-75e9c6a06a34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.224']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9738d205-0a6d-4e51-8aeb-330f66fb7777", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ce52dac-9e36-4cfb-b9d9-34937d18972e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.140.43.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de23a4f3-002d-4fdf-9128-edecd4b9377a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.184.43.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37d1e6a9-2449-40c6-87d4-43b8f23296c3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1cee7cd-afd1-4d75-bd4a-1d5bbbb10137", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e38bcfd-2c73-49b8-a5db-62aaae872e6a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2cbad84-e817-4553-8ef9-74f1245ead76", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.196']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf9cfa80-995a-4594-beb0-e260a556f961", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11540a4a-1c83-4f9f-83f5-29b9eeb3fd2c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bed32624-6393-4ff3-a52d-bc8cbe29681c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.199']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a5376db-1598-4110-95d0-7dc4f5f8ce44", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd9b993e-d70b-489a-931f-1d8fed61ca63", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--578c283d-2c50-4880-9790-07354ba6059d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3eb51e3-9541-4fab-a5d9-ae36e4821619", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.203']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e1816b5-4f66-4f96-8110-fe3e489ac2a0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73234575-3ed2-4a1b-96af-73e19f5028b8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.205']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a58685eb-45fb-400c-8ad8-4946964e0ed7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6c73366-c2f3-4a92-9169-aeb83313d3ba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.207']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16eabc71-66dc-40f2-9855-08a4aee088a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92e2d36b-89f1-42fb-955e-d59862cf97eb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.209']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--676a2cc3-670b-49fe-830e-633ff8058c34", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97e4a6f4-c030-4a04-8b5a-c64449a6c348", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.211']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05973f5d-f536-4ad7-8876-d79c2e827063", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.212']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1301d1be-044a-498b-b8e8-27128cc39597", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c44a614-863f-4e96-a996-16030b581a40", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--332c14e4-9b34-4a40-b5a4-b9b8aa6e41ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d189775c-1663-4165-81be-0159d84beb43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.215.181.244']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a11bc446-8da7-4c2e-9da4-06d004647ded", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.1']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd9140da-a24e-409c-89d3-f3c7681f190d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6e993fa-8f2b-4f5a-bc10-bf20c40795e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33572c60-5415-4d39-a32f-ef6bf530bedf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--505dd22f-bd6a-4e62-b684-9fe9b0a5d36b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8f7b070-5869-45e4-bc87-50a573f57544", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c6e1b3b-26c1-4ab7-b94e-74cef096ed3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ffd1355-7375-422a-af5f-ef321b29f780", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3ca8264-62ed-423f-a304-47ead4ec9e3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0abd5ed9-8d36-41fe-8509-fc8a23acdbde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8db20e1-e8c6-40e7-959c-79eb86ad4649", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--451b52c9-49c4-40b8-a865-e151127ca6a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c55bcc6-8470-4982-ba3c-0a4e6598bf95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd030a86-ceb6-4f4f-8537-157a3cd303a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f0aa286-d1ba-47fd-b643-12340a4eab07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18e45c34-2fa5-45ce-8fd1-9e83edbb3cfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35086ce3-01a2-4232-8ca8-975b2f914d14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c6a733c-900e-4607-a187-e2aa7821bb4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58e6fc30-8a00-4feb-b203-20bde0878fe8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f838b57e-0dd0-4dea-80b3-5a1725870272", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--899a6328-89b1-48ad-868f-65cecc390686", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd249c89-8ee1-4ca1-ae0d-b104d93de28f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3fe8110-3e2c-451e-ad4f-1abfe3f151d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eadb481c-4279-4f3d-ba94-7985ee8f810b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--808a5adf-af01-43bf-81f4-d35933141897", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ec55806-95d3-4023-a195-bf19ae9c3b0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62ca6617-6fc9-4f68-9c46-69da3ba96b73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.37']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdadfa6f-cda7-47e0-b8a4-158feaec888a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6af5bff-61ba-4681-aedc-401973d1d117", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41b46a3a-20d9-4521-9957-94f5f9b766ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--577a7979-15ca-466f-a141-a8f4b7ea4446", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efeaf84c-75dc-4cf4-aeba-dc6cbeafdb46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97d0c359-7d45-459c-8bb6-9e929ea0347f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--428a4578-3c68-4451-81bd-b99004e5e165", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b62f9a5-533f-47b7-92c7-fef4c81f244e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b7cba2f-18a0-4863-9ef7-ce7f376a00fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cdac179-bcd6-48fb-b83d-9b868491ac6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b9be3d1-fff5-4598-840d-a315274a9180", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c909c29-f054-4c37-94bf-9872a4773ae3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67d3a64e-5d1c-480a-9675-3efbeafac269", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d00f06dd-872e-4d2d-bed4-266b9899d934", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41e1c2ad-9350-4e27-99c6-2931f89757b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3aa98b8-ebb9-456d-a447-6bed384be92e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.51']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76d78cc7-8137-4383-83aa-0c50e8b53dc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--373ab179-a9d8-4f11-891a-e0a950a00406", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--affc6048-e35b-49ea-b538-eee2129783d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8a83ae2-7d9d-458c-b257-5c9d9b65a716", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82b62d93-01a2-4d5b-927f-c99a9396302a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--944acb58-f15b-46e2-8392-d29a40659351", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.0']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97fadebd-0491-4dcb-848b-b24a5774bb61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.1']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec72a8ac-4916-4f1f-beb9-9d3d3f3de780", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--695c339c-6b71-449b-9fe2-513d937908bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.11']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d8ee32b-2ab7-4fee-9f17-976ded76a750", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc7efb7e-b467-498e-8975-06ffdf7a127e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.13']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34577bee-537a-41a4-bf18-b6e504d2d101", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.14']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bc71f99-fd53-4279-a9c2-dd3f635b0d38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cfc349c-715f-4195-869e-fc608a23de9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.16']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--145cd8ac-473c-4dad-8998-d3a0f501113e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.17']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7c2a1a2-1560-4c9e-b69c-a58d104ec045", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a05efbb-26fe-4d03-93ac-62a709d9b50c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.19']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44ac4578-513a-4056-9063-6af2a481100d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0910fcd0-a1ae-4137-b8d4-9601351b54c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.20']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ee7fb34-d734-44d6-be52-514e4b6ef109", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--718d3540-17ba-440f-b976-1cbe59757c0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--493ebaa6-db30-47a9-8c90-a126281e6d98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.23']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e35220b4-5ba3-4bd8-addd-507ff48ec8f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a62fe4b8-ba61-4dda-8904-be459e20802f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.25']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--283f5367-f7dd-4248-849a-a13050c8f07e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.26']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4513a855-e49b-4ea9-8104-f8e818254832", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b71d552-6096-4c43-ad74-0abb22152cee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a422eb66-6ea5-4f4c-a03c-e8caaaa8591f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.3']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b1caf7a-e721-40be-9368-311676103b88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--076107c6-4fcb-46a6-b85e-737ab12d2f48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.31']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36cfeb16-74a8-4941-9986-55aab2b8976b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abe8d3fe-6d04-452d-8de6-11c5350677ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.33']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a50c0627-86e1-4c1d-8c65-402dd218c620", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--910a5c2f-3213-4055-a022-3981f3a7af8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bd94096-f6df-4257-96c1-79f49d2aa55d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad5ac303-882b-4adf-9908-2e91ac74c212", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e05ea35d-06e5-44b7-834d-677d0df39a0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.39']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eec8021-cc05-4d1b-a76f-77cb65da8a32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--195422dc-3ec6-41cc-9df0-69d93ddb4ee3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d607e83-b6e8-4ba5-b48f-216caec18c46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5a5bef3-f44c-43b7-9ddf-2c747614312a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.43']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b5aa3e3-6d1c-43d2-af95-5740f8400183", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f49216ea-c1fd-4ddb-a483-658786b2b903", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aef1bff-32ef-443e-aa38-e8c8f2794c5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7acdcaa5-3393-4c32-ab0f-e991f63bf8e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42a6d602-ad96-4717-ad36-c934032586bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.48']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12a8d845-2d1f-4bef-89ac-ef1d5a0b5b3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a1209eb-5122-4767-8a94-295cfbe41ee9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71c5d082-a45d-4da2-9616-e980ac12e4b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.50']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6198b76-d7c1-4a2b-a9b7-40c65bcb6e69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--184e5967-b533-4b43-81a4-600dc85b052a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.53']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62984575-2582-4375-a78f-686a0c0f474e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.54']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c908141e-4c26-450c-bc52-d55adb173ad1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.55']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--119a8007-517a-4763-b9e3-9ec11679faec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.56']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0e8df2e-4044-4581-878a-70032a0c6e1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.57']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db2ac6e6-0239-46a3-9d64-879e1f798faa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.58']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac4f004c-e84f-40c9-8fcd-e6e05724dcc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9f60518-d725-4fe8-a605-fdde6bc2d988", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.6']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da468712-f135-44ab-9c09-6b1e0caa0bc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.60']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33424fc2-9728-43d6-aea7-79ced37e872d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19a9b3df-b500-4974-8d84-f078996c5340", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.62']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81bf63c1-b619-4feb-b91a-0079fff1b850", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.63']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24f76182-4c78-4337-a6ad-e4d59a8ed0d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.64']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36377e7c-c396-4226-a907-c16ff6a8a2bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.65']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c275956-aef7-423e-ac7b-7e63373f6021", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b32f9907-04c8-46a7-962d-80a4d57d9258", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e77ea06-8370-4eb5-a47c-c997569ea7c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.68']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b10f6924-efd7-4c8f-ba10-f99df4f3d2d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7f85f69-9e71-48fb-92ba-fe5b43bc5189", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.7']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0f8748a-056f-4147-9117-e3c2aa645e82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dedd187f-ee5e-4e57-8161-a5c3efb398bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acd0306e-500b-43eb-90cc-57f362934703", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fe110f3-c497-4d6f-b8c6-4e3c1a955055", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.73']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82522880-1a11-468f-9df4-693535ced80e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2238d693-11d6-4430-9aec-eb56d36af03d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c65247e8-bd48-4265-996b-ab8bc61d1246", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.9']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdcf5f33-cbfd-4eeb-b499-4dfde0de1f1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.239.151.41']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--914e819e-b25d-4289-b6c3-298b5287e8ee", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.239.57.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85851fdf-2a11-4c3f-b849-c7e89f5c8672", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.240.193.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46b52a46-2cec-4667-bf99-b1338806aaab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.54.158.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28121f27-8a46-4130-949b-a277c81234ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.92.232.220']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94809466-fbd9-4940-87e2-b0d36a0a7462", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.95.188.206']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7a63bd3-b382-4946-99d7-03d6559a73c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.106.74.245']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--813fba2b-4922-450c-9230-8459fa38ad33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.108.25.145']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07fa59dc-c669-4f60-b5c2-66d98dce2cf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.146.140.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81ebf62e-5e24-48a0-a7de-31f3fd194f28", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.252.154.197']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--532eb5ca-b645-4954-b632-02e0bd08b362", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.254.114.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bec5381-bdda-4c83-af4a-1531cee99002", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5654c60c-a831-4d48-89fa-8d716ea648d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e036ed0-b447-430b-97bc-061f35d479b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71467201-899d-4e4d-be7b-84a3db585bda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.38']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a229830-d1f7-493a-8b54-269086a24dab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5913b310-e246-4ae0-886b-fe1ab9d1cfce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b211b57-a758-4ef7-a09b-bb1902d58c03", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.96.69.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5dc2c8e-b153-4fc9-be1c-209a3d91d670", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.116.175.28']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e853bff3-b624-4b32-bf3b-bebcd4b7538b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.120.104.75']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95a924fb-7089-442d-8b48-c99ef4afc302", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.120.104.79']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd9502ca-c581-4caf-9d8b-93b8d6dc3b90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.250.206.59']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec5129a9-72f0-4eeb-b2aa-2a6021ded3bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf7a3454-3403-4aff-9940-d5fd61364106", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--618cbc80-22fe-4ff0-9b68-28521f545b8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b2557aa-4691-4e72-b70f-c79938a7fbb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff3012ec-22b1-4fa9-a115-2b890e69a994", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.99.156.47']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7519455c-96e2-4e02-bef4-9cdfb3894e77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.164.250.32']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bae04f7-2023-4b62-b622-3c9c8ca3fd3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.205.172.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a001b99-1ff4-4eb9-b475-f2bcfdf79348", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.210.63.69']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea0e44f6-cf23-4fff-8025-d92ac2da803d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.214.24.117']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--899089fb-d1e0-4896-9b94-3aef20782094", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.214.26.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b7e5fc8-79af-4092-b7b6-76bbd8cbfa8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.226.250.66']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1971861d-b4a5-4f79-ad43-dca3f9497a25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.241.84.195']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6568e3e-f5d8-4637-95e8-0a5248cb1bb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.80.20.49']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b4e8725-6cd5-4a91-a9ca-7771c30e62fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.125.154.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e909fa2-2556-4386-aae5-3fa4f5ca38aa", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.146.136.137']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28f12937-d175-4dd9-947b-1e6728b1dc50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.148.63.240']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61a49b18-25d8-415c-8442-5937ef6e3b67", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.153.125.230']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a91d30c-2b7e-485a-8ac8-b883a701c9e3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.190.156.21']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cff96eff-4c54-4c4b-a6a6-8e9fff57bff4", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.190.156.70']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0e2b0bc-2ac8-4f56-a2e4-b33af5909aa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.130']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c948240-c551-40c9-b0a1-61705aa4a12e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--273cceef-29a9-49d8-b280-bb5422f1d6cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.134']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48d5d86a-2021-4726-b042-32deb8744839", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.135']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aef0384d-56e6-470d-9e12-3564081e7297", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f47dc74-7334-49a7-bced-88d43fdf8993", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6fc5236-d856-45ce-8fd8-400913b546cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a13660d4-f4c5-49ef-ab11-a9345b18a478", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.143']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7389e4bb-1eb3-4c24-8472-02e91f1fdfc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ecf7f81-054a-4815-89d0-6518c50db040", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98dc94f9-8fbc-47ae-a83f-163bec82a1cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da78536b-f94d-48e7-afce-4168aed54e8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55ced0bd-f357-411c-98d9-4dd8f7a19032", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b9fa672-42e3-468d-b23e-8d3ea24b03f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d25bbd94-2f48-4f9b-9a02-c8d413dd26a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.160']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4478ebe-0f81-43e3-8b8b-a2a3c5543df9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.161']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd31c2dc-1f6b-4505-814a-3e341a2bb840", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.163']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc1d82f3-7138-448a-aa87-12c6de27e5d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75217e58-0827-4d46-84cb-38c60b517739", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaf6ca2b-0aa3-44c3-a30a-8e56172ff1bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.173']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5e616a3-70f1-4322-9964-8e876b51db91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.176']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13916576-5033-40ae-bc83-2a9e11ac09f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67588208-d947-4f1d-a2aa-f64774d5715c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.182']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eb48640-3310-4f9e-ab37-132421b66b4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31d00249-a963-44ea-b2fc-eb7ba4a6328d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1697dfd9-b8b1-499a-a7d8-e2260093340c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.185']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--068d5c94-99ac-4833-9a1c-852d134853db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9edbbf61-7f48-4a8d-947d-cd383f4d8385", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.21.67.190']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18673712-eb66-4725-8067-021d76972e47", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.22.231.162']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2e2b597-e1e0-40b1-9ea1-e60b138bf159", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.23.113.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--984c042c-ed27-4262-90bf-053ef08d4cb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.163.200']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c99fd023-2c54-486e-b348-1f7810a4af68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.168.227']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a67d062f-9d0b-405c-bce2-61ce65bf4108", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.168.239']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--206c5884-d182-4b89-81d1-5cacbd6bb971", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.168.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd42e9e3-a6c7-4a80-b8cd-a7795d2d8dbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.170.2']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a56a4c1-20fe-4d2b-8817-39075112243e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.172.183']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--128ef0eb-0221-4881-8326-7115115e5bcd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.36.231.131']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b3081c0-3652-4b62-a74e-d42227ccd3d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b5c551d-6d45-4d92-a504-1e32a3ecfa2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca706730-11a4-4076-b4b4-952e94167cf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eec2122f-c063-4763-8022-09334c05f328", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.149']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f440fbd2-d863-49d1-8485-d187ff41f38d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abf4df01-8805-4dcd-b237-372e65138f78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb440cd1-9e7a-4237-b5fb-b4bd66ddd460", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff0f5c6e-e20f-4616-b5eb-86190d99dc2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88916748-964f-44af-bb91-6d56a7c9a4fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8889173-14e0-4b4a-8e8d-baace9e059e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.158']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b7a47a0-7638-4e0f-a758-de98e5a57f1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.43.132.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30e2a21c-6629-4167-9168-934074ca4a24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.43.132.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fe5f049-2efc-49f6-b474-4d75ea3b3b1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.43.134.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf98c5a0-59cf-480f-8122-7ec132c7e3f8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '9.223.176.221']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49a4186e-87bd-42cf-8f04-ac080ce832be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '9.234.10.188']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d19de14-0dca-4af7-a54e-a198190ed974", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '9.234.8.125']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b834f49-79fa-4da6-a803-d754a0d9772a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '90.116.224.84']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df0d9117-9038-40b0-baaf-a33eb4fdbf4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.107.243.87']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--654e98b7-a491-4280-aef6-fec05f2693ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.109.163.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e24be342-ddf1-4471-8ba9-7eab5fdd1e5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.120.74.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdc437f3-7a34-441e-883d-b797f5ca480b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.148.190.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bb0601a-88c7-4ec3-b253-19594fc64b82", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.148.245.45']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b166cf5-0b79-4aeb-9118-7fc44dbf2b69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.118']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2950e4fd-35ec-4bda-b6e5-fc63e715ff71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.198']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b3db813-113a-43c6-94e7-2b06242b1bb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.46']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a29da333-7708-4326-b83a-d9af62d2336e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7282e50f-ca97-46ad-b500-7c224fe7cc67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3354a102-09f8-4a70-94d4-5534669044e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7ff44f3-55ad-4d31-8686-7b4bab8564eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.114']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4db53a66-56de-47a9-839f-33bab002704b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.208']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa20be42-ced5-4c4f-bc6e-390883086dbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.210']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61add5e1-a1a7-4481-8125-9a51b1181c8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.24']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea37deec-5e22-444d-8b0e-3640f3758195", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.27']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65356f19-57b4-4b92-aed6-2dcded6fec9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.90']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ace0feee-1e2b-4af5-9894-44ee0b479fa3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f2be384-ff2e-4f53-99bb-93a8db8b1a08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.198.249.101']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bf2e06f-9458-4b54-993d-018d0a900702", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.199.163.52']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--447d3c3f-58e3-456b-a399-f838a17419cf", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.201.216.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6573b3c-7602-4cc4-8dbe-6b30bde72ca3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.205.42.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baeb50ce-3e95-45eb-8ff1-567882a30f9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.205.42.15']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c97df6c4-993f-468b-89dd-db27debfab95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.207.245.201']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef75b245-7cdb-4c5c-924f-1bad2dbbcd1c", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.215.146.138']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07fa0516-d047-4b38-a590-cc6c96bd02d2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.218.245.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc871691-523f-4236-8854-35b65d920881", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.224.92.147']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c855ffad-2219-4b75-8b21-7769596e14a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abe6bc15-eaf1-461c-b4e3-838506c87528", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10bb5b25-2dc9-4470-aa34-e0425e558a68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8a20b9f-a2bd-4577-b546-1d98c56905ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d9705aa-0f38-4780-a821-d574b9abc49d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.202']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01b5eba4-3dd7-441c-bbe5-c395436e6c09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.204']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a1a9444-f79b-45d4-9db8-48ec8aed29db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.226']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ca99571-54e4-497a-8d9d-5db7278c3103", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.241']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57e6fb41-379c-46e5-87ea-5e8a484c34e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb3868e5-142c-46b3-9979-5979768ad99e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.246']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0fc486b-26d0-4f1c-91d1-2605ef2c6113", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.34']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfe8710e-881a-4d94-9dbb-9f04cda955cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.152']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbe387ae-be31-4550-865e-0258e6fefee0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.153']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f52831c-0848-4dec-8d9d-a16cf4f9b56f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eef4727-a509-4870-8434-b874a9f2272b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fadaa391-7f3f-4593-984e-720962503c40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.159']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df5f0431-da93-4d0e-a593-9fbf12d9a4a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.178']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e890106c-148d-439f-834e-96a6029ac0c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.184']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27a5ad67-5c0b-48ab-a21f-e63285807c31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0342153-9874-4d6d-9df2-ce1e4c6272bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.218']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2a86654-49e2-4cb8-a439-f3f96e304131", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce47fec9-f2ae-41c0-ad7b-5253383395ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.253']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8e6b208-6a98-47fd-8aed-65818c2c930b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.254']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb95993b-d339-46d8-b5bc-ece7847b1d75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.42']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e966f139-46b0-460c-b7df-647724aa6472", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.41.216.67']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65268c8b-c44d-4a61-91da-d475fa004707", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.240.214']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07b2391d-a74f-4b77-82bb-591636c1bb72", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.42.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb44eade-96c8-4885-a00b-107bae9a7ddb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.98.83.83']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d4b5cbe-3515-4174-9a18-439f7265db43", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.99.137.123']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--758ae638-f7da-4d43-96da-2b872ba3cb53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.182.93']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2863751f-8f2f-45b7-9b7b-642807fb0e98", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f03f455b-b2b0-4099-8acb-5d90c4cc77b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.74']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce47bcd8-d031-45a5-bb0c-695fc31481db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.119.63.94']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44fe4509-e7ea-479a-b09c-4440e8b04aba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.130.83.61']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--617e1114-9636-42cb-99d8-c0c15c3fda5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.154.95.236']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71e433a4-c844-44ae-9aa7-86105556a7b6", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.19.98.136']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c34f200a-d57d-46ff-859d-898a5975870c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.205.183.29']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--247586ad-b17e-41e0-8631-484ff671bb04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.205.232.88']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2df9bdc5-7986-4bd9-b20d-da15cb74838e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.205.57.72']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--253c48fb-9511-4016-9784-5b198d314639", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.207.4.157']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18958c05-b1de-48c9-8f51-886f1add0dc8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.27.101.99']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3be75c45-35c6-4026-9555-c735c014752e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.53.13.237']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74c2f239-ac3a-49df-8743-c944bc9df990", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.22']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc6cfd24-9120-434b-88a2-d39d1b34bb17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.5']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dd184fb-3996-4415-ad9f-ff278290167a", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.112.144.219']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fea46a7c-76cb-4b5d-91d7-bfaa29fe2739", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.112.192.104']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c99c7146-4227-4a97-9f89-42522d9485df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.109.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d08e300d-6f55-49fb-a6af-0d6efeb0217c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.72.166']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2db3365-d49e-4839-afc2-c7c7d858c20a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.170.189.187']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--438a0995-79bb-40a7-9bdd-10e454b073d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.174.93.12']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4499dd79-1d0b-475a-a6f6-d88f8c9d0db9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.174.95.106']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b786112-fb14-4312-a997-8cd83f6eec46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.175.44.44']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5875dd3c-2b12-4ec8-8849-07496d766051", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.37.212.141']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f89274d-97c8-4246-97b3-8c8a19ee2901", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.91.196.243']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be5c412c-b85b-4be2-8b9f-b4ae34ce2ff0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.102.49.193']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06c1caf5-8070-4976-b1b3-fcb7786c7807", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.178.213.248']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--441813c0-2eee-4086-a364-f6154c9c1235", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.10']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a4bcd4d-d72a-444b-982c-ba346a2fa226", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.250']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7ff34d2-7a94-4988-a115-d15990ccfbdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.26.106.30']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e97da60b-50d1-4bd6-82b9-06ecb1c7e102", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.104.121.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7053df0-7571-40b0-8e45-a80ef21524d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.130.170.146']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cbf5e90-52ff-4b64-a8e0-c07fa2b1dd54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.140.158.170']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c66ac3d5-0967-4d36-80ab-84c7c1040683", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.152.62.156']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b059f89-35db-4ae3-a818-fe13abf391d8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.159.59.35']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae1da7bc-980b-441d-ab25-e79806aac49f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.163.84.18']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ee9da86-406b-49ce-86c9-7190e4fc5e1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.181.236.142']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--724b9455-f564-4f72-88a8-b4ddeeb66758", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.214.52.233']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84229662-8741-4dc7-ac4a-6fa8df2761b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.215.0.144']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12dea424-00fa-406a-b834-3450cb9f7350", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.215.108.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--403d8ffe-7ed1-42fd-ac5a-3dde2cdf1cc0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.250.241.71']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f457f20-a6e5-4e0a-9e43-18b15a6f7577", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.58.255.251']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d690d4c-1540-4bb0-9af1-270304ca6b43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.66.145.154']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7e3ac7a-aa99-4631-a11c-f3fddeec9d86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.93.23.175']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26da69f1-fbe3-43a6-888b-5a56f880eafa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.126.98.168']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa7fef24-63d9-41ee-8e4b-7c40c9926c7c", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.127.153.174']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8946e5c1-e71d-4747-bf85-3cfe54e3d687", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.245.101.109']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edcd0e2f-114c-4762-bed2-7e77ef76471b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.107.133.213']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44b5b3b3-bd4c-4600-b8a6-99b90a48e524", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.107.141.150']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8b1dbe1-3d18-4a47-a434-063eb005e018", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.115.50.194']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be31c058-6fc7-4eff-9c0b-1d9bd7dbe66c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.22.234.140']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--843c4341-8886-4ee8-baf7-f2e171557c44", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.70.28.4']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df7818c4-3596-444b-a265-f8c67d02fa43", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.70.57.151']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5866c73-ac45-4957-9d24-a1051c08fa17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.81.162.40']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e0e46d5-2457-4b12-83ac-29ec0ba62590", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.81.205.36']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd0334ba-698b-40a8-b7cb-def9d2418cbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.81.221.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe11a9db-34b8-42fd-ae5a-e5fc825e2805", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.89.3.242']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bb792e4-e89d-4d35-8640-5885544bcf8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.94.27.155']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d913575-0177-4cfe-92af-6b104b451cae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.94.39.8']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaaae791-423b-4ce8-b77b-133b7264119b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '99.92.204.98']", "pattern_type": "stix", "valid_from": "2026-05-24T00:00:00.000Z", "valid_until": "2026-06-23T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-24-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2109cc18-d01b-4dce-8b0e-ed07bf887c30", "sighting_of_ref": "indicator--fd1d81dc-b04a-4116-a458-28c0c88ec0bc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7587b498-43bd-4227-a2a6-1540d55d43db", "sighting_of_ref": "indicator--1a668263-6430-4ef3-96ed-fdc92474b02f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffcd1d62-d9d4-4a2f-a907-beb8284d6711", "sighting_of_ref": "indicator--dcc099ef-8b77-4b9c-a7be-c308d1a50a44", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f367d1f7-6428-4666-ab4a-b58c994c7c00", "sighting_of_ref": "indicator--2949edc1-a59d-47af-b293-0b88314fb303", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--780ea05c-7975-4268-8463-0411c76d9cb4", "sighting_of_ref": "indicator--96e193c7-b63a-4dfa-8546-5f26ea9ac232", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bf5e543-9a16-40ad-ad8a-d24e4e32b068", "sighting_of_ref": "indicator--6f6df09d-6153-42e8-b87b-fecd3dd1737a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31e6a813-5ce6-41fa-ba6d-4bfa50cd3021", "sighting_of_ref": "indicator--6f6df09d-6153-42e8-b87b-fecd3dd1737a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0b021c1-0e7b-4914-916e-f97b68b4c88e", "sighting_of_ref": "indicator--1c9be048-3ad3-4672-8808-2300fd4d9aba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faed34bb-230b-458b-84a1-308e3ebaa469", "sighting_of_ref": "indicator--601445fd-5141-4c91-a096-a837b0b84745", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee256b66-41e8-4c47-aa1c-2dad49447da3", "sighting_of_ref": "indicator--c17242e3-3721-4b0a-8c8c-ca8438d40123", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dd676ba-ba11-477f-a15c-a6f3d481f414", "sighting_of_ref": "indicator--ff2ddbae-d0e6-4290-b31d-fe0a8743ae12", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85ff6943-e302-4569-bd03-3964d28cea55", "sighting_of_ref": "indicator--40f03bd1-69b0-4ad2-9a6d-63eeaf837b16", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bb26c3f-8fc8-426b-b05b-51346370dcca", "sighting_of_ref": "indicator--0fc6b229-92ba-41ad-ab46-6d8264027816", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ae2cb69-d807-4bc2-b585-ed627788f175", "sighting_of_ref": "indicator--03a3d38b-38a2-4240-a057-188be2ddece6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a67cce1-6d55-433c-a43a-2e4bb08a3166", "sighting_of_ref": "indicator--eb7b22f0-61e8-4276-a5cf-d072e33dd701", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31b6f609-848d-4447-9282-d8ed4cd295ec", "sighting_of_ref": "indicator--3a0865b4-6334-489b-b75e-1311639d0ab5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c9bfcca-8809-42e2-a116-d1bf0f0486ca", "sighting_of_ref": "indicator--fe42ac7a-1940-42bf-9255-86a978c75f1c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--056926b7-d8d5-4df0-b60f-779c0b7e75fc", "sighting_of_ref": "indicator--de12f650-db02-4a48-b988-9d4685fe0bbc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd1b0a99-44c9-4772-9641-071b1be717d1", "sighting_of_ref": "indicator--673af9a6-2786-4dc8-82a0-85ac05d0fd8f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea9e63c6-1d4d-4504-a18b-7e2ea3b09232", "sighting_of_ref": "indicator--035a529c-9cac-45d3-b0c6-6ef9467964bd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b6178de-bd5d-4a48-8a60-0e7149676331", "sighting_of_ref": "indicator--0a1f1e45-2fa8-4c2d-94b0-641f47482a96", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8e39421-c3fd-40ff-992f-3500a1c37529", "sighting_of_ref": "indicator--77307512-f6d5-4241-9aaf-1a70111b35b4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86b2dabc-89c7-4d65-8906-514651bdce16", "sighting_of_ref": "indicator--0a987ca0-8be9-4943-9568-3824cce3c1f1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d18871a-9387-4a69-986c-ad5371bf8e0c", "sighting_of_ref": "indicator--c6a262c4-97c2-4537-bb6c-1aadfafd2a55", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59e680e7-b80e-4d7e-874a-65f93bf6c404", "sighting_of_ref": "indicator--6e4d7d45-99b0-4c64-b50f-6f26c4d968de", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd51656a-e8bc-40fd-9c1a-0f4c11a4580e", "sighting_of_ref": "indicator--71d21fc6-97eb-4d75-9c3d-749de1d9d7ba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7afdc25d-f03a-4b71-921b-a27678886581", "sighting_of_ref": "indicator--c8e642dc-0868-45b2-be4e-1b9a92bec321", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef134d25-d0d0-44d6-9d2c-a84da40bb001", "sighting_of_ref": "indicator--9eaf1021-0dae-41f8-b4fa-88f139f07df0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea8af6e9-c2a7-46ee-bccd-f230b040979d", "sighting_of_ref": "indicator--2578127e-8215-4c02-b710-d1a8e9bafcae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9782d4b8-03d1-4caa-b153-47f8df6dc229", "sighting_of_ref": "indicator--e28a2651-a783-42dd-88c0-7b9854e8e2f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aab5d284-b8af-4602-ad5c-5dd2070f2bb3", "sighting_of_ref": "indicator--22a77a61-d860-4030-bff6-7586dc2ad930", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac614d13-9a83-44e9-ad10-604f61b6b055", "sighting_of_ref": "indicator--e74d319b-64ad-4d66-8252-604794ef0eac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9b4397c-c4fc-4479-af28-99e0fb25da4e", "sighting_of_ref": "indicator--d64a7be0-7708-46b0-9b0f-a200ab3dc5cd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8217412-ca3a-432a-b48b-3f933deb47ae", "sighting_of_ref": "indicator--423d36e0-6222-42b0-9b42-7353683f6a5e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2ab616a-8414-426a-a15c-931a0175e82a", "sighting_of_ref": "indicator--03760a35-e850-45de-bf72-08b457c64e6d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff74e563-106c-4389-99a8-12de4aab782a", "sighting_of_ref": "indicator--26e24bac-8f1f-4310-82f6-d7d4f9b9b8b3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c0da8c3-01f8-40f9-9ab0-adaf999aca3f", "sighting_of_ref": "indicator--5c588ed4-a97c-4e62-aa79-f67b70b65888", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15329694-383b-4053-9ae3-755b34788612", "sighting_of_ref": "indicator--18e58771-8d82-48bc-8651-cb9d6f76d785", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be3f08d0-edd5-4be1-85ad-b699266d45fa", "sighting_of_ref": "indicator--47b94e2c-97c9-4613-a385-8bef1e2fb857", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faa7f0a9-bba0-44d2-87ad-91ccbfe6f04d", "sighting_of_ref": "indicator--a23590a2-aee4-47f2-a0cf-0acd737d8020", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b7d9ea6-b4f1-4243-a5c1-53df843d8628", "sighting_of_ref": "indicator--deb1f0cb-2c7c-46d9-92bd-15970e841678", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba97d899-9a00-4f0c-b96b-44e1b12fbdad", "sighting_of_ref": "indicator--bd2372a6-70fe-410c-9383-d6ee8d385465", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab82034b-a854-4627-99c8-a5b2f01d1ae6", "sighting_of_ref": "indicator--a5662590-e172-4f6b-91f8-9d445777cf09", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8f17cb6-d355-4d23-8b2b-2aed8a501d37", "sighting_of_ref": "indicator--a5662590-e172-4f6b-91f8-9d445777cf09", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73ee75e2-edaa-451a-9c2f-5c6a9d0bf46d", "sighting_of_ref": "indicator--9d04e17b-1686-4b19-a9a9-08f64db752dc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6a5b5f6-e112-41db-8421-203dde98873f", "sighting_of_ref": "indicator--9d04e17b-1686-4b19-a9a9-08f64db752dc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a127d2d-5ebe-4d9c-af34-24052b2147c0", "sighting_of_ref": "indicator--81e8315e-49b2-48cd-ad83-4fe2a315bb57", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a1b89ee-a44a-47e0-b9e5-c8c64f92b65e", "sighting_of_ref": "indicator--c15f0fe0-20ac-4d92-a8e3-a7d518a2acbe", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--541891b6-aa50-46c0-8b0f-347e76e246f8", "sighting_of_ref": "indicator--cff97bf3-ca52-471d-b12d-829c9a4983ec", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a827d2f7-8b96-4653-9070-cb2348326e38", "sighting_of_ref": "indicator--7d961493-8aec-40a0-9ccd-5173eedc7aec", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffa952cf-2a2c-43d6-a40b-5d6ad566a706", "sighting_of_ref": "indicator--91de531d-deba-4b4e-bbdd-e8218bd519ee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2abd26f7-2c85-4420-a98c-8ab923df1860", "sighting_of_ref": "indicator--930b5405-148d-4b37-b601-225b7bb0c069", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec85d0ae-3d58-47e6-a783-cdb24424f83d", "sighting_of_ref": "indicator--930b5405-148d-4b37-b601-225b7bb0c069", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--915f4656-b40b-48c5-a7d3-7c788d1d5246", "sighting_of_ref": "indicator--4c54f0b0-46b4-4022-9f68-66cf1d4bbde3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73c1eec6-b630-44fc-9e95-cfbdae3bc26e", "sighting_of_ref": "indicator--f68e7c6c-5852-4219-b795-c0fad57a5532", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--245e4056-4718-4176-91ad-83bc06839476", "sighting_of_ref": "indicator--c2ba24af-0752-4f97-a4b5-955c74a0eb8d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8e5cddd-1ae4-40c1-9ddf-40f51f8790ed", "sighting_of_ref": "indicator--9fda8889-b2c1-484a-bbea-a7a536c93131", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--647b2a08-7f6e-4747-a882-9f45b70ca3f2", "sighting_of_ref": "indicator--9fda8889-b2c1-484a-bbea-a7a536c93131", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed1c1d16-c12f-4451-ba9a-c5a79a876e8a", "sighting_of_ref": "indicator--763e3939-addc-4ffb-b119-4d17a9c58f6e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18f014c4-211d-4bad-95cb-26db25277dc6", "sighting_of_ref": "indicator--763e3939-addc-4ffb-b119-4d17a9c58f6e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e214f3ff-af29-4219-8c5d-5e2a46db599e", "sighting_of_ref": "indicator--9ac80931-cc99-4f7e-a43e-acd3d08eeb39", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ede4892-b722-4a21-949b-4998c0aac71e", "sighting_of_ref": "indicator--d7c5639f-5b09-4475-a3e2-b6e570280b49", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--493b6aa0-c648-43fb-98e4-902de0cb2dd2", "sighting_of_ref": "indicator--29b9f82b-7a28-4585-b551-b457821c4d38", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2d987e9-7e83-4011-9f9f-0f55d28b4219", "sighting_of_ref": "indicator--29b9f82b-7a28-4585-b551-b457821c4d38", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41498b0f-5353-4c8d-bd5d-615dede60f4b", "sighting_of_ref": "indicator--8ea0e5e5-1da0-417e-8fa3-2ddbba9a413f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--101bf47a-ab04-4858-80a3-16f82d3d25bb", "sighting_of_ref": "indicator--8ea0e5e5-1da0-417e-8fa3-2ddbba9a413f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45d5d046-05f6-44e9-a8cd-de97b0f2ed01", "sighting_of_ref": "indicator--42e674f3-9770-4fd7-a58b-6ed997b5aac3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--371a6ffb-06d9-4fd3-92a0-8b5f09383124", "sighting_of_ref": "indicator--6cae7ff2-1ec2-4396-841b-3b5ff13532bd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a53ec530-ea74-4585-a131-00b44303af0d", "sighting_of_ref": "indicator--79adc963-772a-4f9f-bf77-00ff02f6a7a2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ff3fba7-bbf5-4130-a4e5-3b35b51e95fa", "sighting_of_ref": "indicator--665a7781-3708-41f6-a34e-0230e5de9bb3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb658d68-6696-43dd-847d-36b3549ac9cf", "sighting_of_ref": "indicator--665a7781-3708-41f6-a34e-0230e5de9bb3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b77d2f7-d1e3-4913-8ea4-e649d1488146", "sighting_of_ref": "indicator--73c0302f-c634-4f3f-a5f6-d9be3cff77f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61f55656-1875-46b8-b3f6-d40365254716", "sighting_of_ref": "indicator--d8c4b1fa-14cf-4d23-9c54-9945ffa78a7a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2abf0599-90b5-446c-8fea-ef52148177bc", "sighting_of_ref": "indicator--da63f796-62e6-4dfe-8b1a-3213be686ec3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b690575-4087-4622-97ec-948327f68974", "sighting_of_ref": "indicator--da63f796-62e6-4dfe-8b1a-3213be686ec3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d799509-6df6-49cf-9f57-2a6e2c1f4ad0", "sighting_of_ref": "indicator--84e435af-9bc1-46e0-bc6a-5157a791b1f5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a62e1098-4997-4e6c-afbb-fa4eb9a39fa2", "sighting_of_ref": "indicator--5206525d-5519-4467-9075-f27442c68232", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bad0031a-0bb3-43d6-8f65-b9ccac6cd7f4", "sighting_of_ref": "indicator--8da1cf30-1b3e-473a-995a-fc56bddc5286", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dffe31b-121b-4315-a635-6542d2f7567d", "sighting_of_ref": "indicator--99bfc58f-f594-489c-a678-8c6c6480898d", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64ff8c56-caf1-439c-b7d7-9ba4b2a67130", "sighting_of_ref": "indicator--060ab6e5-8edf-48ca-9b24-d3bba6d376a9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a4a6306-6a9f-4e75-9683-c2269775be26", "sighting_of_ref": "indicator--8b36b6a1-23f0-43cf-9766-77a46ddfcc69", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f24a98bb-281a-43e0-baed-4f0509367ae9", "sighting_of_ref": "indicator--8b36b6a1-23f0-43cf-9766-77a46ddfcc69", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93f4a399-016c-4ef0-a1b2-50cc1d5da5d7", "sighting_of_ref": "indicator--e4d99c5a-5779-48ce-91ce-c93c75ba00b8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edf61462-1c00-4098-b2b1-e8e66cbe47ac", "sighting_of_ref": "indicator--ff9c97a0-0e3f-44c4-831d-3e26b3ffe209", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28982b08-56c7-4af4-86cc-2046a62811ee", "sighting_of_ref": "indicator--ff663a53-1890-475f-b3c6-4dcc68dd5a6e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8891a73c-545a-4a40-ba7f-8f546746d768", "sighting_of_ref": "indicator--47e35ad9-ae09-4c77-be17-66b4e4d3aac1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b502cced-2357-4a62-b89a-096caed134f4", "sighting_of_ref": "indicator--6a0596f5-5ddb-40aa-ac2d-3a6941353416", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f633b69-0eeb-45e7-b8e3-4a85a3c649be", "sighting_of_ref": "indicator--447eb5ca-9ee7-4f1e-a65e-5ffb39224846", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a82322d6-51d3-4789-8db7-8599aa75deea", "sighting_of_ref": "indicator--74429804-bbfb-45b6-b4e5-5ce3e5f48771", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f1934f2-f26c-4104-8ca9-f490d211c565", "sighting_of_ref": "indicator--9e341d10-ad21-4ec6-8688-41d7897eb4dc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d3ae6a0-faed-40cc-94da-d1d5617d0b6d", "sighting_of_ref": "indicator--f5c7176a-23db-4a63-a59c-e4b3ce9ca2e3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48e1b8cb-9b45-4403-ae94-f90f12cfef8d", "sighting_of_ref": "indicator--352e0be3-a0e6-4ce9-9ec1-734d7a808b8d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e01af1c5-d096-41b4-9284-f962cee00844", "sighting_of_ref": "indicator--5ca90fc8-c06c-484b-b18e-21808cab9bd6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e6ec86e-58ce-4c72-8f2c-503413dbd633", "sighting_of_ref": "indicator--e11d721d-a3fb-4fce-86d5-59a05208f00f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32c5b953-4919-4709-b494-a3e5e743ff78", "sighting_of_ref": "indicator--3b2da704-e88f-4d4f-9fbe-e2cf1bc36ef4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f735b5c-af17-4385-937d-23ecdca7c46c", "sighting_of_ref": "indicator--64853283-e49a-4f9c-b32b-9b498241a6b9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71c9271d-1439-4b2c-8af5-ffca92ca4cac", "sighting_of_ref": "indicator--28a81b1c-6dd8-468f-a1e7-936087f0ebbb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6119c30a-9d51-40dc-b52e-505327879e72", "sighting_of_ref": "indicator--12ec7ecf-9d3a-44e1-8f7d-279b7596599e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--364889c5-a0b5-41bf-856d-72cff3d0deb1", "sighting_of_ref": "indicator--ea2bf0fa-7c25-45b3-ba18-b432fedd6929", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e2066df-cfa8-476d-a44d-c341e798256e", "sighting_of_ref": "indicator--a46a43a9-bd97-48a7-b5cc-ec711dd1dfb6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee5e0a22-8d7d-4052-9f2a-e1f9eabe3471", "sighting_of_ref": "indicator--acdaed5a-12e9-4cca-829c-7ef87308e248", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e45fdf6a-4c78-46dc-86ce-5bbb38ef629f", "sighting_of_ref": "indicator--1002b6c2-50f4-41c9-8472-84971abd4bd0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7587c03-d7d6-4791-938b-62b24462a6b6", "sighting_of_ref": "indicator--0af69f67-b3bd-4987-9394-c747eef611e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d04e52b-3ed4-46c0-95b6-9f22c54c2c1f", "sighting_of_ref": "indicator--909aa7cf-3dc1-4719-9763-cc0aaccb83ab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e05bc1d4-bdbb-4367-8dad-64223969e66b", "sighting_of_ref": "indicator--7e268074-ee09-4edb-9a63-b03d51f23d7c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67666308-fb58-4dae-8659-1c600a2b0e25", "sighting_of_ref": "indicator--762a50fe-4701-4e47-866a-0869c7d0d740", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0f508e0-0d68-4797-be70-ca3cd0cb952b", "sighting_of_ref": "indicator--75642237-ac3a-4846-a99d-ddd9b68e414e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef8c0f4e-b445-40f9-ae89-de2d3c2c3263", "sighting_of_ref": "indicator--51bef104-1634-4095-9ba2-e3893d5b8c96", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b4721af-5211-4802-a97e-e64a6f7fb109", "sighting_of_ref": "indicator--f21c6465-384c-4d1e-b4b4-4149263ffc0f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25d28805-adfb-4d58-b032-5e425c82232b", "sighting_of_ref": "indicator--820ecd18-ef94-4214-ab26-6e9af5455b57", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bf77d0e-bd0d-4120-a894-1d41b106f40a", "sighting_of_ref": "indicator--f1b461c0-63a0-4a58-81ca-45cf19fada05", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--760c4e6c-8bd6-477a-b9f7-e779936efdbb", "sighting_of_ref": "indicator--dce25de5-46db-4663-8875-68266f775eda", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f48b83a-a169-4b0b-b081-7ad64d2d1b35", "sighting_of_ref": "indicator--de305e26-1cb4-449c-99cc-7cc4a42acb74", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b106674-1b8b-4669-8bc8-f9f412024582", "sighting_of_ref": "indicator--49a43ed5-f345-4e66-8252-0e39fc1b8d82", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d237f5a-781f-4c1f-89c4-b844cf72c2cb", "sighting_of_ref": "indicator--49a43ed5-f345-4e66-8252-0e39fc1b8d82", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4feb05d9-9b99-4a8b-a172-997642da89f3", "sighting_of_ref": "indicator--e962cf7d-60c7-48e6-af4b-2f77da14b910", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d489f2b-8803-43c9-8528-0bbfd6a07ba0", "sighting_of_ref": "indicator--42375d65-faa7-434e-aa22-30e9722ec1e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57938d16-94f0-4e6e-8d5d-3d888ec1ceed", "sighting_of_ref": "indicator--1cd6387e-59cf-4337-b774-064292dd6cf1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b119b218-4ec6-4425-9044-45dc0b7283e7", "sighting_of_ref": "indicator--8a686fef-f136-4728-befc-3bb02339d6fb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5bb0fd6-31d4-4789-a827-d6072a1698a6", "sighting_of_ref": "indicator--8c4e01c0-91e3-40a7-b24e-bd28948a6ebe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36cb702d-9fe6-48b7-a0b2-9cb04ff74be8", "sighting_of_ref": "indicator--9f60c446-5e20-4e9f-8d7f-d0c726157e3a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61317fb7-194b-4f67-86b2-6f79955740c8", "sighting_of_ref": "indicator--9f400370-f194-4310-8c3b-d3bcd67720bd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f1ce36e-0f14-497f-ae43-73a7dc26c06e", "sighting_of_ref": "indicator--ad298266-addc-4fce-ab1d-9b69dbc5b136", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d48942ff-fbd0-441e-824d-3fb9c1bbb28f", "sighting_of_ref": "indicator--81795fd5-62d4-477f-9763-4a1d2c3e5c55", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4d0354d-4afb-42e2-abb0-508760204415", "sighting_of_ref": "indicator--39dd25cd-9723-4044-8c5e-2c856e88456f", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0c686ba-2b70-4e34-99ab-c701f3005582", "sighting_of_ref": "indicator--0b9c2031-9990-48dd-ba07-5728a7281383", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e920792-2052-4cbb-9639-387c5eae60f5", "sighting_of_ref": "indicator--0b9c2031-9990-48dd-ba07-5728a7281383", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cfad255-4b41-48cf-9393-7db084f016c8", "sighting_of_ref": "indicator--2afffd9c-dce0-4c0a-bbeb-14ded431fb1c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fbb993a-b87e-416b-9b1f-87880444158b", "sighting_of_ref": "indicator--e5230633-3828-4348-9230-637074fcf99a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11c0745b-4462-4a2e-96a5-8049d729916d", "sighting_of_ref": "indicator--46e52017-e87b-446d-9d7b-12a8c610b66a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f831631c-0d85-4480-bd67-9510cb7ba19c", "sighting_of_ref": "indicator--6fb196ea-1b1f-46bb-97cc-b0282053945f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a03632a8-f6b8-409a-b6f8-28c3224149a3", "sighting_of_ref": "indicator--748b3ea1-8417-4458-9283-cd7cdecec765", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3fc1c5e-4d39-4756-818a-2071560c0f10", "sighting_of_ref": "indicator--748b3ea1-8417-4458-9283-cd7cdecec765", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7df56f6f-9d1a-402e-a357-09bc614327ca", "sighting_of_ref": "indicator--ece0927a-b04c-46c8-a8af-6392776da05b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a5b53e7-ea8a-460e-9cf9-841b85c6d19d", "sighting_of_ref": "indicator--6c88dc95-dfa7-40b4-bd46-73ab116d6c2f", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f17a94c1-a097-4dae-8fe0-f2c095ef3ee5", "sighting_of_ref": "indicator--e3a91950-d536-4cdd-abb5-a09c32ce755d", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4442a143-08e3-40f3-b8e3-65a712f2f70a", "sighting_of_ref": "indicator--c5417281-4213-498c-b03a-8c82e27b6ed8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8008121e-1592-43b8-8414-41a7f99b867f", "sighting_of_ref": "indicator--19b53619-463f-453e-a9bd-a79ff65bd989", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbd1ddf1-6819-4d90-b719-e0ae91a50ef4", "sighting_of_ref": "indicator--72fb2ece-b5aa-4d00-b2c1-e42d7f92063c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a19b04e4-82ca-43ea-b299-f61358b746b5", "sighting_of_ref": "indicator--55a4bef1-a81c-4969-87d9-c70eba9babd6", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47e6cde6-bfde-4d40-a955-c56301d4d5e3", "sighting_of_ref": "indicator--bfe62f3e-f1a2-448a-87a4-1e05b80860f4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3150d784-dd07-4343-bbcb-17effc732d6d", "sighting_of_ref": "indicator--767bc6ee-8476-4a1e-bca6-66535fe6e220", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d86b5821-e118-4497-a8ec-10b9935a25e4", "sighting_of_ref": "indicator--3c9a6e5d-1b8b-4721-9657-17eab7ac55c0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63321603-ff15-4995-85c0-6d55b6bc0af0", "sighting_of_ref": "indicator--18b552d0-8d2d-4a10-8d1c-342c9cff4403", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1098525-f2a5-484e-955d-9824d5c02dab", "sighting_of_ref": "indicator--3300a66f-8424-4992-8847-3f80374fbd40", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4ccb026-bfd3-4ec5-b421-480a968a8e73", "sighting_of_ref": "indicator--fbe279b6-1362-4c53-b830-87ee126f14a9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63ac443d-657e-4e8e-be11-67be2375f4c1", "sighting_of_ref": "indicator--8204f04b-2c21-4599-8bdc-b68732cbb3c0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b1411e0-5ffe-48b5-b489-c29919b86089", "sighting_of_ref": "indicator--52b42a84-e7b8-4d4d-9efb-d8be2d7b1cf2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b1775fe-c015-4519-a7cf-c6b32a27691e", "sighting_of_ref": "indicator--22c4bab8-101c-459c-abdd-e3485dc887be", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b52e418-5659-4490-919b-8e3cfac667c1", "sighting_of_ref": "indicator--5fda7c9f-2dcf-44d0-bfd6-6ef667f5c447", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6572818b-b40b-4800-a6e1-1bd0ef50be9b", "sighting_of_ref": "indicator--d62e0a42-4a3c-429a-b113-ab7bd625b7b3", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cfdb15f-9761-4a5e-90a4-4bc1680096b7", "sighting_of_ref": "indicator--188e66e2-e431-448e-9cc3-d5d8ba9d3e35", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e5dce90-1a68-4033-8cdb-6b161fc8e38a", "sighting_of_ref": "indicator--188e66e2-e431-448e-9cc3-d5d8ba9d3e35", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b6245cd-c4aa-48cc-b3af-84e784efd9b5", "sighting_of_ref": "indicator--51994511-e14c-4a66-83a5-72c8474bbfa9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46d51437-ec1c-4561-8232-83269f088fad", "sighting_of_ref": "indicator--ac33d884-fba3-422b-9753-781edf7a7251", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea81e6b2-a48c-4dd0-9b97-e1fbf2b808be", "sighting_of_ref": "indicator--ac33d884-fba3-422b-9753-781edf7a7251", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c8def14-81c4-4226-babe-0c583f2a39b2", "sighting_of_ref": "indicator--cf9ad39a-2088-47bc-ab2f-bf3d52dfdb0d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fa393b1-ca49-465a-8a67-1748a62ec783", "sighting_of_ref": "indicator--68d33f3e-1e87-4f1e-add9-7000324a3b26", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33192e86-1a66-4cef-b9b1-c78b801a5faf", "sighting_of_ref": "indicator--4371e7ea-6a95-49f9-ad56-b24266dd10f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db171eff-95d5-463b-a362-ef95b0ffc6b3", "sighting_of_ref": "indicator--418306d9-7ed1-4a78-8679-00d314839b97", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--190077da-3570-45d6-8b6c-1bb873450197", "sighting_of_ref": "indicator--eb554435-991e-4e04-936f-a1527f218c6a", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ff478f6-8238-4f00-a9ff-808560bd094a", "sighting_of_ref": "indicator--eb554435-991e-4e04-936f-a1527f218c6a", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd3a85c5-c391-44dd-9cbd-7eab3ba0ff03", "sighting_of_ref": "indicator--8ced1407-8cf9-45f2-bcba-5bb7182aa7cd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71a3a2b7-ea17-4f91-b8a4-376d94d7913f", "sighting_of_ref": "indicator--75868b4b-b4ec-48d0-80d3-fc355f7adca5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66bf2042-fea0-4a85-9378-6c22ba672334", "sighting_of_ref": "indicator--75868b4b-b4ec-48d0-80d3-fc355f7adca5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12ab8103-4dec-4895-91fe-20d9e84c862a", "sighting_of_ref": "indicator--0b89799c-70ef-4f9c-b164-76fbd09b4515", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec453895-40d4-4a2f-b8fa-a55dbadffd7b", "sighting_of_ref": "indicator--a58b5637-e88b-443d-b09b-cb64d6427cb3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--307bdc96-41dc-4d91-9391-fac6b684c0e3", "sighting_of_ref": "indicator--33f50308-625b-4cb6-9e5f-6027030a05c8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fbcc695-f272-4bce-84a4-28054ed05267", "sighting_of_ref": "indicator--bf81f9a3-91cd-444b-819b-ffba67748e91", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7969bc31-8644-4f7f-89e1-f8363a4a2659", "sighting_of_ref": "indicator--9fb20120-b51a-4431-9747-62a510fe6113", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d2c6cb3-3597-42bb-bac5-fa820dc2764b", "sighting_of_ref": "indicator--31dfa805-6ade-4bdb-a2a3-5ff751768425", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3deef8c-30a9-4b1f-9a5c-6ef07d7bdaac", "sighting_of_ref": "indicator--ee607c13-1e67-4ebc-9365-96abaf8d0d67", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1fc44a1-6163-4157-99d9-1ed139a69a9d", "sighting_of_ref": "indicator--aa6b9f17-46f4-4273-a5de-14438948d3cd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--102c93fd-1639-4ff4-9a71-00cd490ae6ea", "sighting_of_ref": "indicator--34104727-8fa0-4391-8567-178cde71cd06", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0ec61de-180b-4117-960d-f7ac79f6241b", "sighting_of_ref": "indicator--de896bec-62db-494a-a531-2ff2ea724234", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b58494a5-a04b-46d3-9bc3-17b9a3c0a60a", "sighting_of_ref": "indicator--cc31bac8-b083-449b-bacd-2023a87ff365", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ed480a9-98ca-4977-8170-17861f57f868", "sighting_of_ref": "indicator--fe874526-20e2-4849-9246-c86e986a580d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52aa9c5f-a203-4eac-9b71-b82ea6304ce6", "sighting_of_ref": "indicator--d71c6bf4-6e98-4f15-99e9-49579c0d6a39", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b496fc9-2407-45ed-ba84-63b3dc6548f3", "sighting_of_ref": "indicator--ab7e4377-51fe-487e-8cd9-004a16edead9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88d13156-6055-426c-8122-78d891836a3f", "sighting_of_ref": "indicator--dbd2fe01-473c-4f8e-b3c3-14fba6102274", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01a547f1-dca3-434e-9f38-d48ef0ad4ad8", "sighting_of_ref": "indicator--28c9dcb3-e362-4a38-9ab2-55b3c1a4fa8d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c22d6802-5f5d-4ac8-8bc6-e6fe9cf534fa", "sighting_of_ref": "indicator--bcfc2481-abf4-495f-b887-cdc6bd1e0c74", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0727cc55-1e97-4f4d-bcb9-93cfa17cd6bd", "sighting_of_ref": "indicator--e06c5495-6f7b-4e77-b456-286653495079", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf8bbae3-ff24-4616-b902-88c8f4090f1e", "sighting_of_ref": "indicator--79e79db4-aeeb-4588-a041-6dd549fbd09e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c4835a3-3f87-45fe-b0f3-79df57e1c034", "sighting_of_ref": "indicator--90b90f29-ee48-4eff-9c9d-7d251645ca05", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4d9c2da-7191-4c7f-a5a8-a417143cc0e8", "sighting_of_ref": "indicator--56424f9f-5e30-4259-abb9-9db4fb35d3a1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a815b87-af81-43ef-a83e-7b8736946ea8", "sighting_of_ref": "indicator--5713d5d6-f784-407f-9d81-d77d5111396a", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbafeade-072c-46f1-9397-fc11a6de33c2", "sighting_of_ref": "indicator--07bc338d-50b5-466d-be0d-74369ebb221b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a3d52e1-1008-446b-92be-9f97331c25d8", "sighting_of_ref": "indicator--b147ac13-1950-4145-ab45-9dcacf7b9653", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81916aba-26b7-4c34-a0de-92348e53237e", "sighting_of_ref": "indicator--db1f1fdc-7092-421e-9bc9-58676c525089", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c799156-9f0d-4153-8c0c-4c8291d96db1", "sighting_of_ref": "indicator--ed374c49-2c47-4e5e-a379-0837277fd76a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--938f4d77-c2e0-4f19-b549-e7928ec24485", "sighting_of_ref": "indicator--b881dc56-4c85-4159-b609-6b926750862f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bde1b3bf-d3f2-4f08-878e-143c103a7044", "sighting_of_ref": "indicator--e3aaaa90-cc06-4385-a675-0f0511b8e210", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63ad647c-6b48-432e-a09c-21cda86f71e2", "sighting_of_ref": "indicator--1dc7456e-1c04-4192-8062-b1b0daf071ac", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3c4425e-7c35-4b63-91a4-44252e401f80", "sighting_of_ref": "indicator--f62d8d51-bcac-4773-81ef-7148123bc738", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a5c8740-39fd-4df1-89ee-cbe3d73abc52", "sighting_of_ref": "indicator--b25af515-cb24-45af-82ff-996a6e24b523", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f046203-fd7f-4071-9e41-341ba7d235e8", "sighting_of_ref": "indicator--4bf3c076-c543-4816-9d77-a84390321ac0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--335d43ba-2caf-4806-8636-9e75832961f5", "sighting_of_ref": "indicator--8455d48a-76ca-42a7-a7cd-60683be3c968", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2df3d86f-1318-4883-9585-5b3dc5d1302d", "sighting_of_ref": "indicator--c6bdcd8d-034d-4c0d-a91c-16e948c6b4ce", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2f46787-3fa5-4528-9121-98ebd6b673f6", "sighting_of_ref": "indicator--34b7a734-350b-4859-89cb-3ac66b1c9332", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee547697-f823-4dda-a16a-5479712723b0", "sighting_of_ref": "indicator--34b7a734-350b-4859-89cb-3ac66b1c9332", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c080e127-6daa-4454-a4e2-9e3dcff14717", "sighting_of_ref": "indicator--98f252b7-d011-4702-bf7c-24610158f8a1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dc36794-711d-4a5a-a9c2-86f97bc6784d", "sighting_of_ref": "indicator--9dffc0b2-63cf-4562-a369-466f928dd9b1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--946ce524-4e3d-404f-abe1-100f97d7f5b2", "sighting_of_ref": "indicator--720eacaa-5bf1-4058-a911-c422e47e37e8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d895ddee-352e-4997-bf5f-b2d9197b00bc", "sighting_of_ref": "indicator--f88172f8-6303-4ba4-a92d-b0e26fdf6006", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2372ff9-5dc0-449c-958c-d9530cb2ee6d", "sighting_of_ref": "indicator--7d7bb128-02b2-48d5-8f6d-a1968181c234", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c05bb58f-4479-4428-8c1e-9bba1e0ec0bd", "sighting_of_ref": "indicator--06b5b27d-6b96-430d-bb72-16d7fe7d1d82", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43d17108-a769-44a9-8f7e-7485171d1cd7", "sighting_of_ref": "indicator--ab23d87c-972d-4e2d-a913-ec0d0425f2b0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7b1cc96-a141-4b7c-a6bd-47a1783e6ee2", "sighting_of_ref": "indicator--38fa71f2-f066-47c8-ae6d-de4b5dca5d67", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6c83c6d-1836-4af4-80f8-f5b09e4cf558", "sighting_of_ref": "indicator--eba8b8ce-630f-4dc2-8890-d05622076405", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15a5eff0-f0b1-4176-be99-8040f8dbc65f", "sighting_of_ref": "indicator--50963d33-d47e-4034-8df3-f47d344f47b0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94742c83-8b54-46ce-927e-053743da30f7", "sighting_of_ref": "indicator--a3030405-0c43-4bfa-a3de-7236ccde3045", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--090df2ad-0512-4c87-83bf-cbb7589dc332", "sighting_of_ref": "indicator--a3030405-0c43-4bfa-a3de-7236ccde3045", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76d92a28-aef1-4285-b44f-ba6a453677cc", "sighting_of_ref": "indicator--4ae9da6a-d8e4-4524-a7bd-d60274f6cb94", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2907dc67-3e04-49df-a4b4-42de6997019d", "sighting_of_ref": "indicator--fee946f9-76c6-40bf-ba15-7193b88e632c", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--182fa38b-2e86-499b-9ff7-d157bb23ff26", "sighting_of_ref": "indicator--2ce2dd78-7c4d-4d6f-b829-dce79f81a145", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c312035-693b-48f4-b8f4-2ad682866df3", "sighting_of_ref": "indicator--5badfe29-de74-4606-ad47-38c7bba791ef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93d5f811-01c5-48ea-a470-d70753e63852", "sighting_of_ref": "indicator--185506fb-2b78-4e87-b3f7-2951da5ba073", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f650fe1-0232-4536-8583-dc8a786f48bc", "sighting_of_ref": "indicator--28139f96-748a-4f4c-a741-94141e95aa70", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c131966d-9930-4c06-a08c-08f5e6148677", "sighting_of_ref": "indicator--7605a26a-ebe2-42b3-bb66-8e4ee09c66c7", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--522a581a-fb54-4ed6-8206-8deff2a88e3f", "sighting_of_ref": "indicator--c685c716-e928-4d44-b2a0-49295ec68a78", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25753267-90c5-4841-9c78-32d26501b141", "sighting_of_ref": "indicator--52c7ea44-25d4-485a-9c5c-d31e21fb9b7f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8964f92f-6b75-4b91-8083-5a5c101b2243", "sighting_of_ref": "indicator--6f666891-a157-4794-98c0-aa0c0ae016c6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8298872e-9fbb-4aac-be4d-5e3da87a10a5", "sighting_of_ref": "indicator--30305653-2141-4fd3-99bb-bd276322e98b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96f52154-2960-4934-8345-07a74178cda9", "sighting_of_ref": "indicator--e59f0062-9dbc-4791-945b-cf090f2477d1", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea7cf8e5-1eb9-411c-8552-bca3be3926ec", "sighting_of_ref": "indicator--dcb788a2-caa6-48b2-9799-619c7cc3d215", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c185e3ec-b69d-4a8d-924c-7baeec8df095", "sighting_of_ref": "indicator--0483e921-bf84-4a18-9d33-8dc1adb01cad", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a57e6d98-5a23-4380-8921-c56d1c7c431d", "sighting_of_ref": "indicator--0483e921-bf84-4a18-9d33-8dc1adb01cad", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a104bdd7-6264-44b5-bd11-81b898390a61", "sighting_of_ref": "indicator--0ca17ab5-2538-4425-ba1a-9497d7e3b377", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0743bd58-0f19-4678-a87f-a12c9c3d8cc9", "sighting_of_ref": "indicator--05195adc-08f2-4e18-bdcf-f9aefdf366e6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25288a65-b9a4-4c75-a92d-e43cca59fdb1", "sighting_of_ref": "indicator--9a7328c3-7ca2-4c38-906f-582a63f267fc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d266950-2e25-49f1-a103-8c6957bb82bb", "sighting_of_ref": "indicator--7418b799-afac-4578-be8f-55983b23908d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ac6db7f-cd46-4b61-a4ac-340f99384233", "sighting_of_ref": "indicator--7418b799-afac-4578-be8f-55983b23908d", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec2a567d-fb9c-4496-8a87-bca6cb6d1231", "sighting_of_ref": "indicator--1ca4c62a-9c8b-4c79-baef-800c70b1ce1e", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--973b3fe1-550e-499c-b3d9-b508de669c24", "sighting_of_ref": "indicator--27bc24ad-8b16-47d0-9e4c-b737e61d7a62", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--813baead-f4c4-4b7a-ad48-de37c7b6dc11", "sighting_of_ref": "indicator--9cf2d48a-7209-4cdc-af36-841bf524b3b1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac1738b-dbec-4fd5-90f2-2a0402d2b71e", "sighting_of_ref": "indicator--9cf2d48a-7209-4cdc-af36-841bf524b3b1", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c6011f4-63c8-49d2-a378-8f5a9a05103f", "sighting_of_ref": "indicator--6459b2b2-4c50-4733-a648-06a5f038d2cc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0c5e5c9-d23b-4a44-84c3-3771fb8c0750", "sighting_of_ref": "indicator--f9cb30ce-69a1-48ae-8f52-dc6fbc0e5083", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fd23bf6-0aa2-442d-bd78-fb785a4709d6", "sighting_of_ref": "indicator--0ccee5db-1e74-41b1-abe2-4fded84c4373", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6307e3d4-e2fa-46d3-a57c-78abab5b8cbe", "sighting_of_ref": "indicator--1b2c930a-0507-4caa-8eaf-6b8a2b2ce99c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d5ee273-feac-421e-b75d-6e70777d8b74", "sighting_of_ref": "indicator--1b2c930a-0507-4caa-8eaf-6b8a2b2ce99c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23a3a027-b997-4074-9811-3071e55bbbc3", "sighting_of_ref": "indicator--d9ca19e3-1fc5-42f8-af8c-16dfe98a2e59", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e957d02-7684-41aa-83af-bc6f957e2ce4", "sighting_of_ref": "indicator--1cf3705d-7528-4f5b-9b2c-5299084f978e", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc0d9123-5af5-4705-b544-f7d2f9af8584", "sighting_of_ref": "indicator--39cf7bda-912c-42d2-808e-8cbd72f63a7c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e3c7ad8-ff69-4984-924a-41356d934966", "sighting_of_ref": "indicator--50c927ed-4934-4100-af97-38153d51234f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--513c6bb4-f5e7-44a9-8c63-679a6f05fa82", "sighting_of_ref": "indicator--d9f11f09-a887-4653-905c-d23f93c8e791", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5de4aae0-b16a-45bc-a635-470268750ad2", "sighting_of_ref": "indicator--bbcb9d87-8f02-4166-bfae-b492e4a30138", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75fe7a04-68d8-47d1-84d4-6267148ab8f2", "sighting_of_ref": "indicator--b0df982c-5578-4350-947b-45875f8adca5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--387881d3-880a-4f08-8eb0-377744de7f98", "sighting_of_ref": "indicator--f676926f-c23d-4b9e-bb4f-8570ac402003", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9f6ef11-258d-4c2b-9d26-4ab1a909d3a3", "sighting_of_ref": "indicator--08f79ab6-10d9-41d6-b7ee-5f4913ad6aa2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--234bde8f-3e31-4fcb-9b72-8064a7664be8", "sighting_of_ref": "indicator--117b57d2-9679-41f9-9894-a257aa1db662", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f7013a5-957b-43a3-91e9-121bd88e089e", "sighting_of_ref": "indicator--ad9e0f2a-8c95-4e6b-b745-5cfedf3768ca", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f86b8c96-3963-47fb-8287-087a7fd1b350", "sighting_of_ref": "indicator--b8ac68e3-60e4-4c87-a41a-53c056036605", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--777134fd-b9a8-42c1-b918-57e3acf8da35", "sighting_of_ref": "indicator--f2a61a7e-7490-4166-9174-6accab35e15e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff5b0d8f-50b5-42ab-8a1d-c7f32e60eb07", "sighting_of_ref": "indicator--fd8eec3e-cd6b-4e46-8ff6-fe09a625a5d9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61004c8a-3910-4e4b-906a-0c9166140dcf", "sighting_of_ref": "indicator--296f385b-7836-40d5-a0e2-7d8887457109", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbbdc739-a7b7-425c-af13-732ed6087915", "sighting_of_ref": "indicator--513dcdf6-a397-42d1-9018-f002984eb435", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6032b53-a125-4cc6-ad29-50553d3f20ab", "sighting_of_ref": "indicator--aa646906-547e-4758-b988-bc5e49e0030c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dd763e1-9a5c-47b2-9e35-6e42aeebec30", "sighting_of_ref": "indicator--2a8fdc5a-31d7-499a-963d-a7325196a0bc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cf00617-7207-4e08-ab4c-afcb501fdf14", "sighting_of_ref": "indicator--81e71599-f457-4940-9048-469ad56d84d7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22cce8e3-21b0-40e2-9105-7c37283203a6", "sighting_of_ref": "indicator--78645bbb-c026-4d5a-9aad-b60566ac7603", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2fc4950-ff77-456e-bb7d-77d19868152a", "sighting_of_ref": "indicator--ddb8666a-4bec-49a7-8fc3-ab3f5c15bb8c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04bbafb6-8e29-4d02-b810-67bf99ede582", "sighting_of_ref": "indicator--95a2734c-f99b-44f4-ad3c-ed912fee0f37", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53c424e6-c1ad-4c92-bdba-371ff70b3278", "sighting_of_ref": "indicator--b1695472-84bd-48ad-ae87-ac12c85953d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aed8efea-29e1-4bb0-a35c-e238e36a7745", "sighting_of_ref": "indicator--22738da6-a0e4-45d0-ace0-553f80cf5364", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9656da08-0698-44df-920e-79ddbcd30d78", "sighting_of_ref": "indicator--22738da6-a0e4-45d0-ace0-553f80cf5364", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--159ded4e-5d1d-4b61-b7a7-a01a1c9fba8c", "sighting_of_ref": "indicator--bf57ff47-fff0-45c3-91e2-eff59feb57e7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3e1d6c3-7ce0-40a4-aaee-1ce20852c054", "sighting_of_ref": "indicator--5942452f-cc29-4fcd-b4d1-61de0a16bc1b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ad0b926-e03c-41e9-87f3-2fdc9593aa2d", "sighting_of_ref": "indicator--5942452f-cc29-4fcd-b4d1-61de0a16bc1b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9156c37-1bf0-4084-9b50-00ada512c6bb", "sighting_of_ref": "indicator--7211b5c1-6433-4951-83bd-b9513df481e6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23a58968-d9a5-4d72-9b31-58ec9115db8f", "sighting_of_ref": "indicator--7211b5c1-6433-4951-83bd-b9513df481e6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72bbe94b-cf29-4b5b-b7f6-7dbebd0055bb", "sighting_of_ref": "indicator--52c21c7b-36e9-4d2f-914d-fbae8e58992d", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09731f61-7cc6-4084-9e19-9c5a39bf4c26", "sighting_of_ref": "indicator--52c21c7b-36e9-4d2f-914d-fbae8e58992d", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b150f8a-da42-4e5e-9bf6-b4dfb4717faa", "sighting_of_ref": "indicator--e0a5e5eb-f521-471e-84ad-a78928cc3e69", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--499b73e4-351d-4626-8225-ee707536cd7a", "sighting_of_ref": "indicator--46ee3047-3807-4373-879d-dce17c057468", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30f3256c-f45f-4f2d-96ce-579f070aa375", "sighting_of_ref": "indicator--70bfca34-1af9-4f38-a967-ad22b871232f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6fb905a-46c6-4c52-b436-886b241fd2c8", "sighting_of_ref": "indicator--4431d0a1-fe09-4671-ad38-002897978739", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea5a353e-daf5-4bb3-9e8e-5e6b67fc60d1", "sighting_of_ref": "indicator--4431d0a1-fe09-4671-ad38-002897978739", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa9d9771-d4ec-44cb-83fb-748c8df43037", "sighting_of_ref": "indicator--4431d0a1-fe09-4671-ad38-002897978739", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5efa78ea-9549-4ccf-af17-48032326f4bb", "sighting_of_ref": "indicator--f9b5acfd-81f0-42e1-8811-3d9f82e736bb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3b98f14-0b6b-4a6c-b3fd-d50f88789b3f", "sighting_of_ref": "indicator--aa495da3-e10d-4ade-bd20-91d912c512a2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8939cc6-4017-42c4-91ce-4959041d97f9", "sighting_of_ref": "indicator--e7bd4610-29a4-4700-86a8-a4700f63d6a2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9ea89a0-ec76-4ce6-bcd7-56125028d351", "sighting_of_ref": "indicator--e287a21f-6ed4-4af7-b848-b8343d2a4e28", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33c477dd-7747-4f2a-b7e4-9e9a3abbc21d", "sighting_of_ref": "indicator--0e5fbbdb-805f-4d30-b498-45616df384c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ef2f7a7-a18a-4241-b956-f81bdba41516", "sighting_of_ref": "indicator--0e5fbbdb-805f-4d30-b498-45616df384c4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57082c73-b5a5-48ae-807c-7b74ebeb678d", "sighting_of_ref": "indicator--1feafa79-caaa-40de-b795-a2c872f5c1d9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8c8b2c8-1ee9-4756-bef8-98ad45bd29ef", "sighting_of_ref": "indicator--27befad4-a998-44fd-848a-11381e260f76", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8f7cd98-758a-4fcf-aa38-cae231ad8f4f", "sighting_of_ref": "indicator--fb982cb1-30a7-436d-b26c-56582fd92d81", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89116ef2-1df3-44e2-824a-5ccc05f22477", "sighting_of_ref": "indicator--35c8c09d-d33a-4dea-a465-89ab49b3e769", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a235c90e-b8e2-4d33-894e-eb5724a01727", "sighting_of_ref": "indicator--3d4e9d44-1ee0-4dc0-b37b-d8b05aab0b90", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52821ab0-cb44-4182-b645-a790198d0e9a", "sighting_of_ref": "indicator--35af8180-7309-4dea-9758-3e6e0d19c9a0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c65ab64-47f9-4cc6-9cc7-4773f99d5063", "sighting_of_ref": "indicator--e85e4c49-9805-4659-ad8c-2be6534ff0dd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd670259-a2bf-4ca3-aaf9-8cb5b8570c08", "sighting_of_ref": "indicator--05af7da4-fd8a-42e4-a5a8-676892bbf0b0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80265f72-3553-4b13-9c83-d596b4eea0aa", "sighting_of_ref": "indicator--32ca782c-a1f1-4355-b0a9-ab1a63603b57", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d7207ab-dc2d-41d9-9411-a9ddf5943964", "sighting_of_ref": "indicator--4a6e725d-e7ee-47c8-b3b2-5acda8e12a56", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18975af4-a8de-42bc-8e12-f80a0e5afb64", "sighting_of_ref": "indicator--c81a7882-8551-4d1b-9a88-c04008028336", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5da7732f-749f-486c-b95f-5bffbf93b999", "sighting_of_ref": "indicator--e509faae-17c8-4940-b6b2-1668e8e86b7a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d484a343-fd91-4a9c-a242-eaf50cea040b", "sighting_of_ref": "indicator--60d72cf2-974f-40fc-8313-dd70b785de09", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89087872-f8f9-43b4-9261-a99fac887aff", "sighting_of_ref": "indicator--4ce82a42-019e-4964-8828-d8e16630d0b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c75d9ec0-8bbf-4031-af70-fc58da2ad82d", "sighting_of_ref": "indicator--8e02eebf-ead4-4eac-93fd-9616d4af690f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--171a6985-524c-4532-9c8a-72d889ed17ac", "sighting_of_ref": "indicator--1c7e43b3-6cfa-482c-a20e-9c57953d0e1c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12ee2693-1945-4603-b817-c5c7b6f62e71", "sighting_of_ref": "indicator--c800ae32-eb21-4703-bfe7-2f0dd982ddf5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93045ecf-777a-4b40-b0de-ce38d24366e2", "sighting_of_ref": "indicator--c244d4ae-0ce1-4e42-b5ea-16d6dc72630b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee7b8fcf-be21-44fb-92b7-19a76f484a78", "sighting_of_ref": "indicator--362cff62-cfec-49c5-aea3-6422512c672f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61c413c4-e16d-439f-859b-3c19c2073364", "sighting_of_ref": "indicator--f5fc5d91-68b8-4228-9236-3f0c51e85635", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9c00b03-f014-4670-b918-2de8bc55f6fe", "sighting_of_ref": "indicator--02e174f3-c9ff-4527-8bd0-8416c03fbf38", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c1d3005-267a-456f-bcc5-153e3c5e48d9", "sighting_of_ref": "indicator--21472ba6-1a3b-42d3-a1c0-997153723208", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d30d400-0a92-425e-b864-76ef302e5fa4", "sighting_of_ref": "indicator--32d5d546-7ffd-4dcd-8183-cb6ce9398963", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e196b63-4a07-477e-9eb3-d174d9c9b445", "sighting_of_ref": "indicator--531360c0-c41b-466a-ad11-2a67d5684478", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2847edb6-886b-452d-8b2e-f1ea033c5514", "sighting_of_ref": "indicator--dc47544b-b02c-4bf7-a9dc-f3a834225c19", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9808e17b-3ba5-441d-95bb-96afcfcd3735", "sighting_of_ref": "indicator--ab8797fc-e39b-47da-9f45-732437b2b78e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09062df6-b8ac-4b37-b605-c79b2fc8339f", "sighting_of_ref": "indicator--8fa03ee0-a4c0-4725-9dc8-0ac66623cae3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a49a50ac-f546-4536-bddc-3a5aa3ae5615", "sighting_of_ref": "indicator--89f5d2ac-f031-4084-bf63-467a20de4f1c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a71ee79f-e93a-479e-8d62-17ff9a49e4af", "sighting_of_ref": "indicator--7f51ad4a-d014-47cc-8c0c-703447eb2e62", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15c579cd-7484-43db-ba5b-96cc63681d41", "sighting_of_ref": "indicator--fc7819bb-7151-4836-b1ee-c20bc5f57568", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--427f69ac-2a3a-4b76-9e69-41b26be97e89", "sighting_of_ref": "indicator--f2b0fa6a-87c2-4ace-a3f5-0d3bfe5c873f", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e10b909a-bbbe-4761-aae0-5112e228b1af", "sighting_of_ref": "indicator--72b98d29-67df-437a-8c95-1bb57176da4f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--741c9276-6717-40e8-952e-0ad3af9296ac", "sighting_of_ref": "indicator--eef22df7-b3a7-40a1-8f84-21547422dceb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4091e822-610b-4580-bc49-7b0424c2ee16", "sighting_of_ref": "indicator--aad7fb63-a331-4493-8554-73eae734026b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e2716ce-4627-4c60-8f3a-d0b18cccde78", "sighting_of_ref": "indicator--f981c474-4a75-456f-af8f-e9bc55bbec04", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e65eb40-bc67-4f84-aeb0-f2a6065871a2", "sighting_of_ref": "indicator--8c578d80-1d94-4402-b79f-554ed8d31bf2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca793b46-bde4-49a3-b273-dc12014bad0d", "sighting_of_ref": "indicator--4f172c7a-6864-44b3-b1a9-e9c3848e37f6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baf6d9bf-2874-46b7-b9f4-952fc1028b86", "sighting_of_ref": "indicator--4f172c7a-6864-44b3-b1a9-e9c3848e37f6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a355086d-7c70-4286-9aaa-9dee038f00d1", "sighting_of_ref": "indicator--5d074bfb-2b0c-4a52-8f7d-7091438126ee", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--085a6c33-0657-4096-888f-b91f6d5b9bce", "sighting_of_ref": "indicator--1933cf38-34df-47d3-97eb-ca2dc5d04ec1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85badbd8-7f4a-4844-8f5a-b0b57badcb07", "sighting_of_ref": "indicator--e70a079e-3985-4a87-8d65-9bdc87d54465", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5555afa-e7c8-4682-9471-b02fffaa2463", "sighting_of_ref": "indicator--3d5b85fa-9243-4571-8fc0-63eaba8c3a21", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60114051-ec5b-4740-a482-78fea009418a", "sighting_of_ref": "indicator--c9020eca-11a2-4438-af27-c8b1a2194cb6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3e4e518-4ca8-4d64-9819-9937fbd3bea1", "sighting_of_ref": "indicator--c9020eca-11a2-4438-af27-c8b1a2194cb6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2bab0b2-6d17-42fa-aaea-5cd9a965411c", "sighting_of_ref": "indicator--859462e3-3805-467d-bde4-69ca71ed533a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94e1419c-e03f-44a4-bc2c-4803f0c3b741", "sighting_of_ref": "indicator--859462e3-3805-467d-bde4-69ca71ed533a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--327ae3b9-8e16-4db2-a00e-97a423751d74", "sighting_of_ref": "indicator--0c4492a1-b4b4-45d4-8bc0-99a665d7894f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f12563b-c825-4360-90fd-2be1b8d4b18f", "sighting_of_ref": "indicator--0c4492a1-b4b4-45d4-8bc0-99a665d7894f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f3378ce-8830-4c98-b8b0-b7a957404df4", "sighting_of_ref": "indicator--ddce2ba4-a79b-42a7-90ca-8c5d4c328c3a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7989d72-2848-4b85-bfbb-aee528ae89f5", "sighting_of_ref": "indicator--8f817fc4-8407-4e47-8424-1b985c76f6f8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7165184-068c-424c-a0a3-355d5208b346", "sighting_of_ref": "indicator--f0426d4f-f0b7-4693-b018-f292e5d17815", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5b1907a-7c09-4ca4-9940-456f8e6f8145", "sighting_of_ref": "indicator--f0426d4f-f0b7-4693-b018-f292e5d17815", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43404465-181b-4f7b-9e10-bf15a73ca6ba", "sighting_of_ref": "indicator--321d04ab-be2c-42f1-bcaa-af5d9aa40476", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a6bc497-bf0f-406e-8ec4-8f1aed403956", "sighting_of_ref": "indicator--1eda7cc2-9c80-403a-961d-1c8d2e94803a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f147bd6-f131-40b3-bfba-09ce296008db", "sighting_of_ref": "indicator--e83b3695-b781-4695-88f4-2d4c809c3731", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--916489b2-765c-4303-94ac-89ffa6ee71fc", "sighting_of_ref": "indicator--b0558d99-eecf-4c7a-b8c7-0d3409e24459", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3ffbd3f-d3c7-4388-9583-fed36cf0da80", "sighting_of_ref": "indicator--b0558d99-eecf-4c7a-b8c7-0d3409e24459", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a16ca19-bf7e-40ad-ad50-48d010c221a7", "sighting_of_ref": "indicator--371a64f6-dbb1-420a-a032-062244583daa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f260f03d-562b-45ca-a883-55bb5ae419a2", "sighting_of_ref": "indicator--371a64f6-dbb1-420a-a032-062244583daa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30fac2cc-1332-40b0-9031-d3d84bd595b0", "sighting_of_ref": "indicator--0f847200-fa4d-4761-97d1-f37be3889612", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4e0dd6b-dfe2-4bca-a76b-609602f7a431", "sighting_of_ref": "indicator--d2d2a9a7-423b-4c17-a582-e63edd79ca85", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--476cea77-3f14-4084-9d8a-84059a0c6534", "sighting_of_ref": "indicator--ffc215af-fc3b-4471-8fbb-c300702ffcb6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c480e60c-e1ac-47ef-89c4-d27d03861cad", "sighting_of_ref": "indicator--33f8ba20-7e03-43d9-a85d-47585b36f5e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84873585-9fc5-4357-b73f-e96c1c034c02", "sighting_of_ref": "indicator--8bd210d4-662a-4bad-a8f1-7db54275c660", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa2473e7-571c-4d08-956b-5540a5a4f7c5", "sighting_of_ref": "indicator--b62b0639-4ff8-4a76-9eab-5f4e4c21ec6f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b786a32a-afde-488a-a4bb-e4e9a0fbd839", "sighting_of_ref": "indicator--c84c1797-801b-4f6f-9c13-8c8b7d5f4bc6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--852fcea4-c5ca-4f2e-b568-b7f7f39df0b9", "sighting_of_ref": "indicator--73d988bc-e8d5-4877-937c-40b57a672178", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a04423c9-af5a-4a99-ac8b-97aed3ad6e18", "sighting_of_ref": "indicator--73d988bc-e8d5-4877-937c-40b57a672178", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d25a4723-0522-4a9b-b227-5b46dea4f501", "sighting_of_ref": "indicator--15dd2aed-1e0c-4b67-a78d-19d2c67d72c7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba577e60-e259-48bf-92e9-e225690b21c1", "sighting_of_ref": "indicator--f826c67d-0207-4706-9f21-a85d1d7f112d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66667e4b-26d1-4d41-afb5-f8d6475addf0", "sighting_of_ref": "indicator--47509896-b9c8-4942-b2bd-a60f92266026", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3512466c-c84c-47b9-b5e4-6fe86769c3d8", "sighting_of_ref": "indicator--50d81869-89a4-4f4c-ae9e-874a21e10173", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfdefea3-244c-4f41-a931-cb2bda136ce2", "sighting_of_ref": "indicator--d5a024ec-ceb5-4313-b487-58d5181d46ec", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b037e097-b014-48cf-a591-fcd0a0eee177", "sighting_of_ref": "indicator--d5a024ec-ceb5-4313-b487-58d5181d46ec", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d1995ec-ebeb-48ac-9399-177455bad7d8", "sighting_of_ref": "indicator--7cdfbf83-06e3-457a-bc39-73c60d379c7f", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--778a70b2-d5ac-4d2c-81df-7f40b89e0a9c", "sighting_of_ref": "indicator--7cdfbf83-06e3-457a-bc39-73c60d379c7f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a120bd3-a3a0-497d-b58e-b800639d5a40", "sighting_of_ref": "indicator--7c69f65c-05e6-47e9-9b58-58eeefdeb57c", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fa153a7-589e-4dee-88f9-afeb0a7cbe94", "sighting_of_ref": "indicator--3b94cac8-35bf-49ee-8bba-eb7d130c6d60", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05125e0d-c9fd-4693-a4b8-2d294354a094", "sighting_of_ref": "indicator--aa017a09-d6ff-4a10-947e-8e8e66f6e70f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dc74356-7dfd-40cc-8ef8-2b59220ae74c", "sighting_of_ref": "indicator--8c0c0bcd-5042-4b86-a5c2-22c6d5bd6f2d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de858c8a-ac78-4c01-b0e4-544c95a4c8c5", "sighting_of_ref": "indicator--eab9d28c-bdc4-4087-ac9f-c128c5a62eba", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a17c994-3f33-4b25-adb1-1e2c21ee7f67", "sighting_of_ref": "indicator--9d0523d5-8754-4a89-b837-9e214efdb63f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5b5ce49-748c-44cd-8681-d80c5084c9d2", "sighting_of_ref": "indicator--5c3c5869-11d5-4f1f-923b-3e9094c4e0db", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adc23fa2-c1db-46a5-86ad-9c8e3aee3414", "sighting_of_ref": "indicator--65d37871-532e-457b-8a7d-c6c960f09208", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e8c6612-f834-4b6e-b02a-2485b96f985a", "sighting_of_ref": "indicator--6f25e56d-c331-4953-a0a3-e1625ed9176c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16cb5b17-c45a-4083-8a44-417aae5296f1", "sighting_of_ref": "indicator--5aff2047-2d61-449f-8251-c1a3f51fb12d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b582b801-0d6d-425b-bdf3-5312d1468ae4", "sighting_of_ref": "indicator--aa66a5f3-60a6-4090-af94-1fb427ca2497", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92371f51-6a3b-4f8e-9e06-56c1ecfbfab8", "sighting_of_ref": "indicator--1821c0a9-8705-4224-b50c-d1063237cf7a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11232eff-3796-4a55-b76c-2f35c8702d8a", "sighting_of_ref": "indicator--39ef6f65-9f22-405e-8d7c-3ccd7706cdcc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d3ccb3a-b11a-4906-a8b6-b4550711078d", "sighting_of_ref": "indicator--4b8b41cc-3361-4a33-995c-5bd3cfb4e83c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e96fb82-c8a3-4f30-b7f3-81e137a0d534", "sighting_of_ref": "indicator--8d74d58a-7b23-46be-9f26-99cec53b7421", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--399e67f7-9f5f-4b2c-b445-5d37efbb616b", "sighting_of_ref": "indicator--76b57e32-5824-40bc-b005-1f2f71887a97", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46fe6b6b-1e60-41fc-90c5-a89b7fcf4281", "sighting_of_ref": "indicator--b05cf301-af0e-4188-bb37-5197a2625262", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa5d7da7-9bf3-4bae-9d37-212c43c58ae2", "sighting_of_ref": "indicator--b05cf301-af0e-4188-bb37-5197a2625262", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e84531f-e4e8-4ba5-9af4-ab1f05a42906", "sighting_of_ref": "indicator--5c02e7f5-c695-42ff-a491-8e01b33205bc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a08e7a18-938f-4c72-a9e8-fae5ef965ea4", "sighting_of_ref": "indicator--631dbd63-5041-46e9-81c3-0638191db5b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcd02ce6-b875-4314-975f-35f8bfd20162", "sighting_of_ref": "indicator--36668931-f131-4007-b454-fa67f7ed1aa5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5ccc2a0-da67-41da-8e1b-09f79e98637a", "sighting_of_ref": "indicator--36668931-f131-4007-b454-fa67f7ed1aa5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b47aac94-9c61-4e06-9b1e-63bdbec93428", "sighting_of_ref": "indicator--c4da2a08-dfc9-4d3d-be9a-ba2001c63d27", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e517619d-93df-411e-b794-a10a2bd84292", "sighting_of_ref": "indicator--4783321b-9400-4f3f-86b9-260d18c8d795", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9318ce96-9179-476c-9993-f617d39e1a3d", "sighting_of_ref": "indicator--f6000c6d-6b2c-4e0a-91ab-2af770b5ea6a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2e94241-6e75-4c8f-9d65-ced207b9a0c4", "sighting_of_ref": "indicator--a7293988-7f5c-4525-bca9-969992a2b694", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c894c06-07f5-4cc7-9495-4c7cc90e368d", "sighting_of_ref": "indicator--3dc488fe-6b23-461b-a68b-241d3c46b425", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03dd766a-8313-4e70-882a-c7bd96ddf9ee", "sighting_of_ref": "indicator--ac65eaea-7451-48a8-af30-9c9ccdf2859b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29412c0e-15a7-4ffa-a449-20981744798f", "sighting_of_ref": "indicator--551fff6c-ae8c-42f6-8630-0fec48d39550", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b6412cb-1ea5-48ae-a166-23cc373696b4", "sighting_of_ref": "indicator--d56f2483-9f85-4dda-a0f0-4b9c25242eb7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4686a95d-09db-422a-b1c8-8a3374f3394e", "sighting_of_ref": "indicator--86558ef8-783e-4cc0-91b2-2b04f8162d70", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91a4c5ab-a1cb-4db5-a34d-80999b96a581", "sighting_of_ref": "indicator--55c7cee2-5aab-4c58-bb19-fe3992543549", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaaa052f-a16c-4926-831e-7ce21cbc2c3c", "sighting_of_ref": "indicator--7e2cdc19-8b7c-45bb-bd9f-d158940d4a96", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7eebfdfe-39d2-4eb4-a76b-d84ebeffd0d6", "sighting_of_ref": "indicator--7e2cdc19-8b7c-45bb-bd9f-d158940d4a96", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cc77e20-9b6d-4909-b963-18dc0085c196", "sighting_of_ref": "indicator--28e8967e-3df4-4c37-a837-4f49b2ce2080", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2644aece-6c25-48d2-929b-1b7e49de896f", "sighting_of_ref": "indicator--817dd39e-6d81-452d-a812-4bb5fab2d40d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--666b7312-e2b1-4287-818e-3fda3860e3d3", "sighting_of_ref": "indicator--158cf9fa-b6fa-4d98-9fa7-b765947316bb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a21591a-5763-45d8-9f4b-a2ded6336776", "sighting_of_ref": "indicator--35e578d9-40ad-4a5a-94ae-4edfb7748e43", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b34f372c-5b1c-40dd-8735-63bd0b661a94", "sighting_of_ref": "indicator--d913cda3-69af-4526-845f-919f58925367", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45adf3db-c800-4c9c-8199-4c781a5aae9f", "sighting_of_ref": "indicator--441e04ef-f95d-4df4-852c-d5dce7c84a84", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e9fd0d5-56ee-40e6-939f-bb92326b48f1", "sighting_of_ref": "indicator--15d8ea7f-410f-4e31-b012-c9ecd37efef7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dc7b6be-c127-43a1-91a5-e7e99f9b3ac6", "sighting_of_ref": "indicator--37102bd9-648c-4eb5-92ca-7130ee6991a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6fa2585-9c23-4536-b54f-412efda742b6", "sighting_of_ref": "indicator--c756824a-7e36-4488-ad8e-3e33a5975376", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e1960ae-88fe-4460-9369-662881afbca9", "sighting_of_ref": "indicator--74d125c4-17bf-4bf9-ab75-77cd066416d3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--281e9ddb-ea87-452c-82ca-785c38ea8262", "sighting_of_ref": "indicator--cc11eaf8-5c52-4b09-a6b1-7c92cee0ad20", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e072f7a0-e0cf-4201-8331-4fe5bb29061f", "sighting_of_ref": "indicator--cea2e7c3-deba-41a0-abce-688771bdc5e3", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83731252-15ab-41ae-a669-b18408dfe6ae", "sighting_of_ref": "indicator--f6553611-9504-4ce2-b490-b4402c5a17ea", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c83f76b-14c6-47d8-8257-0b0feb7a8848", "sighting_of_ref": "indicator--59dd1237-8f79-4eac-8f4a-cdb2103a26d2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--274e505b-5b15-446a-be02-4ad7dd6cce38", "sighting_of_ref": "indicator--1f856967-514c-42e3-9cd2-23c1dd8105f2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa8534d7-fe99-4f17-9adc-571026d496b1", "sighting_of_ref": "indicator--a73e0282-27f7-4823-9c25-cf899634097b", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--473217d2-0bb8-48ea-97e0-a5e53287c514", "sighting_of_ref": "indicator--51c0f7e2-6b8f-4b09-875d-452b61fd9975", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dfc2dc0-2624-467a-8663-140f5a9dd895", "sighting_of_ref": "indicator--61aceb8f-58cd-4064-980e-4b9da630cb3a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46abb3c6-b393-4bfd-b72a-ff5c7ad428d5", "sighting_of_ref": "indicator--f7bc875b-c478-479a-b1b2-20a07bcf5146", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25987e94-4fd2-48cf-8e30-fe2ab0398d53", "sighting_of_ref": "indicator--28e8e102-ba7f-469e-a028-ad2d122d4584", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58a4c921-a56b-4c60-9068-e3010aee7860", "sighting_of_ref": "indicator--bcdb6d9d-9858-4b46-9c1e-b984a507d175", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e40fefb8-4b11-4f55-be79-38c666945668", "sighting_of_ref": "indicator--34a48ae4-e9e0-4051-b2d1-9d8f2a3b9580", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--769f75da-abd8-4564-ab6b-a30135bfe29b", "sighting_of_ref": "indicator--07194678-dc02-4f29-b251-948179d4726f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2ec36bf-32cc-421e-8ef1-8293c3748687", "sighting_of_ref": "indicator--9641d888-4bce-4e50-af98-c1182f20f629", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f58114d8-3ea2-4c61-9c9b-a823ac41c8f2", "sighting_of_ref": "indicator--34e7f42c-51e7-419b-b1ef-015a1c8a6b63", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c148a35a-f04c-4807-9af1-868ed5d9f19a", "sighting_of_ref": "indicator--a266f66a-8ea0-402b-8c89-508c766d4629", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6389ae47-e0cc-4239-9704-6093a3142baa", "sighting_of_ref": "indicator--a266f66a-8ea0-402b-8c89-508c766d4629", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20164b7c-3ec0-4c85-905e-0153a4801c76", "sighting_of_ref": "indicator--af8b631e-b653-4dd3-8910-195406aca659", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fccdf83-238b-45c7-ad44-f14895b05a34", "sighting_of_ref": "indicator--fd8f65a6-a425-4f8e-bea2-69b4e54243c7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bae24399-2e73-4209-bdae-013f16ed932d", "sighting_of_ref": "indicator--ae2a3943-b52c-49ef-ae27-13fb7b4011c3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b48c8db-f9bb-4b39-b46f-3cf3d0a92b2d", "sighting_of_ref": "indicator--f989b3e9-be65-4dce-82da-11a85701a19a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33606751-511e-40d8-a7fa-e85801aea2f2", "sighting_of_ref": "indicator--7324a806-b7fa-407b-bc50-87fd827db154", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45029910-e3be-4568-b13a-e98f9d4f8203", "sighting_of_ref": "indicator--e7795645-fbea-4ad1-94b0-22d6c17d8f8c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ee618ed-8cf7-4339-8b6d-1aafc4f19fbd", "sighting_of_ref": "indicator--87fc4ab5-19e2-4417-ac42-58e336fce484", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4aee478-b8da-4012-a916-c3bd58dc62d4", "sighting_of_ref": "indicator--87fc4ab5-19e2-4417-ac42-58e336fce484", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae1715d0-6c7f-4d49-a4fa-c94c575e4882", "sighting_of_ref": "indicator--1b807886-d2e0-4b5e-b2c1-c1d14b1fbafd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c25646cd-bb04-43c5-96f5-d006ced67b31", "sighting_of_ref": "indicator--6e86654f-e3e0-45b7-a5be-888cd5079ebd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01bfd212-c22e-4001-b3c6-79a35541a76d", "sighting_of_ref": "indicator--ce8e0b80-4caf-4c25-8e24-8c3ccdb3bdbf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--298b5f68-b3c4-4b51-8024-294d1ada493f", "sighting_of_ref": "indicator--30fa0a19-f01b-4e65-83ca-fd6f286bc182", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63118373-9ef7-4ab0-9104-a3755c53bac5", "sighting_of_ref": "indicator--6b7775ff-8b10-4b93-af34-9994b381f475", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f07238a3-35ff-48cb-bcb7-10a65c35707b", "sighting_of_ref": "indicator--0c116e19-7665-4229-927d-ef3b4309d28f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25f0e4ef-cb12-4c15-bae4-15828448f3f7", "sighting_of_ref": "indicator--79824125-c13b-4706-921f-cbd1da461610", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faef14ea-0d4f-4340-a3ce-21d9101a55e0", "sighting_of_ref": "indicator--73d964b7-4960-4504-a378-fd7a1208c617", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1c5e8dc-f52b-4676-9b99-ec694dcf53bc", "sighting_of_ref": "indicator--91522762-2295-4d61-aa14-5a1dbe6abd3b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e92f75b-ad2a-44de-b41e-84ca8e915b76", "sighting_of_ref": "indicator--93902353-f588-4cd6-8a81-3f6f13ec6716", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--907b20e5-070f-48e9-942e-035b67dcf858", "sighting_of_ref": "indicator--1b700304-be22-4eec-abbe-2d06dfd8b721", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--783fdf3e-ef7c-4703-9baf-a104bc2e4ab4", "sighting_of_ref": "indicator--f3ae9361-3e5a-425b-904d-05b5db5520e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83831122-e1f5-44d7-ab78-dd821abeb80f", "sighting_of_ref": "indicator--e140bfa3-0836-4402-ab33-f10fa58a0bb7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c526a269-1ef1-4630-966f-576a6942febc", "sighting_of_ref": "indicator--de4d32ee-e56e-4e15-a95d-b88471ecc024", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1437e746-cb64-415d-85a1-9e0ecfc84da2", "sighting_of_ref": "indicator--3057d5e7-b8f7-4bc0-834d-d2e86be05129", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3343fce5-8a83-4d04-9653-44fd3a04a266", "sighting_of_ref": "indicator--029fe071-c51a-40ec-a2c6-3fb917674c55", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8059b019-181f-4df8-ac9a-5d8a9dccd0f5", "sighting_of_ref": "indicator--2a490731-bfde-4c28-aa8d-226ca118a7c2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff648dc8-3100-4207-bc35-b0ee23bc2185", "sighting_of_ref": "indicator--577890c9-46cd-46a4-8121-7945103f13ef", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47694c9c-c8f7-43aa-8602-446c9d21d218", "sighting_of_ref": "indicator--688a08a4-6229-4db8-bf9c-b8ebbc9a7c3f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6b5ee5a-0b5a-4701-8eff-aa795260cddd", "sighting_of_ref": "indicator--03119ed1-83f4-494a-bb5c-221a5651cd0c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7649e45d-7610-4db7-8729-4f047dce0777", "sighting_of_ref": "indicator--a759267f-567d-40d2-9f80-e8c2e3c120ff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ba04b34-83a7-434f-b862-c1dbc140d172", "sighting_of_ref": "indicator--f09fa327-7dd3-4628-827f-beebd0822f37", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbb1bdb7-58a5-4916-b0f9-ba915a8554b0", "sighting_of_ref": "indicator--7f671fc8-4ec4-4aeb-ac57-8a98e1396b2c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f677381-e442-47af-ae3f-b73ecabf2fe7", "sighting_of_ref": "indicator--b218808b-6f15-4943-8e9d-5e3b1a69b5c0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e02ad9b6-cb6e-42b4-9ac3-a4839c53391f", "sighting_of_ref": "indicator--0f669c7e-eb4d-4497-b7b4-8323e879a99c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e160a72-5bd8-4680-9d2a-800100ce3aad", "sighting_of_ref": "indicator--a7f5dc91-ecd4-4e3b-842c-070db380bf6c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a6e0552-9642-4157-b251-4c5d9431810d", "sighting_of_ref": "indicator--2f05fc81-d2cb-4160-b675-35b407a65875", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcd04cae-9935-404b-a38e-9130f84c81b5", "sighting_of_ref": "indicator--0d8d4086-f7f6-4834-98aa-6c61d7f5e380", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65ebfd17-5007-48ae-8f9e-0264b1e6ad11", "sighting_of_ref": "indicator--7b9973ae-4ddd-44d6-b9e7-e26898659edc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--649d6e01-9cbf-4f16-a9d4-554543aee3f2", "sighting_of_ref": "indicator--783f344b-7a51-4e0f-9762-9dec230d7686", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef7cc468-4f82-40b5-a6c0-e659f928992c", "sighting_of_ref": "indicator--76a91a5f-b358-4bde-bc75-d538c25d26f2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e81d4730-5875-4d7e-a3ad-856c97a0f0ab", "sighting_of_ref": "indicator--0ebcfce0-f289-46fd-b084-442cc5a0d553", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1abdf95c-05c5-4ecf-b510-f17694fa7a65", "sighting_of_ref": "indicator--9b01b1f5-de93-4e06-a304-5eb5468559a8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74063cbf-90fe-477e-8d5f-4f6f3fff28df", "sighting_of_ref": "indicator--74f24e36-55dc-40d0-9fc4-a253a0a2f74b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c175f1f-68c2-4d17-a616-2fe9a219c729", "sighting_of_ref": "indicator--92fe6683-d226-4e4b-b3e5-4ab844ff68c4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf484bcb-138c-4313-b64c-4bc034a8581e", "sighting_of_ref": "indicator--4e63092c-67bd-4972-9cac-277e9770ea27", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c15a01f-ccd3-4a5e-b5ca-849db7604265", "sighting_of_ref": "indicator--441588b6-0172-4447-93ff-9e22613d5714", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9080c8a2-7ab1-4609-a8e4-bf72397b034e", "sighting_of_ref": "indicator--f8691e6c-a3e5-436d-b291-f2dc58f8cd86", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--383dd528-4248-43a4-8a12-ad89b09cbd9e", "sighting_of_ref": "indicator--7645641d-53e3-4e23-9e59-234d312f2a81", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca086557-c26f-4c6c-b19e-7a8866844669", "sighting_of_ref": "indicator--6003d9f8-968b-4e7c-9d68-c14e9018da60", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7d9585c-b6ff-4060-a772-f2d553e4d8d6", "sighting_of_ref": "indicator--d1e9deeb-681a-4411-8865-6a897eaa3774", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3879940-3fb4-41ae-aea0-1eb8ab038391", "sighting_of_ref": "indicator--850bc9c4-541a-4cb0-b5ab-1c8bc8b37c53", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--500e233c-5401-4fcf-a3a2-4fac57b5ea63", "sighting_of_ref": "indicator--21e555f9-a067-4566-8f44-931c63081df3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09db68b8-13ad-4da2-a998-f4d3159adbce", "sighting_of_ref": "indicator--8409103f-24e1-4d47-96b0-fa3481506fdd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79dcfe34-4be8-4a7c-b4fb-ab195bee432b", "sighting_of_ref": "indicator--219ddd1d-9c55-4e19-b73c-71fb78977952", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c88e740-2e0c-4c9c-9e9c-34e1e405fbc5", "sighting_of_ref": "indicator--60ee1895-647b-46eb-a1c6-7d3c8925a37e", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d70177c9-b69b-410c-b13a-0b92854c7a6e", "sighting_of_ref": "indicator--7b2e13f6-5ca3-4c89-b6cc-853461a4399e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--954ec028-d133-4377-9b89-a73dfb8f79d7", "sighting_of_ref": "indicator--9b1a1773-af7b-48b8-878b-a9e40a0229b2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60e10482-502b-4701-bca3-5c6b5b1343d5", "sighting_of_ref": "indicator--d202ae95-f201-4241-975a-063c475ffef4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc5a38a7-2706-4364-b923-671ae6cc3d00", "sighting_of_ref": "indicator--f90c4edc-f5e7-422e-b38b-31ea779ce548", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d79ca6d1-4735-4249-b5b3-a700b1b40edf", "sighting_of_ref": "indicator--1b7eb04c-b9c4-4fb5-a17f-d279c8cc4536", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d7508f2-ae72-490e-9a5a-8bf9bfbf422f", "sighting_of_ref": "indicator--5bf42ede-9aee-4fa8-a120-870b196c4462", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d66badfc-9119-4300-905d-3d06b039a812", "sighting_of_ref": "indicator--121b7114-7e5a-45db-8d1f-cdb26fef66bd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec1f9315-ca7a-4c6c-9a20-0cd74e89d71b", "sighting_of_ref": "indicator--e6d153be-d77b-4814-9b1f-0b8ff2b3c391", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1548d4f1-6965-4f23-9517-113ae4e082c7", "sighting_of_ref": "indicator--a8fd8386-ad2b-46a0-9193-c2bd8ab750e0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7c92df8-1d36-4ec4-a79d-4dec06ed6278", "sighting_of_ref": "indicator--75317611-1b53-4c51-88f4-9806289a10ed", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--078b2b31-eff5-4feb-a600-d9addff4c3f6", "sighting_of_ref": "indicator--9fb9f9a8-b9ac-4606-8bdc-900487686a0c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80637206-fe4d-4474-b2a8-512cfad48d33", "sighting_of_ref": "indicator--05129843-2e12-4f82-bc04-a13c279fe7b2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce716281-7816-483f-baca-607eea447cc0", "sighting_of_ref": "indicator--f925a1a1-3a54-4477-ae78-23be891f3fe3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4ac2aaa-5554-4bac-a3e5-5bbf3dea1673", "sighting_of_ref": "indicator--f8729388-2ddf-4f87-8ded-d1b27684e867", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dfdd755-fc50-49d1-9a49-a36fe54d30b3", "sighting_of_ref": "indicator--d3d889de-7829-4138-9e18-9d74a5fee6f6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42b8dd01-0a27-4641-8b5a-1433ef3c6b74", "sighting_of_ref": "indicator--a6af0d6e-9678-4d54-ac85-f14b80f5e8b0", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23fa1b20-a7b1-4ab5-9cc4-cf4ee95a85bb", "sighting_of_ref": "indicator--d402f91a-af9e-4a1e-8c85-9deb2baca70e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--506b708d-8602-4ca5-910b-574757304ff2", "sighting_of_ref": "indicator--b2961a74-7664-4695-88c4-571e71b5b101", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68d797e1-8d3b-4f21-b67b-1e440e0b3f15", "sighting_of_ref": "indicator--890abdc1-a48e-41a3-a761-3b55c8e771d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ddb13f9-10f5-4baa-aceb-e119cca4020d", "sighting_of_ref": "indicator--24b66646-5cda-4bdf-bb9f-783c9c7ab844", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a09eb344-78b2-48f0-af58-f8ef02f406b4", "sighting_of_ref": "indicator--d10b41b9-2357-44d7-9792-f575285cb6d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67d7a834-379f-4b0a-8715-72087cb4abed", "sighting_of_ref": "indicator--f855c789-5046-4350-8d7b-8359f43bb1ed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb6e362f-4c9c-4b8e-a624-7e141d560af3", "sighting_of_ref": "indicator--b17e091a-4105-4ff4-b88d-a763000271fd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab9d53e6-ec99-4194-8459-0633552c0fa6", "sighting_of_ref": "indicator--00bc4040-ca75-43ef-ab43-706d2242c4de", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--619c89f4-5a5f-418c-8102-d7b2c8525d9d", "sighting_of_ref": "indicator--70375c9b-fe4f-4124-8c8e-54c838f4fc81", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--805910c6-3f44-4fc9-96ca-4cea0e1a43f1", "sighting_of_ref": "indicator--22352aef-3cc3-44c2-88a4-b5d3daf7fe8b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b2772d-424f-4e06-9ea8-2d3ea3a1ea3e", "sighting_of_ref": "indicator--ae541ba7-55e4-4b34-8676-61f6c6ac529e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fcd4f42-8658-4c79-add8-9c46d1f09ef9", "sighting_of_ref": "indicator--6b0febde-4782-4ee7-8641-065c5ece7ef3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21e95dca-8154-41ac-b13c-249b7380cd0b", "sighting_of_ref": "indicator--6b0febde-4782-4ee7-8641-065c5ece7ef3", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb5783fd-90ec-42a1-9bff-afc0afcd8fc0", "sighting_of_ref": "indicator--004d9077-d2ae-4b33-bb9d-20f92434a46a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--760eb8da-e55f-4993-8cad-82a5e2d5e17d", "sighting_of_ref": "indicator--77d3ea1d-a05e-42d8-ae62-8f323bd8faf4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c203635f-25da-46a3-aa37-2c6d1b81a728", "sighting_of_ref": "indicator--5e71bdf2-9f5a-481a-ac05-2a4f7c6c2df6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cbcd76d-1176-446d-b916-6706d0edd1fe", "sighting_of_ref": "indicator--177e9ee6-3a49-411f-9c63-993c0f5fe614", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3644d151-8b5e-4e96-8479-a38c29f5be6e", "sighting_of_ref": "indicator--a70ed3a4-93d4-407b-9f11-9f95ecde136b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08340dd0-84d2-477a-99b1-850b9ff23897", "sighting_of_ref": "indicator--d0410dad-ab5f-4747-82bb-530fb6ed727b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06c3f39b-e991-4da0-b6f4-af3fbfb531dc", "sighting_of_ref": "indicator--d0410dad-ab5f-4747-82bb-530fb6ed727b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3cecf5e-ddce-4788-9950-111b58dd12ab", "sighting_of_ref": "indicator--c78631d6-bb5e-4196-bde1-893d5474b89f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b934a05b-3801-4895-be5d-023ac395355c", "sighting_of_ref": "indicator--3a2e21b5-dde3-4e3f-8a03-2137efe7e2a9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74fa7c9d-d6cd-441a-92ab-4e522e7f7d5d", "sighting_of_ref": "indicator--bd6a171a-3cc0-423c-88cf-ece7e5dc970e", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04d9cf4f-7010-417f-ad55-fff67d36a7be", "sighting_of_ref": "indicator--5b3604c2-4267-45c4-91bd-6f33edd8f99a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce8dc44b-80b5-43c8-a1b7-12cebc113175", "sighting_of_ref": "indicator--1b055245-3b07-4f33-921b-d89f35572e8d", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f7c1bb2-ff90-4d3c-9618-238e26ca7e28", "sighting_of_ref": "indicator--0abc0ef8-d87c-4b78-8438-bfbbcf43c7af", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7dd0287-c3d6-4719-9102-42bdccb4ec9c", "sighting_of_ref": "indicator--14d0d449-e1ce-4a28-a1b9-f5414b5416cc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f3884cd-cfd5-4bb9-acfb-89b799620015", "sighting_of_ref": "indicator--14d0d449-e1ce-4a28-a1b9-f5414b5416cc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a70e613-d80c-4b66-a954-a645dd9cb868", "sighting_of_ref": "indicator--76e66fdb-eb62-4969-b46d-1112c76b5b8f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e944efc-54df-442c-a4b8-93675515a05d", "sighting_of_ref": "indicator--93053910-2b08-4482-b39c-5d1c9149e80c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--393c5ed2-96e5-49c2-800f-7073a1ebe834", "sighting_of_ref": "indicator--28b3be78-3e7c-40ba-86ac-e9d4678c4aee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e74ad49f-22d4-4886-940c-f05e5b194140", "sighting_of_ref": "indicator--879a8d9c-4e02-444a-a46e-0384ee2af743", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--567a1664-dc7d-4f2a-84a9-8d4cf8e99d82", "sighting_of_ref": "indicator--879a8d9c-4e02-444a-a46e-0384ee2af743", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cbaa970-6304-45bf-8984-6f427980f395", "sighting_of_ref": "indicator--f75d19da-df6d-4d7a-ba96-18a3f46af8f3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ac3609b-0652-40da-a340-7a1857e7626d", "sighting_of_ref": "indicator--ba3f0033-70a0-45ec-a5c5-b99bb66898bd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09215e01-8b94-4a45-b093-68ba09b69314", "sighting_of_ref": "indicator--9a73c029-d45d-4e84-b196-6b0f261c7943", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f996db8-279c-47a6-8997-7e80c97edd4a", "sighting_of_ref": "indicator--0f7b1cd1-ab3e-4f1c-9f1f-4b19c98f644c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b79abd0-24d4-4434-b37f-411c4648d74a", "sighting_of_ref": "indicator--392ce689-324f-485b-a290-d06047ab39e5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49380996-dfcd-43b8-947d-7fb565ff3826", "sighting_of_ref": "indicator--b5beebfe-f56e-413b-bc15-25e32009f547", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75cc77f7-6ab1-4625-8113-4ae5d5dc1770", "sighting_of_ref": "indicator--6ad15b89-e390-4e72-a797-491d9bfbe71f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b8fd184-6f89-475e-91be-15f2957f97e5", "sighting_of_ref": "indicator--75d3c2e1-e6a8-48d7-a21b-2ff5b1fc43f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--442ba243-e014-4456-8592-4ea785201dc1", "sighting_of_ref": "indicator--9dfd5ccd-c79c-46ef-9ab5-d4f4552f28be", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8778372-5d5c-464b-803b-ed1864f202d3", "sighting_of_ref": "indicator--704dd470-8977-489e-85fe-d31940bb8575", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35e11eff-c09e-43b1-bf43-f810f8fa4801", "sighting_of_ref": "indicator--de98d8a4-1041-4efc-9458-6dd6b08684cb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cda51a72-42fa-46c5-8089-5fb8797b537d", "sighting_of_ref": "indicator--1ae90e94-a34b-4a91-ac44-328359a59826", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b2fc45a-ee37-4044-a7fb-4af9ba11ccf4", "sighting_of_ref": "indicator--874e9866-3641-4e60-937e-421fa95d9560", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6391c702-5255-4fda-a437-3d94b1c201cc", "sighting_of_ref": "indicator--9609bc0b-d05a-44ae-bae0-292458ad3e98", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75bd8630-a388-4962-8797-1c17af6dc401", "sighting_of_ref": "indicator--a5d84771-fec6-4f1f-b72c-b9e1cb7b83fd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea1191cf-77cd-487f-a5ba-25f88bb11d74", "sighting_of_ref": "indicator--a5d84771-fec6-4f1f-b72c-b9e1cb7b83fd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29c0b7de-d445-4050-be4b-2dd1a9a2b0dd", "sighting_of_ref": "indicator--69171529-e13c-4544-bd91-3818c648d20c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1d83bb5-6e66-419a-a9d2-5e772ef48232", "sighting_of_ref": "indicator--69171529-e13c-4544-bd91-3818c648d20c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e3edab8-d112-4f43-9566-b1c0a9136767", "sighting_of_ref": "indicator--d0146d8c-d03b-4967-8249-7f3e4f085ffd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb5abe5b-605a-4dbb-b8e3-c763cfff47a7", "sighting_of_ref": "indicator--d9e61cca-7a47-406a-93cc-627bab7cfcdc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7030fc1-0375-4661-978b-bc9fadfc73e2", "sighting_of_ref": "indicator--c0ad94ba-b931-478b-a46b-9ff9290c08d4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc4f3b9e-7303-47bd-b3f3-9526b8e3b755", "sighting_of_ref": "indicator--28d86f35-6f13-4bfb-94bf-dc305a3e1956", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b323414d-22ce-4c9a-a6f2-b2538facc62f", "sighting_of_ref": "indicator--28d86f35-6f13-4bfb-94bf-dc305a3e1956", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--090a3693-e725-4968-93c9-c5de82d21dba", "sighting_of_ref": "indicator--d44f5ba4-07d1-4934-9aea-a619f0dc38ba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f492581-edb5-48ab-a6d1-fe56f3321589", "sighting_of_ref": "indicator--c878a448-2938-481b-8612-bddc7a2e4d12", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--373c789b-51f6-4ea9-a050-f54f480715fc", "sighting_of_ref": "indicator--4db05c48-6e5f-4089-ac18-a8e52e2a48a2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39efad8d-6bd0-4af0-a8fc-ab8a6af07d79", "sighting_of_ref": "indicator--bcf5f875-78df-4f85-9f6e-54889ecad427", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9fd9b1b-1da6-40e1-8679-f819bed16fc2", "sighting_of_ref": "indicator--d5baadbb-444a-473d-9025-fa22cf28b59c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1a7f7b3-5aed-410d-bd9f-03409a06207a", "sighting_of_ref": "indicator--1eee04b2-c460-4ac0-b6b2-29c4c4d24e3e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2a407ae-00fa-444f-b8af-4e13f4588e08", "sighting_of_ref": "indicator--005e246b-2385-4c6b-a20e-68f440c50683", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3668971-98b8-4a1d-be23-279029c086cf", "sighting_of_ref": "indicator--5a2ac4d1-d02d-4078-9f8b-8b54f2f6dab7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51c0cd98-56ed-4e5d-afba-ea934844e346", "sighting_of_ref": "indicator--1b9e8c25-4125-44c6-ae62-46fa9233b8ea", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85fa3aa8-6262-411c-9068-7d33fa937384", "sighting_of_ref": "indicator--292e2c46-5203-4dc3-9d77-4a722eb62fea", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78c878fe-4420-4c0b-8081-835efb9af2fa", "sighting_of_ref": "indicator--292e2c46-5203-4dc3-9d77-4a722eb62fea", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da3298dc-5e68-43a5-96dd-66f014da88da", "sighting_of_ref": "indicator--12b9bc09-2241-47db-8571-f113aefee0b0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2697d4eb-a2bf-401d-8405-a710cf06ee05", "sighting_of_ref": "indicator--6b3710a8-3e03-4638-af0b-d8107dc6c91e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d795f1d6-9d99-443b-96b6-659c345e2a45", "sighting_of_ref": "indicator--1805e6c8-09ab-441c-96f4-00a0f73a3b6c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12d06aa3-d61d-426c-9931-ede7c47b95f2", "sighting_of_ref": "indicator--e2461ab5-5244-4eb3-880d-5e9abef6b530", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8da7ed61-b168-4181-8bd2-08fc1c27e90a", "sighting_of_ref": "indicator--a209e3e3-a0e2-4285-9174-870fb3d69164", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9d376e8-81a1-48a1-b035-1bc3ada6236b", "sighting_of_ref": "indicator--9aebc588-3398-44f9-8921-9e618be93775", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9495bf09-8aff-4080-8a5b-e294a62a69b3", "sighting_of_ref": "indicator--9aebc588-3398-44f9-8921-9e618be93775", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--700f5948-ed62-44fb-99b8-ad898cc0971b", "sighting_of_ref": "indicator--277d9812-e547-4dcb-a004-0cc557530bd0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09cdc9ac-1805-4023-99e0-63834fdd7efe", "sighting_of_ref": "indicator--eb6f941d-f78b-49b6-8acb-d7f42061586e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d224c8f5-1353-49e1-a664-464922af1bf4", "sighting_of_ref": "indicator--eb6f941d-f78b-49b6-8acb-d7f42061586e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50ffa2bd-310c-41e7-938d-ae2acc393ed8", "sighting_of_ref": "indicator--3bc21c10-0068-4cd7-8634-b6eed9ba29b3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a7e3518-5960-40d6-b42a-0d7f9074dd11", "sighting_of_ref": "indicator--1b808432-0787-4481-bdf4-cef33fd5c954", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15735853-666d-42b3-88e6-d7f115c1b046", "sighting_of_ref": "indicator--1b808432-0787-4481-bdf4-cef33fd5c954", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5ef3b1c-3553-400d-82c6-87f819de838c", "sighting_of_ref": "indicator--1962c0ab-4707-419b-a036-114ba6dc3c63", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04374e45-d335-4458-978e-fcf2a97d3662", "sighting_of_ref": "indicator--273a9653-baea-4ee7-836a-3021ab1e16d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae07f03e-b475-45ac-989b-81f8530260b0", "sighting_of_ref": "indicator--273a9653-baea-4ee7-836a-3021ab1e16d8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7734871-4577-4fa9-9af1-20535ef13cdd", "sighting_of_ref": "indicator--65c240cd-3a47-4134-bd39-93ce38e25777", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4d377d0-17d6-4a11-9e2b-515b54940c7a", "sighting_of_ref": "indicator--3c768aa9-fa6a-46af-b385-fa0e7113ac89", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50070ed2-bcf0-4129-a588-1c578aa1d87a", "sighting_of_ref": "indicator--36190dc9-0b25-4a23-a6ab-3acc97912527", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0572d114-868c-4e35-88ab-08ddaf6bfe7e", "sighting_of_ref": "indicator--f3f3ef5e-42ae-4230-a78f-4a035b3be7a6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1237877-d58c-4cac-b0eb-9fecd0470c04", "sighting_of_ref": "indicator--2474b06f-efb2-4824-a3fd-f5ee2aa4dc09", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--523bac1c-88fc-4f1c-9b2e-6ef777d7ac98", "sighting_of_ref": "indicator--611222df-619f-4d86-b2eb-67cb0e457de4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90a6b1d0-8af3-4c30-9017-16c9855f6741", "sighting_of_ref": "indicator--9ed1e324-b6af-42e0-b9e4-881c547a6b35", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30f3bd08-05f5-4e0f-b3ed-1e0fbc1ec2a2", "sighting_of_ref": "indicator--8ffbfca1-1c3c-4806-8184-aa6f55743de7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8d58832-80f9-4257-9a1c-3399c7e3ebe5", "sighting_of_ref": "indicator--a08b3beb-3cc6-4ff3-afe8-7b8f3f77dcb4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7662a5e7-b66c-4201-96dd-357591c434b8", "sighting_of_ref": "indicator--a08b3beb-3cc6-4ff3-afe8-7b8f3f77dcb4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56b40225-5075-4acb-827f-c71825a1cc7f", "sighting_of_ref": "indicator--bf32dcfb-1a2c-4e33-8631-ba323a52f2cf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b522b6eb-baba-4246-b9b3-1a74fd21060a", "sighting_of_ref": "indicator--bf32dcfb-1a2c-4e33-8631-ba323a52f2cf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b172216-4ce4-4aa8-a58d-bd7464ed34a1", "sighting_of_ref": "indicator--16ca4510-0a58-4e64-bc4c-33b14667e9ae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc50f1cd-c773-44f1-896f-871719e7ec88", "sighting_of_ref": "indicator--16ca4510-0a58-4e64-bc4c-33b14667e9ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c3aa211-dd34-410b-a9cd-e9116bb9a092", "sighting_of_ref": "indicator--f7ffb125-333d-4f98-bc57-c4819791b88b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49b7230e-838a-4963-9082-2af62284e8ab", "sighting_of_ref": "indicator--83295ebd-366e-4e53-8ffb-ad349d6cbec4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bf89d5e-78b5-4133-bef2-a3cd2684811b", "sighting_of_ref": "indicator--3c9bdd79-2364-4154-9fdc-0a897885164f", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae251520-1aa2-4a4e-a956-2754b6735a75", "sighting_of_ref": "indicator--e65aa2c3-2de7-49b1-a0a3-42a9ae58affc", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea395700-ce5a-4cd6-9eaf-04d2d128c013", "sighting_of_ref": "indicator--eb03113f-bd71-442e-a7a4-a8aa0b437af2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--449b52f3-caff-4185-ac31-19d7e223d930", "sighting_of_ref": "indicator--6f7569d5-1c74-4a37-9ead-29a337ffc925", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--031da9d6-9a25-4ea4-ae02-a5d7658792de", "sighting_of_ref": "indicator--73b0a3db-9f93-4f0b-b940-008c6328d966", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--781ad06c-c577-4e1a-a1e1-889b5661a5ea", "sighting_of_ref": "indicator--dbe1a823-897d-4228-a894-2fae9ae1029f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e0e09fd-e5fc-402d-9cc3-222713483153", "sighting_of_ref": "indicator--73410ba9-e5d6-4eea-9c6a-3392fff665ff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b25d75a1-bed6-4969-bab3-05f2e17285f3", "sighting_of_ref": "indicator--73e1b378-0e0d-452d-963c-4791d19b39bc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b955c73b-b5e3-4391-9326-a76fd62303e3", "sighting_of_ref": "indicator--73e1b378-0e0d-452d-963c-4791d19b39bc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bf02234-8ccb-44a5-9773-b625db4ba5aa", "sighting_of_ref": "indicator--afc07d91-1478-404e-8513-d385198d6a41", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69b7886e-f335-44b3-b23a-04b28206618b", "sighting_of_ref": "indicator--e548794d-8c96-4583-a2fa-34afce0d029b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8b54b65-12cb-4200-8e5c-17de1a9176c6", "sighting_of_ref": "indicator--36b59f80-a1bd-478c-b590-f55168d24bfc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1337f3e6-50c4-403c-b55d-0f01620fad38", "sighting_of_ref": "indicator--c7b05a7f-31a3-4397-9258-8fb86b57fcac", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48401a61-df4b-41f4-b8ba-4970595809b6", "sighting_of_ref": "indicator--ef16609a-0e80-4915-9e81-80f2402a4710", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cdf1476-77a3-4f1f-a5e1-fa7488498b02", "sighting_of_ref": "indicator--ca7694b4-a5c1-4369-ac10-779bdfa99d0a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76570703-e211-4ea5-b2a9-08f1326c3e3b", "sighting_of_ref": "indicator--2f667906-5219-4ecd-95f1-794b86b06f28", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de48d684-5f5e-4e11-921e-6d1ef6003c6d", "sighting_of_ref": "indicator--1c9882af-7217-4385-9dec-6e173b5cf72f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7d5ed07-557c-452d-b948-fb72bad5ad6a", "sighting_of_ref": "indicator--7fd17c22-b6e3-47df-bc21-73c6864e99cd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d92271c3-6cfb-4b35-a63b-8fd950af9178", "sighting_of_ref": "indicator--6de7c0fc-628a-450d-8dfd-d136f57aa25d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--939ca8be-aff8-4b68-9913-1fa960ecb419", "sighting_of_ref": "indicator--abbb28fb-3552-4067-bb88-9477cab90499", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52cdc66d-ec24-4939-916f-0b2c2142dcb2", "sighting_of_ref": "indicator--1cb6f322-2c92-441b-baae-809d9529a3b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aee1b2ca-fe8e-4b11-a7e2-6b6b0455a37e", "sighting_of_ref": "indicator--1cb6f322-2c92-441b-baae-809d9529a3b1", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76841773-1652-415e-8214-e76c99c4d719", "sighting_of_ref": "indicator--df6674ce-cd4a-4b22-850e-b2dd1192296b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--284df1e8-3db4-4ced-9a10-7ee929169451", "sighting_of_ref": "indicator--23ebecd1-717b-4877-ac38-68078c3f30e5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9a4117b-51ec-4200-9bf8-f523ee7eec96", "sighting_of_ref": "indicator--9b7adfc1-db86-4a23-aa4b-cd1837cdb6c5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb8c5c93-1556-4fb9-b984-af994fede485", "sighting_of_ref": "indicator--7ead3a18-a203-46ec-b99c-0ddf8fff5f68", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c906563-978b-4d12-8fa9-317eea6022cd", "sighting_of_ref": "indicator--270a0db8-2700-4266-9c76-90c0c3d84f0d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b5f2d79-aa4a-42c7-ad85-11a0773718c9", "sighting_of_ref": "indicator--605890bd-504d-4f7e-b9b2-933564489626", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd5198dd-7606-427c-a33e-93f5e0b2778b", "sighting_of_ref": "indicator--24d2d175-002d-460c-9781-b9532458d1e0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75c8737a-0297-4564-ac56-c29e1a1e30cf", "sighting_of_ref": "indicator--94c1f9f8-7719-4164-910e-4de971fbeed5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b27ffe2-7ebb-4c2e-8e4a-1bf99ea79710", "sighting_of_ref": "indicator--9b92e983-e5ea-4ddf-9065-b358ac525d33", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45ee9d84-1f80-4ad9-99bf-f1df2b621892", "sighting_of_ref": "indicator--c6309f2e-676a-40e3-ba4b-00df920321f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--911912a6-e600-43d2-819d-489ba1e7a98d", "sighting_of_ref": "indicator--eb022edc-7400-4614-a464-55b8b8d94d2c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ff8e3d2-ef41-4567-9674-cb24b425dc7e", "sighting_of_ref": "indicator--235b829d-b6b7-4e04-a2cc-f954ad808d9a", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63285548-b35a-46f5-93f8-577d8895927d", "sighting_of_ref": "indicator--5e539114-3f31-4eab-ad90-bc299a43b68f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd8d3c08-70dd-46f8-8a64-dfb1a133e81e", "sighting_of_ref": "indicator--188bc0b5-c7ea-425b-bd13-efd94260dbae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95d18576-3c6e-4f59-915c-d3ecb1774239", "sighting_of_ref": "indicator--e23d86fd-d1c8-4575-8d3c-a8f4d50386e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a696600-cf69-4d84-a4f8-9291f1c039b4", "sighting_of_ref": "indicator--e23d86fd-d1c8-4575-8d3c-a8f4d50386e1", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80018bce-982d-4052-a651-3491f4a80ded", "sighting_of_ref": "indicator--a34e9ce5-a6d1-4658-9019-3596ac1f8b62", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f95c550-422d-4ff6-b057-264d1e7f58e7", "sighting_of_ref": "indicator--c9beaddb-c754-4e63-b154-c2e6221f638c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23a55b9d-486d-4cd5-b19a-d90ac2a32f5c", "sighting_of_ref": "indicator--6a23fd9d-d8bc-4aa8-ab05-449a89f7fbf3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dd09f6e-7044-4860-8355-dcc2fd0ba157", "sighting_of_ref": "indicator--99171642-f254-498b-b7ff-52a062e1adc9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89d26945-0439-4fbd-8bd5-ce73a04cf749", "sighting_of_ref": "indicator--c1687e74-598a-4cca-81d7-2dfeb0c7d43f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d5c3da0-c0b9-4120-887c-074eaf297e03", "sighting_of_ref": "indicator--05da7b37-a0ad-423c-9e0b-7eed3e2031d9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ab26ca2-c3c5-4fe2-becd-13963b08025b", "sighting_of_ref": "indicator--530bd894-8018-4914-ae44-ea6ad1f0cdb5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c333555-75fa-4378-a699-878f8a486543", "sighting_of_ref": "indicator--323b348e-2044-46a0-a5ea-bf042af4cddc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--236ae99b-1e86-4996-a4f6-8562d3a26072", "sighting_of_ref": "indicator--6d26a208-1b36-4772-a630-24543445a031", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef5f9a53-ed9a-4702-b45f-22d0e5530368", "sighting_of_ref": "indicator--123fc972-0559-4f22-9de2-e8dc5750eabd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ffb0d9c-f13e-4604-8737-88e2c8074773", "sighting_of_ref": "indicator--e6efad58-eb43-4bc5-91f8-cd62b20ecf59", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5c06483-f628-43e0-ba36-ab06f6fd3d76", "sighting_of_ref": "indicator--fbb73a75-23e5-41b1-96c9-2f80bff18097", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2cc716c-b600-4e22-bafe-99f8b5beadd0", "sighting_of_ref": "indicator--0b94a57a-fa4e-4e48-9d7c-2e7969a33873", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b429e152-540f-4740-a721-123b9c8b4c2e", "sighting_of_ref": "indicator--2b66f6a0-6826-447c-b70b-1a423025772e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2dc6e63-877c-42c9-95d7-1e607214ee72", "sighting_of_ref": "indicator--9dc845f5-935a-4d1e-a362-5fbfe7103c83", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad8a9898-21e4-4ae0-9585-7930955482f5", "sighting_of_ref": "indicator--d19e0b79-b4e6-4942-9217-07aa78f27aeb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--329b1ead-fde1-4369-a9d8-4c2881032a3a", "sighting_of_ref": "indicator--c0377e1a-8821-4edb-b998-0e6f9fc2f4d3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf01de0d-a001-45a7-a81a-dd23522ad222", "sighting_of_ref": "indicator--5065c92e-656d-44c0-a8af-fbdfba46777d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c5178a1-b62a-4476-9d4f-202f23d23ad2", "sighting_of_ref": "indicator--e83a720d-da33-4640-a0e4-bc724e96b576", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7260e910-f59b-40c7-a72d-bc594b643b7d", "sighting_of_ref": "indicator--de17a8a2-6302-40f5-b88b-7b5ca83844f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2faf92fe-6bf5-4b8d-9b96-f6e3fdbe7a1c", "sighting_of_ref": "indicator--e4d3ae94-6574-4218-995f-a2f414123ab3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b06c927-3f2f-4f14-95c0-7067eeb2e4a8", "sighting_of_ref": "indicator--17c35054-2bb9-441f-baad-e05104238a03", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6352c97c-4db0-4b04-b078-0002d3c900b3", "sighting_of_ref": "indicator--f53b0ced-544b-4659-983b-f4a09d9cf57a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05fcf255-5c9a-46ed-b4d7-449ac721112e", "sighting_of_ref": "indicator--7142cee9-0f18-4f86-83cb-b3f870194935", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77788bdf-584f-442d-bbb0-3adc1aa7d1ee", "sighting_of_ref": "indicator--f8f61fe3-c01b-4cf5-8fed-742090db882f", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40719034-e1c9-4969-834c-a7dff147acbd", "sighting_of_ref": "indicator--db6bf9d3-fc6d-4bf5-8b20-7481d52c108e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--816935fd-843d-4a9c-a826-0f7dc4a3c1e4", "sighting_of_ref": "indicator--e859fee4-e68b-42d9-9ddc-cff478222063", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13e62092-e338-4f29-9e0d-35ca2797698c", "sighting_of_ref": "indicator--0016491e-0cb7-4cf0-b306-713af4ec1917", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b80f755d-f7c3-4752-a588-659066aacd0b", "sighting_of_ref": "indicator--c313e7df-5550-4919-a578-a9fe5709547c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07c2c5cb-7ea9-4544-a6bb-db1112c7f6bf", "sighting_of_ref": "indicator--c313e7df-5550-4919-a578-a9fe5709547c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67997073-81a2-4cf0-9fa5-eba85825875b", "sighting_of_ref": "indicator--54425465-585f-41e7-ba06-2a48bfc87c59", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25fe37e7-eea9-4569-902a-fda5b550773f", "sighting_of_ref": "indicator--54425465-585f-41e7-ba06-2a48bfc87c59", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d75f0d3-2fdd-4acc-9f06-5f1c6664f2d7", "sighting_of_ref": "indicator--7aa61620-1046-45c5-95b6-dcc34f115010", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3c0d01e-363a-4cdb-a35c-99677375b899", "sighting_of_ref": "indicator--9d0ca7ca-016a-4d43-852b-8aa1ba599ff6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--168a0a39-d5b3-44fa-9b1c-ed02d8490029", "sighting_of_ref": "indicator--5c51b942-ac6e-44e2-a960-0082ba1cac15", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66e5bba1-b22e-48e8-b74a-e1f4d731fdb4", "sighting_of_ref": "indicator--7fc7d9dc-87dd-4064-b78d-92778d289964", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--108a7527-ea32-4c72-b808-baecf8d00d76", "sighting_of_ref": "indicator--135fde3d-dcfa-418a-ae13-642d5d3094c7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bab4351-a253-4c5a-b7c4-ac7df6ee393c", "sighting_of_ref": "indicator--5a7bc3f5-c173-4455-84ec-58475a5d5c08", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acbaef42-bbbd-48e1-828c-9afff68c0c12", "sighting_of_ref": "indicator--18e2505e-09c1-40c3-b085-e375c41c16b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6befe02-efcf-493b-9838-544b527b42a0", "sighting_of_ref": "indicator--18e2505e-09c1-40c3-b085-e375c41c16b4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f860c2b-67ca-47e1-8174-4e8a34c26a50", "sighting_of_ref": "indicator--5767e769-7a07-4c3f-939d-2bce6aeddc9d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86ec9a05-95fc-4b30-bdf2-7122fc498a7a", "sighting_of_ref": "indicator--5767e769-7a07-4c3f-939d-2bce6aeddc9d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52e1e6d3-733b-4a9e-ac28-89d1f6a07374", "sighting_of_ref": "indicator--5faafcf7-bd2d-4da1-8c70-500ea7d80d06", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2f183e2-0010-403a-b54d-05947eb25659", "sighting_of_ref": "indicator--8f57231c-62f6-4222-a7e9-ae4f61a61c2a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0cd626f-6465-4ec7-b86c-803ce4093571", "sighting_of_ref": "indicator--dc116c6b-ad3d-47d5-bf00-dcfa754c49bd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db150833-a7cd-4798-bf09-6cfefddeba89", "sighting_of_ref": "indicator--db238649-e4bc-49b9-859f-1eb38d90aa9b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8913a8b-074f-4804-84ba-e328ba022d39", "sighting_of_ref": "indicator--2b823d12-21e9-4578-aabd-eef3c07b71d8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66753cc2-c8cf-481d-b699-d7669de9fa0b", "sighting_of_ref": "indicator--fb059f2f-0518-4aff-a1fc-a446d3937cef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b0af3f2-9118-4bb2-b2d3-b7bce6232204", "sighting_of_ref": "indicator--e955ece9-e48f-49e1-a5cd-da9c61f07ed1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f93236d1-6cdd-4be8-a4de-8f793dd634b8", "sighting_of_ref": "indicator--d607f1fe-f55a-4a4f-afed-ca3953779797", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa293733-1abd-4e2f-bf0c-fea8d5e274f4", "sighting_of_ref": "indicator--c15c1a23-9306-407c-bc08-53c503ceb005", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--478766a4-1ff4-4c43-b739-4c5286dcbd38", "sighting_of_ref": "indicator--ce286532-258e-46a1-ab5c-affb5ad0e2ef", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b44ee90-460d-4b88-92ec-e2091b2b9dca", "sighting_of_ref": "indicator--176462f8-c7f5-42e4-8680-845db0a0481a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a848be5-492b-4296-8f1e-548e45b44898", "sighting_of_ref": "indicator--ff29db37-558f-41ac-ac5b-2a1bbdbcf157", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fd9e119-b973-4632-ab3c-084592373aea", "sighting_of_ref": "indicator--5d6526e7-1a65-4061-91e5-2349b4129055", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ff9c38c-9db6-44eb-9508-e800594b0e6d", "sighting_of_ref": "indicator--9b78a3ac-840e-4e0c-afd2-3ee8b6d004b1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbcd650e-578a-47fe-9d8d-a51e8b73da7c", "sighting_of_ref": "indicator--c1837d5d-83a5-4b79-87d0-cc1b93342039", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a502d308-2147-4068-a8d5-9b9cf1bed064", "sighting_of_ref": "indicator--c1837d5d-83a5-4b79-87d0-cc1b93342039", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f8fa326-72bc-4ae7-8439-6228dd498ae6", "sighting_of_ref": "indicator--30530551-fd4d-4b52-8368-538ff9be9317", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71094960-8fdb-486f-bde3-a8e2437483ed", "sighting_of_ref": "indicator--2a8d4f29-fe3f-4280-b0cb-98cfa662daab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae4680fb-1dd2-4cab-80a5-1e7c379c4a8f", "sighting_of_ref": "indicator--d8267ba4-637e-4db8-bcb9-08d04f828f89", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79b323d1-3ea4-4e45-be91-933d64abddc1", "sighting_of_ref": "indicator--d8267ba4-637e-4db8-bcb9-08d04f828f89", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bac7008-e5a1-4b2b-a841-75f3e6d3023f", "sighting_of_ref": "indicator--6ec6b33c-6f7d-41d8-908f-c70d438ce1b9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3544c31a-036d-4cbf-96da-3a5b8f0d00e3", "sighting_of_ref": "indicator--6ec6b33c-6f7d-41d8-908f-c70d438ce1b9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dc959b1-d668-4ac9-b12c-7b7dfcee1ccf", "sighting_of_ref": "indicator--68dcc4f0-bbe6-4ddc-ba33-aaa869a700a9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91ecf1bc-dde6-4909-b14a-657e92a13531", "sighting_of_ref": "indicator--68dcc4f0-bbe6-4ddc-ba33-aaa869a700a9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9529fc4-1d59-418e-ba80-d7f8be904a4a", "sighting_of_ref": "indicator--e447463e-ed3d-48af-80af-cd0d3306fb84", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e5f02fd-ba2c-4a63-961b-4dd967badb9a", "sighting_of_ref": "indicator--e447463e-ed3d-48af-80af-cd0d3306fb84", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28dc5a36-52d5-48ed-9ecf-9d63cebe5287", "sighting_of_ref": "indicator--aa443227-92db-4c61-bc3b-6859b79e7480", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1806a18-90a7-4999-9abb-56d370dc8911", "sighting_of_ref": "indicator--aa443227-92db-4c61-bc3b-6859b79e7480", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48cb20cb-4f65-450f-a9b9-e82c6f69417c", "sighting_of_ref": "indicator--5de5fb19-a237-4ac3-93f5-e6180dba9782", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fccdb419-dd9e-4766-9bef-ebca2bfa2824", "sighting_of_ref": "indicator--5de5fb19-a237-4ac3-93f5-e6180dba9782", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4702c37b-5b16-4719-b9ea-6f2072e0628c", "sighting_of_ref": "indicator--efcb7a75-54b6-4cf5-88a6-20518f231e67", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7da14f25-15ab-4191-871f-a6f49ed17ff2", "sighting_of_ref": "indicator--8b4a9356-5d1b-4dfd-8034-9c63e67b472a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cdf16ab-76f6-40d2-b16a-036db6f9ddf3", "sighting_of_ref": "indicator--7780a6b5-8659-492b-b3c8-67cdbfbe875b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2c4b77f-3dfc-471e-8643-f2f28cfa3de7", "sighting_of_ref": "indicator--0b3717bd-7110-488e-9a4f-723806e1c19f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c9ee33d-d3ab-4a30-a168-d0ba1b5730e9", "sighting_of_ref": "indicator--adc20e1f-1678-49d2-bf22-71253e88419a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a6262d5-cf47-4839-acb6-59af22862c65", "sighting_of_ref": "indicator--5fc121a8-d5f1-463b-a8e8-d2237b3ca7ed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7a27ecc-9715-4a8e-af37-86cb39c3cf95", "sighting_of_ref": "indicator--8e0fe587-cee3-46c5-a041-f1d4afd36acc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60f15f25-cd19-4034-a66e-738b32934c48", "sighting_of_ref": "indicator--6fe28ce4-cb8b-4dd7-9eb8-6628d54119de", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--018a1b82-be41-4bb6-a0a3-0a89b9b1804a", "sighting_of_ref": "indicator--49a093c8-c2f4-4cd3-8294-4c86e42a4531", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73185f55-3bd8-4501-a5c3-b214662349a2", "sighting_of_ref": "indicator--64a1fc87-200b-44c0-be0d-d898ed026ac7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcbfa272-9a3d-425c-a69a-a4aac833074b", "sighting_of_ref": "indicator--93c38c29-5960-49bd-8441-a8fd82d956bf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c74c7ca5-cc78-466c-a14a-e771ed70747e", "sighting_of_ref": "indicator--986360fe-27ba-48ee-9f99-d1dfd130b075", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a58489b9-f1c5-430b-87e3-d8dcd184c7b5", "sighting_of_ref": "indicator--0cb988bf-f5ea-4eff-baca-0d4d1502fb2e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d294658-ecc2-49ed-b4da-d64d71090fde", "sighting_of_ref": "indicator--af77817d-c45b-4603-a286-67f187ca7322", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4e6ef11-ff8c-4ff2-a80c-237bc7bc8cae", "sighting_of_ref": "indicator--242f31ef-b41c-4bb6-9a9c-917acfdef316", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b263a9e-75c9-4c74-9959-070b9fe33c55", "sighting_of_ref": "indicator--a94e8603-f660-4481-9349-66982db9e506", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b59ca97d-e10e-48eb-be35-7629b9e23e1f", "sighting_of_ref": "indicator--1ce641eb-9483-4531-91c0-8b90ce2178b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6049b020-57a3-404f-ba68-d6d641f80b65", "sighting_of_ref": "indicator--78a5f248-a2b3-4d9e-940c-88800672fb25", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edc0ffce-34f4-4e0b-88c7-4006bdf84f8d", "sighting_of_ref": "indicator--a751f452-7642-4722-b339-ce31184daa42", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdcd609f-7b9a-4b7e-8074-75563c0f59ea", "sighting_of_ref": "indicator--a616b904-11b4-424f-ad8b-79cd03da9e94", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a36f1f77-b74a-4db1-933d-fec06b9b798c", "sighting_of_ref": "indicator--86a46123-5381-48d8-b19d-0d8b63ae6135", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54191f6a-1685-4ff4-aa70-7df1f8ecd90e", "sighting_of_ref": "indicator--4fefd901-3f74-4d9e-9d73-4acba0d732f9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b918485e-f505-4389-9222-968c62ec5ae8", "sighting_of_ref": "indicator--1b489b84-81a1-4709-9f18-dc2bdb96ddbb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c088c90-a155-4623-9685-ac8a9b2d8f64", "sighting_of_ref": "indicator--3a858e9d-caaf-45dd-a928-aa19e113e329", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34f52bfc-dcb3-4701-9af8-c158c28b382b", "sighting_of_ref": "indicator--33f78a3a-3a43-40c7-802f-a782531d5c0a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f649181e-9dea-43cc-a618-c9da1723c66d", "sighting_of_ref": "indicator--7b578111-3f4b-4ad4-9c66-a2a3f50ef1d7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67339b56-fb8e-4560-b173-b5758aff1fca", "sighting_of_ref": "indicator--4b148cc1-ae8a-4d7d-ac52-37a32ef20307", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93835f77-a223-4773-855e-d14498cf288b", "sighting_of_ref": "indicator--722b29cc-9ffb-4a68-bb69-05b0381750ac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b873570c-ce2d-4dfb-bf75-b50320dabc57", "sighting_of_ref": "indicator--4081938b-e183-43fd-9f13-9f08ce7b8bae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69a57a61-32f6-493f-a601-e1cae2dc029a", "sighting_of_ref": "indicator--4081938b-e183-43fd-9f13-9f08ce7b8bae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34a81d2c-9741-470f-87cf-346a983e8763", "sighting_of_ref": "indicator--ae390d28-3ac6-474a-bc5f-ac2e3c727184", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51be56e4-8ccd-4c9e-a8ff-2412533f5084", "sighting_of_ref": "indicator--271fbb85-b0f3-4d2e-8a2c-6ada7846129e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e228672e-8ec4-402b-a59e-ef732aedf911", "sighting_of_ref": "indicator--9432d218-3fcd-4f7f-aba0-4eefdd1cfd0c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e435c2a2-410d-4348-b322-81bc0bc57909", "sighting_of_ref": "indicator--a959fb56-9217-46e9-ab8a-20ff9bafacc4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a4a2257-7f25-495b-b070-8f40d03e3ce3", "sighting_of_ref": "indicator--f3ef17f6-1435-4bb0-9218-0ede07c4324f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07d434a8-191f-4f29-9832-4821217abfb3", "sighting_of_ref": "indicator--50e5b59d-e796-455e-bf7f-be3ce1daf484", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6178ed1a-dbc9-4299-b013-f7ee8bcbd036", "sighting_of_ref": "indicator--a2e646cf-caaf-4867-a678-d7b426529c53", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2aad275-6d3f-4f1a-979b-bccca46648c4", "sighting_of_ref": "indicator--4870cf2e-bd54-4677-b175-a035c0d79719", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b582619-9473-4304-9cd3-4efacd4d7769", "sighting_of_ref": "indicator--9b5e883d-0e90-448f-8861-302eb48ef105", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cad64526-367a-4655-a7a8-42093f738f99", "sighting_of_ref": "indicator--39e2496f-822f-4735-a35d-6edd5fe52962", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ea93b0f-fd73-481c-ab7e-b6fb41be82cd", "sighting_of_ref": "indicator--39e2496f-822f-4735-a35d-6edd5fe52962", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0933a3e-e405-4937-a5fb-fb3f49d7ba72", "sighting_of_ref": "indicator--2a38be4c-5aa4-4310-9d17-d29bb1b369b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49c51a09-4d65-47f7-8283-4729c348decf", "sighting_of_ref": "indicator--1cfc7410-4ceb-47ea-ba3d-305b7f698aa8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a134470-d8e0-42b6-ad79-27633f07cca3", "sighting_of_ref": "indicator--f7ccf416-0ee0-40e7-ad2c-e233ec5e154e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09fb185f-8c86-4c3d-88a5-8626dd5a0ef4", "sighting_of_ref": "indicator--fde379ac-baf4-40ea-a0ab-461f689b423e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03f30778-9d79-4202-9ee2-5ec53fe3d536", "sighting_of_ref": "indicator--ac2d29d6-13ce-4198-b60f-60d5504bb710", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98de174c-a8b3-4480-9959-27b7f036e6d5", "sighting_of_ref": "indicator--63231864-fd8c-48c8-bb17-6a291a06765c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac875ec-5329-45e1-ad87-583ddd3e4b76", "sighting_of_ref": "indicator--33118a62-ded4-437c-9ce6-5dddc157fbb3", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16b65572-f2d7-473e-b3f4-60ee78e21d0b", "sighting_of_ref": "indicator--837f4bb7-e3c5-4497-89be-3559f0a20e4e", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--171fddb9-2df2-4fe2-8931-b5dfbf4cc7ac", "sighting_of_ref": "indicator--b3ae6ffb-73bb-4274-bdcc-39e851a7b823", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53b55e90-eb38-424f-ae09-ef821d5fc600", "sighting_of_ref": "indicator--4b4ef746-fd06-4b0c-9f65-76b3cbc478b8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bef59cca-b042-4928-a4b0-e583774fcbe8", "sighting_of_ref": "indicator--d2758060-7617-4680-ac8b-c65ffc2902eb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a409153-91ad-47df-b723-d285f974a45d", "sighting_of_ref": "indicator--cfebb531-6e5f-4f69-8a7d-8ff7100e71a6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbc03512-f716-42fb-b155-b6901aa4f1ea", "sighting_of_ref": "indicator--daef13c3-c88e-4e28-91e1-298497768a4a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17ce34a3-3bad-4c8b-9923-a6608bcee140", "sighting_of_ref": "indicator--b97194b2-b5b8-4df0-a7b4-b7a4aa00e160", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e7909ff-6ab1-446d-9086-4a1fd9a7d004", "sighting_of_ref": "indicator--b5578b04-9a2f-4a6e-8a05-c4be44f9f32a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--740adb11-aacc-499c-a907-57f69d01a4a5", "sighting_of_ref": "indicator--fc7434aa-41b3-4eb9-b1d4-dc0c685c5448", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27049940-2cf0-42d2-90cf-70cdd5715027", "sighting_of_ref": "indicator--59dfa133-6a77-4270-8b6f-36186ae19ecd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40563048-4570-4da7-9ee2-6ff76d88f87b", "sighting_of_ref": "indicator--1e55c018-cf98-4f26-8366-b350aed3fa78", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23eb6a91-d241-477f-a304-db5794364f24", "sighting_of_ref": "indicator--3fb5477c-25e9-4ed2-b6c4-8e5ef3734f75", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a5e52f8-a0fe-4413-b572-95eedd34a4db", "sighting_of_ref": "indicator--a0de103d-52ec-4020-9e7d-9fceb6186fb1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd45fce1-e233-48c2-88bb-2f042642f0e1", "sighting_of_ref": "indicator--e9810eda-591f-4a64-9beb-ec89f2e7e609", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc37936b-e607-4749-9bfb-9f6f5f505281", "sighting_of_ref": "indicator--a5cd8667-2f91-4b23-a57e-df0056af2d41", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6019109-f339-4d4b-84d7-003ae48938e9", "sighting_of_ref": "indicator--5e39d276-6500-4a40-a282-b4f660b1ca07", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55fc57f5-a5a0-4e92-a5b5-ec9973d7e7fa", "sighting_of_ref": "indicator--29b3d3b7-07dc-40db-9b4e-1a8df3036cd8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25378c74-82ea-46f2-b565-b7694d703744", "sighting_of_ref": "indicator--0233e5a8-bc82-4362-ae54-5bf742f95788", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd37e330-a205-42fb-becb-d770e3fbbc98", "sighting_of_ref": "indicator--bd9fb550-2676-40dd-a5a8-c7a57228b51f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc5f75ca-724a-4275-9339-5c967505af23", "sighting_of_ref": "indicator--cc2d0837-b489-4a31-8eac-805781c02c19", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a7edca1-9396-4d34-96de-ca68621b715c", "sighting_of_ref": "indicator--eaaedc76-38ae-49ea-87b4-db42cd5c0645", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49c44be0-7abd-408e-a9cc-daa959695633", "sighting_of_ref": "indicator--4fab5a2d-c456-45f6-b906-356b0296eaa7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ba5f25e-d3e0-49b6-bbac-c5dfa5c62a38", "sighting_of_ref": "indicator--20d8c1b5-e8fc-4e19-9bd9-fe124ac36d98", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--680678b3-454d-41e4-bdc9-6b61140aaffb", "sighting_of_ref": "indicator--a48236ea-8aad-4a30-9999-54af6b6d09a3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02b1950c-98b3-4246-84f6-38b18d58ddaa", "sighting_of_ref": "indicator--0dce28ac-421d-4084-858f-149af9f57161", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5563fd95-be3e-47b9-89b9-689c04dde5e9", "sighting_of_ref": "indicator--04e25f67-ac52-4863-b953-f4a9106b8cf7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc113a40-1d20-4351-8236-898d0fac7e3d", "sighting_of_ref": "indicator--36396d20-8cfb-4d85-9501-a070ce83dd42", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f9344ca-b353-49ca-9e59-a09044cc8960", "sighting_of_ref": "indicator--b1e2e833-897f-4c83-b692-67dc0b21d592", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d9c5208-65f8-48b9-a865-367f2819d702", "sighting_of_ref": "indicator--806b0728-a927-4d11-b491-b8146087599a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b93e2338-1955-4387-991e-5fb1cd33a12f", "sighting_of_ref": "indicator--cf919c49-b867-4dee-9474-d6d2d49eebde", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bc53aad-e7b7-49ad-8c4d-26cd482e0c07", "sighting_of_ref": "indicator--b2072c9d-8afa-4606-8d61-4c0965cd36c5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a7a34ef-badf-4632-a18f-f56baeee7dfa", "sighting_of_ref": "indicator--1e10b809-10a9-4288-a1f8-d37780b91758", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9b3c108-a337-4cea-9bc5-a1ac088e9288", "sighting_of_ref": "indicator--40c9fc9c-4087-4a9e-8cd7-244b9b6d0fc1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e4add9f-d7e0-42c1-932a-aeb25c73b078", "sighting_of_ref": "indicator--4101afac-cef6-4046-82f6-3354bb052007", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a895303-6aed-49b3-aa7f-f31b1d33349b", "sighting_of_ref": "indicator--29f8179b-a7cd-422d-9977-9dbfc36f8253", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cffadb2-7c95-477f-a576-953124371114", "sighting_of_ref": "indicator--088b923e-84f0-4b57-bbcb-1a318527e384", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18ddfb0b-33e7-4790-a3bd-f37a8d011acf", "sighting_of_ref": "indicator--4f56ba66-42b7-4a3a-9e6d-f2d15e14f6f4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd126cb5-ea8b-47d3-9574-f80e1eb756b9", "sighting_of_ref": "indicator--bf25062e-bf8b-499e-9015-e4db7114edf2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01b0f410-ac52-45ae-acf3-c875e748d36f", "sighting_of_ref": "indicator--58572f76-0064-45b3-bf81-70eba4906c50", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03ffe92b-e9c9-4535-a82e-554460a39e1e", "sighting_of_ref": "indicator--6cc03f51-68d4-488f-9a7d-c5b8d08830c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4c0e96a-1bd3-4974-8b1b-0bb079acda50", "sighting_of_ref": "indicator--9943b363-d062-431f-b1a7-11d39faf58da", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--754ee66b-72fc-435a-a5da-310a87dd2bf9", "sighting_of_ref": "indicator--cb59b242-2e24-40b5-9256-3d5f7993060c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c857c858-12ab-4a5b-9041-1f70b96b4ae5", "sighting_of_ref": "indicator--6ad11965-02fd-4ac8-944d-005fe33f547a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7240638-6a45-4514-a9ac-1b665b0a6a69", "sighting_of_ref": "indicator--ca759a33-acfe-4504-b26f-553398f13247", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6042a0c-4250-4f12-9ec9-92570db82560", "sighting_of_ref": "indicator--57d7eeb7-1ad1-4440-836c-259ad5995070", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a39ce99-68f9-45d0-b8e7-06944b5bfd88", "sighting_of_ref": "indicator--68d08bba-10f8-437e-a20b-4cf92ce7f3a9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9907013c-c175-4023-a841-8e5f1b206a75", "sighting_of_ref": "indicator--8d76749d-98ff-4d0f-a309-b6ae345a18ab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80c5b4be-18f2-4206-b0cf-1de2aa73d6d7", "sighting_of_ref": "indicator--ff052259-cb25-4027-add6-08022c0b3f69", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--035cbd40-c72d-4711-b8de-656d78faf8c6", "sighting_of_ref": "indicator--e8b670ea-deeb-40b1-ac4d-151d76b7425e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--690a86be-f431-417e-ba3c-d6e82988feff", "sighting_of_ref": "indicator--5435f829-a12a-4969-a3c1-ae522b4b7229", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--209028ce-b8a9-4591-bf71-c6bb9302cbf3", "sighting_of_ref": "indicator--750ec737-e559-4e11-a955-073110aac611", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04991cd3-1d10-4592-b1df-046f9fee0955", "sighting_of_ref": "indicator--7879c28e-6830-46b7-8faa-55c17cc458f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c8ad08d-8786-4704-8203-5dad739e3007", "sighting_of_ref": "indicator--d9c59d99-c5e6-4f03-8db0-1a1f51dc9bf9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e0718a4-701a-453d-b47f-31aaec56e158", "sighting_of_ref": "indicator--e76262ad-00fd-41af-ac23-ba39db287de8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c47cc335-f0b9-48b3-937c-607a7deb43d3", "sighting_of_ref": "indicator--52704714-3baa-46b1-bce0-37087d26e613", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6939c1b2-bcdc-4f4c-9b65-40c14f609554", "sighting_of_ref": "indicator--70dec8d2-1fe6-4881-84e5-42fcbc15bcee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc8a2a2a-52b3-42e0-bda6-347ee5b71dce", "sighting_of_ref": "indicator--7fc22889-d7fd-4a5a-86ec-d8f1e1151697", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62dc36fc-b60c-4000-94cb-9786661673b9", "sighting_of_ref": "indicator--c47c5f5e-8dc7-4013-8faf-6b2f617ee4d7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14156fea-4c23-4d94-bf10-22a9bcd1a800", "sighting_of_ref": "indicator--71412eb9-ac8c-4bdc-b2b2-f94f610ec5ed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6de7c7e8-3bb6-416f-b29f-170f36bb4b55", "sighting_of_ref": "indicator--86123186-7f16-4c7a-967f-95aa7a7d69a2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97e61266-3482-49cf-8ab3-c899d0131c1f", "sighting_of_ref": "indicator--02b77c47-f4c6-4e9e-8890-538ccadccdac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acefb607-d42a-48b3-b810-65a6a62d33d4", "sighting_of_ref": "indicator--02b77c47-f4c6-4e9e-8890-538ccadccdac", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--189fbe1e-1473-45f7-b41d-3113eafc430d", "sighting_of_ref": "indicator--607b40ad-46eb-42fd-9fa8-e76e06dba581", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86839884-358b-45bc-8386-cd047db93262", "sighting_of_ref": "indicator--4cf78878-b9fc-4283-82d5-95620a132575", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9cb6f19-8bc6-4ea8-9f57-b7f6c2806123", "sighting_of_ref": "indicator--9366731a-c8c0-4c98-9f5b-8cb6725799ae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86b31229-1bf9-4590-a982-077d20b1d0cb", "sighting_of_ref": "indicator--81b7dab7-1931-4547-8638-2de22052dc97", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfabbc8b-955b-468c-aafa-b049c223be6b", "sighting_of_ref": "indicator--6d7e553b-dbbc-4e93-b43d-cbe6a4bd7485", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7022baef-a4be-495c-ac30-06be5aac2667", "sighting_of_ref": "indicator--a3584089-21e6-4b98-b242-2693eedb282d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f36e11c6-4d96-45d1-a0db-5d96b76ac238", "sighting_of_ref": "indicator--ad7d75c4-75ac-4aea-8044-e3cfb6adf276", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--798f6c1c-864a-460a-831d-0dcffef8fca2", "sighting_of_ref": "indicator--0d49e6f0-afb5-4ffa-bd2d-1f46d5253404", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faca145b-a2d4-4d6d-a47a-809fe0df762a", "sighting_of_ref": "indicator--7639949b-d875-4815-a691-108aeeaced30", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26a54c77-7648-4f3b-ba3a-e443aa68c81a", "sighting_of_ref": "indicator--258059d6-1cfc-4646-902e-833d44c3dc0f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--477fd501-fbe6-456b-9e32-a85b9b80fc0c", "sighting_of_ref": "indicator--9ca05cef-f520-4e44-8624-73ae4e927396", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18bee0e5-a6de-4d52-aef8-ac73637c9a91", "sighting_of_ref": "indicator--9ca05cef-f520-4e44-8624-73ae4e927396", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04ccdc38-2e01-4142-9226-6671bd623703", "sighting_of_ref": "indicator--bd3f0ce7-c810-4f8b-8267-b3289424faee", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c50273c-87e2-4213-8e65-79b657030524", "sighting_of_ref": "indicator--e222d7fa-84fb-4e5b-8fc8-9e44e05b16dc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--419f4a96-9adb-4728-9f76-f9d013d821b7", "sighting_of_ref": "indicator--2cd3be0a-e866-4043-a9e9-3e24b8b1c094", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--339b67e8-0057-419e-b45f-786de6a482fd", "sighting_of_ref": "indicator--fdb7550a-59d5-4f16-82b3-75333c0c4d2f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32f0fca6-96e6-49c1-8646-a9eee63d4a2d", "sighting_of_ref": "indicator--07436092-640c-4cd0-b83e-2e313cf87b74", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c213c1bf-d00d-4395-a883-b2333acf09b6", "sighting_of_ref": "indicator--c6467690-37b8-42c6-8aef-0384d3432767", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdd70b32-affc-49a8-b090-323df6df1bea", "sighting_of_ref": "indicator--b25de97f-9a41-4faf-9f45-b09e06bb426f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03a09220-1976-4a98-a353-49ec4ffe3401", "sighting_of_ref": "indicator--f7fd21f2-0151-4098-b952-041283af516c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20394139-be97-4fa7-b817-92271ab08c38", "sighting_of_ref": "indicator--f053a89e-8465-4f34-a392-55e581579c2e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fae33ec7-3fbe-453a-a312-09d46a3db7b2", "sighting_of_ref": "indicator--ff12e4f8-fb3d-4a98-943b-36aeb3c92d5c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc1dba0e-2ddb-4336-99a6-d2c1c0507e82", "sighting_of_ref": "indicator--f534041b-ff91-4816-84bd-be9e491eeda9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9aba3137-5ae6-42e0-b4e0-8b8f27b96c5a", "sighting_of_ref": "indicator--86f2b6f0-cb95-4588-92c7-693a92c80063", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42e9b2ad-31ea-4cbc-8681-9abeb29b428b", "sighting_of_ref": "indicator--feede521-faca-488a-be16-ba5c63127ce9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd656300-75f2-4a03-bd16-0a826428add2", "sighting_of_ref": "indicator--b03e1672-07f2-4fb7-b6cc-8ea8faf03a34", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f3c3068-e0bf-4d2a-a0e9-7018561fd896", "sighting_of_ref": "indicator--17810069-6e08-4bb5-9217-2ca219c3221b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42507fa0-e603-4121-b486-8ac4da96efe6", "sighting_of_ref": "indicator--231d2a3e-150f-4310-8280-86dbdfd46700", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa8668e4-8c50-4ae4-bead-8080c894eb1a", "sighting_of_ref": "indicator--844cf233-6060-4269-a548-63e0b4f7b117", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcd99412-16bf-4525-9f2c-c0ddf7573720", "sighting_of_ref": "indicator--92e7c6a6-aa39-4079-819f-1f2dd2f15367", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6840efe5-b89a-4844-8fc8-4d0310ee0957", "sighting_of_ref": "indicator--3d3bafd0-5736-4923-bbd8-715ee0d4da4b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--978b6af5-b5eb-4d04-9f20-7271fc80e348", "sighting_of_ref": "indicator--2aaa6ab8-cf94-41c6-b24d-fd75b0ca051d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07d140b5-963e-4a06-8d42-94b1cc0ed640", "sighting_of_ref": "indicator--17da28e1-d765-4f6d-8211-1645dbf59b13", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75f6dab9-c3af-498a-b17b-477d6413c8e0", "sighting_of_ref": "indicator--c0df3d54-c42e-4032-ae52-d439fb0095ec", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e36fec97-36f7-4f1a-849d-83b21eb17c99", "sighting_of_ref": "indicator--5e3e9e6d-125c-4726-bc58-bb24e95e2cf4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19fe5375-0b48-4fba-8b42-a5fc92a9c3da", "sighting_of_ref": "indicator--7ad3d36e-c058-4e4d-8765-c0b0de82bf68", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--199a371e-c36b-497b-8fa0-e13c170b2c4e", "sighting_of_ref": "indicator--82927890-1e6e-462b-b967-9b9acda764af", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e9f8c11-85a0-4381-84c6-03c1f58a153b", "sighting_of_ref": "indicator--1ef88682-ea0e-43f8-839a-da8af346782e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed562fec-5efb-4f21-b837-2bdf927a1426", "sighting_of_ref": "indicator--27221075-d346-4bb2-bf7b-0518364b01f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3d6ff54-f543-4371-9d19-e240a94b2537", "sighting_of_ref": "indicator--e7473413-8413-40b7-8d58-c5b894339630", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ebf9838-d62d-4b08-b4a3-b6d31b551459", "sighting_of_ref": "indicator--3b130d0d-e4ca-4d9f-86e3-5d6259791175", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f914b7fb-15aa-484b-80d3-e153c6010b7c", "sighting_of_ref": "indicator--779b252b-499a-4541-8439-07271ea4e64d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3093079b-4b98-4b23-aeb8-e28ef7abf152", "sighting_of_ref": "indicator--779b252b-499a-4541-8439-07271ea4e64d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62bbf9a5-a5ff-4225-92cc-3fa033deb049", "sighting_of_ref": "indicator--565ac9ca-e308-4dbb-83c5-1bd9bd2a3034", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dfb049c-6590-4c83-b718-3821a2ddd7de", "sighting_of_ref": "indicator--565ac9ca-e308-4dbb-83c5-1bd9bd2a3034", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f569cd96-b147-4820-bcd7-6f6385430814", "sighting_of_ref": "indicator--2e839d95-805b-4e89-b8f0-18ecd89d75fd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba2e0aad-9e9d-4867-b5d5-79a9a1b51a9e", "sighting_of_ref": "indicator--b3b2ad9c-0e8a-49ad-a0dd-3d15a3698afe", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bb5ccf4-723b-4758-adbe-f46989a4f4c0", "sighting_of_ref": "indicator--f11d842c-a0c2-47fc-b87a-0dd6b03d44c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15ad1ce1-7d7a-4d29-af86-d23b3ed06ee9", "sighting_of_ref": "indicator--b2309b15-9bfd-4f0a-b826-83413decff26", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78d727fa-c0f0-4fa1-bb8f-dad8574d01e2", "sighting_of_ref": "indicator--14398503-69d9-4bf8-9ffc-b558be85a87a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63a557fc-e7cb-4766-846f-c7c69b3086e4", "sighting_of_ref": "indicator--eb2dd0a8-df04-4f2c-8a22-c28f5ddd6ab9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--004faf80-be4e-4ac6-b9dc-4bfadfb305f6", "sighting_of_ref": "indicator--5adce7a8-f809-4fc3-a8b2-93fbc6041007", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e628e1a-ea40-4ffa-8105-2f7c390f9077", "sighting_of_ref": "indicator--4e82b754-0e80-4018-a379-1beb68acf6f1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdff2532-3be2-45f2-aa3e-dbb5480dccb8", "sighting_of_ref": "indicator--2cbb6862-dc58-42de-afbd-46d306708c5a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3c47b5d-ad10-49d0-b0e8-6d5a354619fd", "sighting_of_ref": "indicator--2cbb6862-dc58-42de-afbd-46d306708c5a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4164c0e9-8978-4ff8-9711-2e213e5819d2", "sighting_of_ref": "indicator--e18d48b1-ab57-463d-91b6-fb6d62a713be", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0675157-5b56-4dd3-abbb-16833e282496", "sighting_of_ref": "indicator--63155e93-55ae-4902-9791-265c27cc923f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e14ee6e6-c7b1-4519-9156-a6711b061882", "sighting_of_ref": "indicator--5a0966ad-cd01-41f3-ab17-6981e97f5f9c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e3364cd-5453-45cd-adf4-e44974d1d5f5", "sighting_of_ref": "indicator--be610e8d-e619-4826-a7d3-b786629fba25", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3ae6e3e-f1c9-4657-9ff8-ec765d569bd8", "sighting_of_ref": "indicator--ab05c86d-a55d-47d9-9450-5360f82b8c03", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09573d65-4e6e-4a18-887a-f99b0d506372", "sighting_of_ref": "indicator--477da51e-61fe-44e9-810e-cc88f9a5e82f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a124f059-c2a5-41b7-9506-6ef68b126779", "sighting_of_ref": "indicator--a8d92a85-4dfa-455b-b0a7-4d3e093efa49", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3b136d0-c8c6-44f0-96d8-2b61991e3f5e", "sighting_of_ref": "indicator--a8d92a85-4dfa-455b-b0a7-4d3e093efa49", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ab7f5d0-8fb7-4395-b2d0-fba42d21c8d2", "sighting_of_ref": "indicator--425fc872-8bc5-4b3c-8d90-18459b714a31", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa6c058b-04aa-4b6f-9fcb-b74d4c2a1b8f", "sighting_of_ref": "indicator--425fc872-8bc5-4b3c-8d90-18459b714a31", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ecfd962-ab94-4522-8b10-ebc69d2d4c2f", "sighting_of_ref": "indicator--cbeb7cbe-4be8-485c-9e57-29bad38c0ed4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14bcae98-ff0a-461d-a4eb-53f4ffe131ea", "sighting_of_ref": "indicator--cbeb7cbe-4be8-485c-9e57-29bad38c0ed4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fe64870-5c9c-49c5-b583-60954f025621", "sighting_of_ref": "indicator--91869dae-1ba4-4c61-91e2-d63c4d9b2e2d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41f7a0a7-9bb8-4128-af2b-07a0c209c605", "sighting_of_ref": "indicator--47a06901-c973-471f-8711-bf5de83adda1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3980c751-1d47-4850-ae01-aaaf0d48d5ad", "sighting_of_ref": "indicator--1e921b4b-ff7b-41a9-9de4-cc8542faee93", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fae619f-8367-45fb-8513-65abca589f9b", "sighting_of_ref": "indicator--1d2e4870-87c8-4613-be35-112f282dcd5c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fe8c37f-b03f-48bd-9700-9e456851cbaa", "sighting_of_ref": "indicator--1d2e4870-87c8-4613-be35-112f282dcd5c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a72a3836-bc38-4a1c-b4f4-0aba9c26480d", "sighting_of_ref": "indicator--3e4a1c5d-8db1-4819-a2f2-de07c7e0f337", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0906a72a-4de3-430b-8a74-1f3087098a71", "sighting_of_ref": "indicator--69b49cd1-8b57-4e11-940d-ff5b446ad467", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89721ade-5e7b-426f-a027-a8b471154363", "sighting_of_ref": "indicator--ff6b0918-c2d1-47da-b4e0-afaddfa77dbe", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--689e2a6a-dd60-4437-a31e-4f55cdf2598a", "sighting_of_ref": "indicator--ff6b0918-c2d1-47da-b4e0-afaddfa77dbe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--156a7825-f1ea-4d48-ab1f-4a12921dd0a6", "sighting_of_ref": "indicator--4553c7d2-321d-4747-aaf0-2a34fec42714", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3a7bc66-cea1-450a-8819-4dd2552deca4", "sighting_of_ref": "indicator--395205c5-567a-487b-a1c3-b7612c49d657", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce686257-f7e2-4002-b4d8-26003a84af78", "sighting_of_ref": "indicator--07f093b6-f145-443d-95c8-79fde0aec6b3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73f34f0b-992f-4c9d-bee1-401a8d1f79db", "sighting_of_ref": "indicator--2fb6d965-70d7-4788-94c9-59783d03af4f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94d88625-483b-4e2e-b267-bb9f6571ed26", "sighting_of_ref": "indicator--4a9403aa-2a8a-4b8a-95f2-f95f39eb7a00", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5110fa6d-dac8-4f68-ab7b-dfedb890bd16", "sighting_of_ref": "indicator--642d9fa7-e360-4db9-9c50-781be6fa403d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c303a7af-4536-4f0b-8990-210d88fda6cd", "sighting_of_ref": "indicator--48fda2b4-2a69-479c-ad13-f535b81d0601", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f838a3da-9837-472a-952d-e16a1cbb134f", "sighting_of_ref": "indicator--391203a6-45a1-4577-86a0-809b12896712", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--973d637b-e7bd-4592-8de4-4b2ac18dcf81", "sighting_of_ref": "indicator--b3f767e4-6d9c-46fb-b8fd-722623b9570a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7829886b-3990-4528-a68c-f5a98d952464", "sighting_of_ref": "indicator--5cea701f-0f72-4f09-b354-543b08212620", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c60c3d8-925b-4622-bff6-70c8750a13db", "sighting_of_ref": "indicator--f46f641e-d235-4a5e-838f-9f0b0749bf54", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10631775-596f-4522-856d-3c88c1824794", "sighting_of_ref": "indicator--e038b15b-5d17-487e-a026-ce92bcbf1787", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b47d5525-10e1-480a-8f39-88559b38b583", "sighting_of_ref": "indicator--f48c33c8-5c91-4635-9b40-e815616e7f05", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--184ba112-3e00-49f3-a40c-a1e54c19c237", "sighting_of_ref": "indicator--2b5732a1-fab4-428b-802f-9a596192d85f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bb577e4-b1b1-49fc-ac97-87cb6f77dede", "sighting_of_ref": "indicator--939b0b6e-500a-46c8-a10f-ad204f6d5921", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa5c3a69-ebfe-4c8b-adea-063d98d8a983", "sighting_of_ref": "indicator--8a09603c-3e9d-4ea9-958b-c0cbbf5d2438", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9f07b5a-2423-40ee-954b-8f7a9fe31467", "sighting_of_ref": "indicator--ce5e7e91-10ab-4e2c-8039-81505a15e507", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b94ddd60-834d-4bf6-9277-f05f420e600a", "sighting_of_ref": "indicator--ec6bb508-cef3-4469-ad1a-5052e75906e9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7a9f53d-7b4c-4dd9-8d7c-01442f45d23f", "sighting_of_ref": "indicator--ec6bb508-cef3-4469-ad1a-5052e75906e9", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3351228d-7cdb-4a38-aebe-a8d2907d82a0", "sighting_of_ref": "indicator--36e6216a-5b14-479a-9a83-aae6555031a9", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16b2bc10-8113-4f95-87bf-84913c0d2335", "sighting_of_ref": "indicator--354359cb-78fd-4492-baba-a8df317ca4e6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dd59e56-69de-430f-8aaf-7247f97c5f5c", "sighting_of_ref": "indicator--d29177d8-8be9-44ea-be0d-f72e40aec28e", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22758021-69e4-46ba-a9a6-bf980f683bae", "sighting_of_ref": "indicator--15e15dd3-2c3e-4d02-a8d6-b29ca69b45f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42bd2b59-f029-4d25-9f4e-17c690830934", "sighting_of_ref": "indicator--76579e5c-7391-4cc4-943a-0a5f74b448ab", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0f8a312-0ddc-477b-aaa2-b95d1d5ee5f6", "sighting_of_ref": "indicator--87040d64-e0e4-42be-adc2-39a6034f0fd2", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--742f4a4f-8859-4a9b-8f14-6a8cc8df2439", "sighting_of_ref": "indicator--ad0dfef2-6a52-42c0-83b9-cf842ecda4d6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aad6ad64-0fb0-4390-8db0-99f14dd395c7", "sighting_of_ref": "indicator--a2a34a5a-34d2-47e4-a0ab-eb54876bdf0a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51068bb8-6692-4100-9fdf-754931132c25", "sighting_of_ref": "indicator--3545f75b-b07b-48fc-8d19-6239104d6d05", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e0cf5be-773c-44d7-a7a1-0f5008735aa2", "sighting_of_ref": "indicator--9dadb42d-9e6f-4e77-a88b-551ee49db359", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b25f3994-7a42-4060-a419-73e2d6c5753e", "sighting_of_ref": "indicator--4a0260fb-abb0-4028-b48d-f7f7035d9369", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df1f2721-7507-483c-9b65-a8145765721a", "sighting_of_ref": "indicator--0a9ad6ae-72eb-4545-b3e5-a253bf675c93", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7d7e57c-74bd-478d-aa7b-f4bf136db317", "sighting_of_ref": "indicator--083e3f36-d688-4fa1-abf5-7565efe0c3f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4663ae5-fcde-4292-bece-44b4a87d49a8", "sighting_of_ref": "indicator--4e489fc2-d9f7-4a9e-b887-39bc6f4a9ac0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a71e32e8-5cb2-421f-aa8c-4709f7211ea3", "sighting_of_ref": "indicator--0dc59bb8-4861-4b15-a111-5362bae8dbf4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aae309ff-3919-471a-bbfa-6b990806af45", "sighting_of_ref": "indicator--47fd2f22-2f20-49d6-b435-277124aa50af", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--703c1770-5270-415d-836c-319d9b3b73f7", "sighting_of_ref": "indicator--dc0eef7b-7b63-4a8d-bc54-e08822be5f8a", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51010cca-ed1a-4c84-b166-b8947040edc0", "sighting_of_ref": "indicator--253c48e5-b88b-49b3-a61e-66adb556ae6c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b712aa5-4007-4dd2-b62e-ed8a7f367469", "sighting_of_ref": "indicator--99546d43-c653-4a96-8da3-d7d19fc19c1c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8efd214c-f9f9-4c19-9db1-e41e4e6734f3", "sighting_of_ref": "indicator--99546d43-c653-4a96-8da3-d7d19fc19c1c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b92de9d6-953e-4098-962d-686c8ad43030", "sighting_of_ref": "indicator--f4731af7-ac5c-4153-9090-73d8a512c73e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d19d0eb-208b-499a-ba26-3760f856ba00", "sighting_of_ref": "indicator--39340307-7441-42e8-a574-5c0158a0b711", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed040aa4-f134-45b6-b03f-dbbf006ae352", "sighting_of_ref": "indicator--0e93e853-add7-4cbc-b054-8a160a103ec0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef0bfd51-aba4-4edd-80fb-ce9776432ac0", "sighting_of_ref": "indicator--2da2e46f-1d0d-4084-be82-becb6f114f09", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6c19479-c96a-43ff-8d46-bcd071c1669c", "sighting_of_ref": "indicator--2da2e46f-1d0d-4084-be82-becb6f114f09", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8a009f4-1758-4861-8981-f65e4744a113", "sighting_of_ref": "indicator--1982165e-f3b7-4b91-b05b-bb6fbdcf6f26", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--535284b3-e094-4aac-bff7-6319cf38ffea", "sighting_of_ref": "indicator--3f9bbcd8-b3d8-49cd-90b8-5732ae3e9282", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1c1cc55-f10b-4365-96bf-e52f37516a48", "sighting_of_ref": "indicator--e5d042ff-7ef0-4122-b0b9-beef596dafa8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1629b9cd-5818-4bbb-b76e-4d7c03420a20", "sighting_of_ref": "indicator--332a392d-0160-4f8d-ad71-6f5cfa737f36", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bcfd738-ad22-4c67-90ab-a29867ed3024", "sighting_of_ref": "indicator--84d100dc-909d-48bd-88a4-3e24a05b5f16", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03572ab7-225e-4e79-a590-9207a95696d2", "sighting_of_ref": "indicator--4befa197-6467-4550-9097-242849b652c8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--718b3103-f636-484d-97ae-8e98c7bb73ce", "sighting_of_ref": "indicator--11c722cd-6044-4ab1-b35a-46466e8e559e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0de5bbdc-b1c3-4eb7-a2fd-18b383d96a0f", "sighting_of_ref": "indicator--1549ceed-e8e9-4548-a3b5-bc88141ca4d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa8098c4-afa6-41c0-8d25-1015b35e663e", "sighting_of_ref": "indicator--b9c7db71-6bc3-46cb-bfc5-33885ada6ac3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01542a5a-7a1c-4e23-a370-7bbab1fe48bd", "sighting_of_ref": "indicator--9efc08ea-7b3e-400f-b595-87ec5526d6e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2d35ae3-79f2-456d-a72b-0e6b2f7d59f2", "sighting_of_ref": "indicator--94d6b19a-8354-4759-aa10-c235db580c7b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2024351b-62e8-483d-9abe-4d6407f40a4b", "sighting_of_ref": "indicator--e2fbaa88-7706-471c-bb82-d46cc806dd31", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06cda4ab-cfad-403f-82e6-fc63ca853c3b", "sighting_of_ref": "indicator--450a7938-59b1-4a73-8856-f75c2fc9afa0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31d1e129-f7eb-4aa4-8818-5c89866706eb", "sighting_of_ref": "indicator--a563df05-581f-4975-a883-04550832ce00", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61592810-6c98-406b-9b16-31ef83bbbb66", "sighting_of_ref": "indicator--d13a9d3c-97cf-41c5-aeff-1e118ffd4f31", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9be2e321-7a38-42eb-adb4-216856129c62", "sighting_of_ref": "indicator--471f859c-ed53-404f-b147-9977b3983242", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f31a408f-2e67-4975-b4b3-7a96cf08dc74", "sighting_of_ref": "indicator--7a1752c9-f447-4a0f-8754-04fd42c51d06", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd89f14a-984e-49e4-8513-2ab616a173a3", "sighting_of_ref": "indicator--6694ca48-b5fc-4595-8527-cf82d740678c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04251f00-4a0f-417e-976e-763bcea12334", "sighting_of_ref": "indicator--554f2618-7ccd-4d17-9855-bd30518cef20", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--001c5f6d-e154-4386-8c7f-e97ae6da25db", "sighting_of_ref": "indicator--b0cd1dbe-2d2b-4578-a46f-b5b206a3fb36", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dea3461d-584a-4416-b85d-10b31463d4a6", "sighting_of_ref": "indicator--85449344-fd10-4f87-8339-704ce47db08f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e1b823d-e4a6-4de8-b432-d546af1a1f94", "sighting_of_ref": "indicator--62572f88-7aba-467c-898d-c75f03c62954", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f9e41c3-b798-4f33-aecf-0cba97c9ccee", "sighting_of_ref": "indicator--e00a57d1-80d6-48fe-a67f-352d484e1715", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d277d286-4af1-4427-aea8-e132bcfdf867", "sighting_of_ref": "indicator--e00a57d1-80d6-48fe-a67f-352d484e1715", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9e8d182-57bb-44e3-be39-6b7193280baa", "sighting_of_ref": "indicator--30b3218d-f6e5-4472-a67e-453a2a2e3bb6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76b72149-00cf-4b92-9a03-048e6e14ad8f", "sighting_of_ref": "indicator--30b3218d-f6e5-4472-a67e-453a2a2e3bb6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d284d077-1edf-45e0-802b-f97646d50959", "sighting_of_ref": "indicator--9556f830-e14d-49ce-a3e9-45e92070921a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9313d3b-b217-42f8-ad08-198aaf8a10b2", "sighting_of_ref": "indicator--9556f830-e14d-49ce-a3e9-45e92070921a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77391e88-eb30-45fc-be88-81731f96ef7b", "sighting_of_ref": "indicator--f20555ea-330c-4df5-af1d-a4bda24772fa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--107a647a-5368-42bc-ab2a-ff5547c75644", "sighting_of_ref": "indicator--f20555ea-330c-4df5-af1d-a4bda24772fa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7fca2a0-af73-4bd5-937b-3d74fc7d43b7", "sighting_of_ref": "indicator--04b27191-3812-4564-8e50-c8d18883c251", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c22ab8e6-84ac-4020-b35f-9aa9d8084ae9", "sighting_of_ref": "indicator--04b27191-3812-4564-8e50-c8d18883c251", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7052d43f-51a9-4e4e-9c9c-31b908ad9c65", "sighting_of_ref": "indicator--2656ba3b-820b-4c3c-ae11-ae7a5a7f20f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8e7d1a9-153e-4f07-be64-67094a57c68a", "sighting_of_ref": "indicator--2656ba3b-820b-4c3c-ae11-ae7a5a7f20f8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f1e354a-1ad4-49c7-b144-7f44f12382be", "sighting_of_ref": "indicator--8deb57a1-999a-43e2-869c-173302de71e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92d16022-da4a-4558-9336-fb3f250ad051", "sighting_of_ref": "indicator--8deb57a1-999a-43e2-869c-173302de71e4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d95054dc-d23c-45f4-a025-9f0394f30563", "sighting_of_ref": "indicator--d50849d3-9613-4cd0-bd99-3448ef5581d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24c139bc-379b-42ba-8862-8a0acc8d2e34", "sighting_of_ref": "indicator--c1773dc9-667a-4fe2-a814-f17ebc5b07c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b15bbc83-27d6-4549-bf24-d12d254bdd06", "sighting_of_ref": "indicator--c1773dc9-667a-4fe2-a814-f17ebc5b07c6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83dcb093-2b0d-4274-a853-9f8229543040", "sighting_of_ref": "indicator--adafb658-b9ec-4d92-bd44-788ed3d3837c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa17ebb2-e88d-430e-a2bb-c17a857a723e", "sighting_of_ref": "indicator--adafb658-b9ec-4d92-bd44-788ed3d3837c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--854a713f-56de-441e-bdf5-5b76de9a2848", "sighting_of_ref": "indicator--e1297b15-1f48-4d92-b0f2-25465b1a5a70", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e20d715d-9fb3-4b97-bd17-5f78efe56bde", "sighting_of_ref": "indicator--e1297b15-1f48-4d92-b0f2-25465b1a5a70", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da032508-8bcb-422a-8c2e-d6e972b0f406", "sighting_of_ref": "indicator--0a5b3e16-d0a4-4f1c-819a-cfe2afa3fdb2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--353cdb85-fb00-4ca8-8292-46aaede202c4", "sighting_of_ref": "indicator--35794398-6d7c-45e2-988b-40b9b3588001", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5c211f0-6151-4cdb-92cc-a70f6eff9f1d", "sighting_of_ref": "indicator--35794398-6d7c-45e2-988b-40b9b3588001", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20b3b714-db48-446f-8f02-195f2a602679", "sighting_of_ref": "indicator--2bd465ee-886b-474f-ab0b-2a49b0a1064c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ba8b9c5-c78d-45b4-a5da-689ff2334893", "sighting_of_ref": "indicator--7068eadc-069c-4d5f-8f90-a020c4f98776", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21fe8148-aba8-49a3-aa6f-17e451a9b0e6", "sighting_of_ref": "indicator--b335e1d6-9c59-4c72-9f2c-1d009be90dab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a384111-5e2f-4ea7-bc7e-87567c45bbf0", "sighting_of_ref": "indicator--b335e1d6-9c59-4c72-9f2c-1d009be90dab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b71b50e9-bddf-490c-8831-73ffa4b27d2b", "sighting_of_ref": "indicator--ff4769f0-43c1-4a91-b415-14e54f163f8a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0ebfcd1-2738-4e00-b48f-cb638a997b24", "sighting_of_ref": "indicator--ff4769f0-43c1-4a91-b415-14e54f163f8a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bd4e7c4-7b33-4283-842b-3e512a3e5a24", "sighting_of_ref": "indicator--3f49f59a-f513-4dbf-b1f6-5b8f28a8731f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c8ba35f-9255-4260-a21c-e0d98d3bc53c", "sighting_of_ref": "indicator--3f49f59a-f513-4dbf-b1f6-5b8f28a8731f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5325325a-ad2e-4d95-b403-ffa54bfbcb25", "sighting_of_ref": "indicator--75605cd9-6244-4731-a3fb-cb8a97a4f7d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3128331e-15b4-4a67-9a7c-4bd251e5d9ca", "sighting_of_ref": "indicator--75605cd9-6244-4731-a3fb-cb8a97a4f7d0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc52dca0-9bb2-4bd2-b367-8a8593b12fce", "sighting_of_ref": "indicator--fda7a024-5667-4804-b0ca-5e708c2393a9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c39b839-c08a-4b93-83c7-01d20b431ef4", "sighting_of_ref": "indicator--fda7a024-5667-4804-b0ca-5e708c2393a9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd2c2896-18ab-4480-afbb-136a069f18eb", "sighting_of_ref": "indicator--96d64c6c-e360-4dea-8b83-58d40a5896cf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--256ceb11-c6d1-48e6-ae91-e42d6de6a94e", "sighting_of_ref": "indicator--96d64c6c-e360-4dea-8b83-58d40a5896cf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91bdc768-6184-4fdd-8415-27375a05969d", "sighting_of_ref": "indicator--6264d84e-e89d-4c13-905b-9321ff1a8a28", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47f96f64-b47e-4e8a-8725-e3c103f71100", "sighting_of_ref": "indicator--5af12952-66fe-4b67-9e7d-f75569d12fff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d9cc6fa-ed9b-4303-a173-4c22ae1ec9d7", "sighting_of_ref": "indicator--9c2e2764-c4b2-4f53-add8-06b0235104e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d2d1f28-faca-4066-8da3-e38478849300", "sighting_of_ref": "indicator--eaedac97-4ae1-4afa-8a07-de5f38e54c9c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8cdb9f4-3cf6-4a3b-9957-7ceff9a97476", "sighting_of_ref": "indicator--dea7b9e6-cdff-4f1f-9b93-c3cd676690c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--558b7416-a3e0-414b-9362-239a4e8dafca", "sighting_of_ref": "indicator--4654c003-6276-44b1-a8f6-c3491a8ec173", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35762061-fd39-4fa9-8aef-345dfc9e9e85", "sighting_of_ref": "indicator--4654c003-6276-44b1-a8f6-c3491a8ec173", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff663a72-3595-459c-9644-37e9b906a15e", "sighting_of_ref": "indicator--5254d781-36ac-4347-9b71-2a701f25dd7d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b075793-ae33-4d9a-a238-c301848c581d", "sighting_of_ref": "indicator--2d322866-d09f-4aeb-97f0-b3bcebbc9d20", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad1cbd60-498f-4ca5-a65f-d20f12fedc7e", "sighting_of_ref": "indicator--7f6b4005-18bc-42e1-8e53-7ca5da61c7f5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30def0e0-5d10-4694-b6f9-9125823b6f84", "sighting_of_ref": "indicator--7f6b4005-18bc-42e1-8e53-7ca5da61c7f5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fe8d73a-aab0-400b-989d-d511afce0cf1", "sighting_of_ref": "indicator--6f47704a-0732-45a8-8958-01c1e60fd537", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c89e523c-4475-4320-afa4-172270eca458", "sighting_of_ref": "indicator--f1cd4aed-a174-4641-9306-7a3b54686cb1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb3e162c-c7d6-4738-80b5-6549fa754341", "sighting_of_ref": "indicator--f082e2c4-eac6-4d5c-ad7e-f9ac2f95c57f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2793600f-cb32-44b4-8a55-24182cb28635", "sighting_of_ref": "indicator--beaf234a-2a93-4a2a-bd06-45e2a61be896", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--481fac1e-bbb0-4491-8572-827b58400292", "sighting_of_ref": "indicator--a4df355f-2090-4d11-ad4c-7fa92d7805cc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ced4467d-b613-4dd4-9858-623e07ad6c54", "sighting_of_ref": "indicator--7067aeb0-1ac3-4f4e-b12a-374450e6d557", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4b244d0-5012-41aa-9f19-87be88b94ad2", "sighting_of_ref": "indicator--49286af3-3310-4c9a-b493-8ed164c718d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1135284-3875-4e27-bf8f-01cf0feb6046", "sighting_of_ref": "indicator--ae451b66-717c-4f8c-b85b-d84c353f514f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba3668c7-9c3d-420e-862b-098f53d5cca3", "sighting_of_ref": "indicator--7cb05e18-74f5-4afa-afbb-d4b0596e2eeb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbb5e99d-6288-416a-b87f-e2825b13a9e2", "sighting_of_ref": "indicator--32c6e48b-6612-4da1-8327-5cd0e2367794", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81c60439-966d-4a36-b624-6d4c0a2c11cb", "sighting_of_ref": "indicator--db7fafb9-1f56-465b-862e-e3e0ab3dbda6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b524093-34b1-4d84-a83c-e8b309f3d2b7", "sighting_of_ref": "indicator--d0bb40cb-ee16-468f-805a-359faf1ce66f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fed5173c-cd18-4198-8428-99464e54b3d4", "sighting_of_ref": "indicator--ed13b2a0-5377-46b2-9356-b1ccbdf171ee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f1745dc-c415-4e48-a8f4-b476d4f3740f", "sighting_of_ref": "indicator--cf5e0a80-0bc8-464e-8334-869d3dc8eb00", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--643e48b7-3743-4124-a153-496bf102e7b9", "sighting_of_ref": "indicator--177a2b44-6ab1-4c06-a947-29c9c73bcbf7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d866883-3f01-4ce4-8a2a-2eb5c431a4fe", "sighting_of_ref": "indicator--20673f62-8a95-4eef-9fe3-e391092ab343", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2c02f81-14c8-400c-badd-bee1514c0b3c", "sighting_of_ref": "indicator--20673f62-8a95-4eef-9fe3-e391092ab343", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bbf361e-dcbb-40ab-97cf-e8e90733614b", "sighting_of_ref": "indicator--7af0e35c-29fe-4951-bb6c-77338171dadc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34122410-fb6b-4f01-9c4e-1ea037a23b06", "sighting_of_ref": "indicator--7af0e35c-29fe-4951-bb6c-77338171dadc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c99385e-6858-4288-b0d3-662231831a60", "sighting_of_ref": "indicator--1578ecb8-76cc-45eb-b597-2b1c0e561f2c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f17acb8e-176c-442d-861c-b22aeb5f0b9a", "sighting_of_ref": "indicator--1578ecb8-76cc-45eb-b597-2b1c0e561f2c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc49da66-108f-4ec9-aef7-230bb0ac1804", "sighting_of_ref": "indicator--8924e543-f701-43d6-8cce-5471f6e30656", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddb353e9-ecef-4a59-8e8f-19a47a1558ce", "sighting_of_ref": "indicator--1ef59a22-c616-4871-b550-ab8d2e4305a0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--381a69de-3b05-4589-a32a-e8d0c15d0629", "sighting_of_ref": "indicator--887360f1-24aa-47d9-be20-108f1463f64d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b098ef9d-11e5-424d-b0ef-24993af79915", "sighting_of_ref": "indicator--db511642-8da8-48dd-83da-a87f6259020d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a607cf1-ed7f-4edf-b2b2-000069575951", "sighting_of_ref": "indicator--c129be62-7d10-48e5-9837-72ea73ebe728", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c185b7cd-e5d2-4a42-9b75-af2fbc68d21c", "sighting_of_ref": "indicator--7bd1a58f-e882-4cfd-a163-fe5fb32fdf34", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45bb68b2-6be5-4899-b90f-204188288d51", "sighting_of_ref": "indicator--6880625a-23ad-45c5-bd29-6430d53b1adf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68fb521d-d3a3-49da-842c-fd2dcfcf23ea", "sighting_of_ref": "indicator--179c8a66-f4e2-4959-9956-73ecae257c40", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3173b1e-6e53-4b31-8f1c-d2330fd0496e", "sighting_of_ref": "indicator--3c4c0ebb-8ac0-4c05-baae-a66af29b9daa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f67ce9c-c90e-455e-b729-c9392572dfd4", "sighting_of_ref": "indicator--80c343ed-ab33-4e74-af01-959a9f2dacb3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--590b3872-411a-4b34-8a87-cf77e2109a61", "sighting_of_ref": "indicator--ca33fe82-89dc-4fd9-9f27-d8caa1f5ad27", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9d134b0-eddc-412c-9e3a-6e9c8f260012", "sighting_of_ref": "indicator--5cee2d16-dcdc-4ce1-a8fc-8c5a6e12d2f4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67dd9cd4-b63a-418a-8743-eb0943917135", "sighting_of_ref": "indicator--09247c37-2ce5-4aac-baa3-572c78c93f58", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dc1e5a0-b916-4f24-b8e4-5099213ecc37", "sighting_of_ref": "indicator--bae62ecf-637d-45f3-81a3-a7d275d70a64", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55d5fa39-8a5b-4975-a4be-cc51511dacd8", "sighting_of_ref": "indicator--4a5bc867-ec05-4dbb-8c47-c911f49a889a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d9cb0cb-4152-473d-8815-9e4a34130179", "sighting_of_ref": "indicator--b1d85ab6-70c9-412e-82dc-cbe653999809", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44cb59d1-1e69-480f-8436-895ea9bb73f0", "sighting_of_ref": "indicator--3a805931-2436-4c9c-a085-d1af26c626ff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37081da3-abf3-4c25-b0e0-26927b4f3c7b", "sighting_of_ref": "indicator--d947513d-7a3a-4e9a-b97b-294ad992f997", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01ba83c5-3e4d-454f-9c48-92c10c6f28f0", "sighting_of_ref": "indicator--63a400d0-1b1c-4009-bdd0-08bf1c9945fe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00ee6786-8d2e-4edf-9bf4-dbe6e5fc26d4", "sighting_of_ref": "indicator--7006bf2f-ce8d-435b-9ee9-f7342f906f03", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8087d08-d98a-4506-a938-4799161fb9b5", "sighting_of_ref": "indicator--0a14dbad-9d82-4b4f-b6bf-142a9c1f6d03", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1813f9c0-abdb-4c26-b31c-b333875cff83", "sighting_of_ref": "indicator--6be89d6f-50e8-4679-84f8-1af43ffa48bf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d3e0645-7227-402a-9edc-068c6eb83a33", "sighting_of_ref": "indicator--3b5c69a2-a7c7-4834-a0aa-4b0ded966864", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--859ba1aa-35e3-465a-9007-6d4680541fc8", "sighting_of_ref": "indicator--3b5c69a2-a7c7-4834-a0aa-4b0ded966864", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72400736-0040-4bc4-b502-5f7d4893e645", "sighting_of_ref": "indicator--a81387d9-5f01-48f5-9041-82f95a772f76", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--869c45fa-dd49-41fe-bafe-4a23d6e20245", "sighting_of_ref": "indicator--9f0d2416-b242-49ee-83ab-78c70f3f12f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5575df0a-c506-4dc4-9bec-8e4d7714309b", "sighting_of_ref": "indicator--05ae92b6-1eb6-4059-9683-2a634448aa0b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8012cfb6-2c03-4919-ac93-850491762949", "sighting_of_ref": "indicator--ea8ddc57-b45a-4ed8-990b-750122b90d6e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58d5c769-fdfe-40c3-ab9d-a8aad58d2290", "sighting_of_ref": "indicator--c812af26-19dd-4ab0-9a2d-8a9e7b243e14", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8900e1d6-f1aa-43fc-a5c3-696738223f8c", "sighting_of_ref": "indicator--154a532c-8fc3-434e-8842-f72ae881271e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16e22763-88a0-4c61-8acb-10d1ca8c6525", "sighting_of_ref": "indicator--9da3be7c-19bb-44ac-a74a-0f6537afacb9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11809084-c0d7-4bdc-906b-3ed83d408ece", "sighting_of_ref": "indicator--3f0f5c4b-cd86-41d0-b5c5-831192a6cbee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bf2780a-bf8b-41dc-b124-d3163985a75a", "sighting_of_ref": "indicator--852c7713-65d0-4543-bb8e-ae045d543308", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcb656c4-0061-42a3-b66f-6c66f868ca0a", "sighting_of_ref": "indicator--14718d85-4052-4afe-bc17-15e5421307fc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db96b768-c37f-42fe-8745-3b17f40edc4f", "sighting_of_ref": "indicator--b8f2e346-bc0a-460f-9d59-8428e1cbd327", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44fb0673-0681-40cf-b2f5-d64ff4cc3c07", "sighting_of_ref": "indicator--3dbd6f13-1a81-4ec6-9e0f-322d4a380be0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--499009a7-1f28-4534-8da0-3383fe4d3e94", "sighting_of_ref": "indicator--d58a32a3-e6a0-4b2d-993b-833a83b25c85", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e7b7181-195b-4874-a140-1cce48f2ea36", "sighting_of_ref": "indicator--db797cb2-a679-4af5-94a9-3a356dbea2c8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b636a87f-8bf5-42dd-a34e-9c9e9d6ffd33", "sighting_of_ref": "indicator--f14c5e0b-0325-4bf7-9ea5-1d45fc82363e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67714a64-deed-4a33-b71c-4f5057e90b43", "sighting_of_ref": "indicator--f14c5e0b-0325-4bf7-9ea5-1d45fc82363e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9047690d-2e14-40a1-836f-9dc156c932fa", "sighting_of_ref": "indicator--db53f824-ccda-42ac-ba81-ef442cab3bd9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7ef6ff3-554e-4bc7-9773-799d9ce8b5de", "sighting_of_ref": "indicator--9431de44-6817-4737-a518-2f2746e0f18a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7513ca36-c8aa-46bc-aca0-ec7bffeb5859", "sighting_of_ref": "indicator--8f1d479c-7f1e-4866-aaf4-83613b854d0f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f76761a1-a957-4c68-8efd-5006e0990997", "sighting_of_ref": "indicator--8f1d479c-7f1e-4866-aaf4-83613b854d0f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28144ce1-c08b-4241-ac2c-d2afb485793d", "sighting_of_ref": "indicator--956f317a-01e3-4eb5-aa76-bc473ab07d21", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b6ca546-de8d-4ef4-a7f6-8a93eaa4d397", "sighting_of_ref": "indicator--8926e103-028d-44c9-816a-39487545ba70", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdedf32c-9847-4486-b18c-d8016c0c13c0", "sighting_of_ref": "indicator--d94514e0-bfe9-4f74-a9b1-6cf31d696056", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b1d9df8-2744-4217-b5cf-a3b75b7cc8f2", "sighting_of_ref": "indicator--d908f393-565b-405d-9460-ad76ab4514f8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32cf94ff-73a5-4628-9eaa-d4c8ce14f175", "sighting_of_ref": "indicator--b2303c25-f0bd-44c9-bfa0-94fae9901a91", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0ca2bd3-7ae5-49f0-9d30-6ffff521b1b3", "sighting_of_ref": "indicator--b2303c25-f0bd-44c9-bfa0-94fae9901a91", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33e7316d-c671-42eb-8402-6d44f4fafe9b", "sighting_of_ref": "indicator--42fb6f9e-bf14-42c4-8578-a6e230ace9ae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f1d8057-f354-4186-955d-1fc08d38b89a", "sighting_of_ref": "indicator--42fb6f9e-bf14-42c4-8578-a6e230ace9ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9954866-499b-4cec-af8d-441116c3eb44", "sighting_of_ref": "indicator--65d77598-7ad6-45ad-8c64-a13e3d93d48f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe3253d8-3e75-48bd-a353-ef6699435b25", "sighting_of_ref": "indicator--b82ad27a-1a92-4352-8f0d-bdbfca75a23e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bb6e328-300a-4a3a-8d3b-3c3946b3d9c3", "sighting_of_ref": "indicator--d2c48f05-1014-4f71-a4a5-4b91b0f3203f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73840769-cb23-4fa3-af0e-e288c88ec31c", "sighting_of_ref": "indicator--d2c48f05-1014-4f71-a4a5-4b91b0f3203f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5a2e943-8fa9-4fa7-86f5-d9fc05c2b0d8", "sighting_of_ref": "indicator--c848962f-2e2d-4a4a-b00a-af10bda9b3b2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69907da0-9306-4e0d-bda3-651ad542882f", "sighting_of_ref": "indicator--c848962f-2e2d-4a4a-b00a-af10bda9b3b2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7611a547-8ade-42a9-922f-c06507f3fe79", "sighting_of_ref": "indicator--536f73f6-0fa0-4e63-bb84-4e6a482fd0fc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6aaa5d88-521b-4ea9-831b-3812efe504ff", "sighting_of_ref": "indicator--18b71d12-d61e-4f5e-b949-fc4114f0f823", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--414597a8-f7cc-4033-a29d-091cec173dbe", "sighting_of_ref": "indicator--18b71d12-d61e-4f5e-b949-fc4114f0f823", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55f6040d-00ca-4ff5-ad0d-fc1c3486f001", "sighting_of_ref": "indicator--77970f57-c2ec-4b1f-8590-1e7be695d77c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc590174-4a64-49f0-8288-419407658ec4", "sighting_of_ref": "indicator--77970f57-c2ec-4b1f-8590-1e7be695d77c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--163d0886-098a-4817-8866-745450ab2a0a", "sighting_of_ref": "indicator--be80599e-58b4-4136-9b86-cf43da32b06b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55379595-206c-4997-b7ac-cc35f77af8c6", "sighting_of_ref": "indicator--46bd1df1-1146-4778-9ad0-628656a8c56b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09119df3-f170-44fd-876e-f6e6c098184c", "sighting_of_ref": "indicator--641937fd-386d-4ac8-ac73-462257c07642", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5083a2bf-e08b-4c71-8b5a-bad2f72d560e", "sighting_of_ref": "indicator--641937fd-386d-4ac8-ac73-462257c07642", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ad9208c-4640-4c19-bdb0-d2dc80c2a965", "sighting_of_ref": "indicator--875fa659-d280-42fe-8ff4-b39020715b6d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8699b95e-325a-420e-a8f6-8fd8b5139bf2", "sighting_of_ref": "indicator--78cd4ec4-534f-4b01-8c89-027bb9405956", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2eec2d5-d010-485d-92a5-889de81646f4", "sighting_of_ref": "indicator--685f63be-a764-4b96-a072-494e89eb88ff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95bd10f5-6e72-4fd7-b580-68546e4f3bed", "sighting_of_ref": "indicator--685f63be-a764-4b96-a072-494e89eb88ff", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e21c2f3-355d-45c5-bff7-b63ba8865496", "sighting_of_ref": "indicator--dbb3d077-f369-42a7-86ac-f1bd2d52452b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--208c3531-7d7a-4683-a8ed-6dd198ad608a", "sighting_of_ref": "indicator--c5e6bd91-cdd8-4243-b98c-f32b2445d3ea", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1c7afb3-220c-4a17-b65d-c6d9c945757b", "sighting_of_ref": "indicator--c5e6bd91-cdd8-4243-b98c-f32b2445d3ea", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3992ae4a-d527-4670-828f-0a1e34e6b451", "sighting_of_ref": "indicator--a858338b-712c-4d5e-bfb1-b1ad7b92683f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a378c8e6-926c-4ad0-9a4d-8dac05b41e07", "sighting_of_ref": "indicator--3b22005d-1c56-4ca3-ab69-3fc0ed92a66c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--263c1bec-7c01-4b77-9679-e05de1550a42", "sighting_of_ref": "indicator--28951174-51c7-4692-a733-b9e6e7e81710", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25440575-0107-45b5-b51d-b5e6062166b8", "sighting_of_ref": "indicator--d7236ace-a994-4fba-948b-2c38b88c6f64", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d177fc61-5827-4732-8f10-0d397bb634f9", "sighting_of_ref": "indicator--d7236ace-a994-4fba-948b-2c38b88c6f64", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fca43b9d-1e24-4228-a440-2bdf966530e9", "sighting_of_ref": "indicator--db79ff43-c87f-49b4-9ea6-8e4afc86731e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9583640a-ffd7-41bf-a565-cf2b6867038c", "sighting_of_ref": "indicator--ba023807-5dc3-46f0-863a-022a8a46457f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bb679d7-3709-4526-995a-a2b6c7ed54db", "sighting_of_ref": "indicator--ba023807-5dc3-46f0-863a-022a8a46457f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61383ebc-829f-4dc1-9943-142fa5f74944", "sighting_of_ref": "indicator--e907cbf0-2dc5-4b44-9a7d-b6d7a144ad19", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eeb6327-e750-4094-a33a-c3fc460be002", "sighting_of_ref": "indicator--828af379-021d-42cc-9b74-e53bb0471822", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3e27352-ba12-43bc-b97c-a124bd48ce4c", "sighting_of_ref": "indicator--713042b4-fa5a-4f54-a349-d53f06b6856c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cc56aff-6680-469d-8892-6c1ae007bf65", "sighting_of_ref": "indicator--4cce7f63-dc14-4195-8792-52e53807c7e3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fa6e814-a83f-4f3f-ace8-0c7bbb1ad675", "sighting_of_ref": "indicator--0d8a4da8-bbf2-4ac9-aad1-90eff69a1c19", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f7013fe-188e-4af7-a692-b26b70be4913", "sighting_of_ref": "indicator--fd6a5ac1-84c7-4f29-ba2a-fb4776eaba2f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d3cc8b4-59fc-4213-9970-ba68ffc967ca", "sighting_of_ref": "indicator--b456d69b-a83b-42bd-90d5-efc328461c81", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--617b1f67-9365-4ad8-80c5-251670bcce2c", "sighting_of_ref": "indicator--6e0424ba-2a2b-444c-82b3-b43fc496eb0b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da79b0aa-c98b-4a3c-bb90-cb059b70c554", "sighting_of_ref": "indicator--2d2a9ca2-a249-4082-b91b-91ea3b90a8a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0358ca45-880f-40c6-842f-1b13d9a513f4", "sighting_of_ref": "indicator--d683df83-4dd2-41b2-b818-7116059e0388", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b31ffd78-62ec-4cc8-afa1-184a448e7c74", "sighting_of_ref": "indicator--6541e408-4bd8-4075-af18-68fd35549d46", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86e8e0e9-29a7-4b8c-85de-068f2002e0fc", "sighting_of_ref": "indicator--6541e408-4bd8-4075-af18-68fd35549d46", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab7c131e-6cb1-42be-85a8-74b34d3bd1c1", "sighting_of_ref": "indicator--c6fd602b-e129-457c-9e8a-0abbb127a3f3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--495b2bcf-81bf-4ef6-ad02-9afcd6d250f8", "sighting_of_ref": "indicator--0db99872-883b-4d2e-810d-6146573a08d5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eafdc7a7-f286-4bc2-8f0e-de8ed3b4e9c5", "sighting_of_ref": "indicator--16d599a4-6237-47cf-843e-6d250962fc86", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff020084-77d0-42a4-bd5b-5dcf6d4154e9", "sighting_of_ref": "indicator--d2203c84-f0aa-4223-933f-dbcca626544e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2d49877-450c-4329-90ba-80288b067850", "sighting_of_ref": "indicator--f17db0e4-a62e-4480-8b11-c8b76e91713b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83ed603e-a457-4bec-bcfa-ea6e71a34790", "sighting_of_ref": "indicator--f17db0e4-a62e-4480-8b11-c8b76e91713b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--883a7141-cdba-4a10-8c84-c267ce1b7e53", "sighting_of_ref": "indicator--3b9ace05-a013-4de3-b4d5-7e2bbf324e34", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56364347-eacc-48c0-bac1-f70b0c4af1de", "sighting_of_ref": "indicator--3b9ace05-a013-4de3-b4d5-7e2bbf324e34", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6435f14e-0e4d-4fd0-b633-1ba421e1dac7", "sighting_of_ref": "indicator--d6d4fe14-9ce0-41ca-bd82-8388e6b702e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--868aa06a-ab6b-42ea-8577-46e30e765c7a", "sighting_of_ref": "indicator--d6d4fe14-9ce0-41ca-bd82-8388e6b702e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8f086cb-2d58-40b9-8a52-0eb1e7d22f05", "sighting_of_ref": "indicator--d6d4fe14-9ce0-41ca-bd82-8388e6b702e2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d563de09-248b-4239-9a34-36fe3a0fa6f2", "sighting_of_ref": "indicator--7c8fe6d0-6df4-4889-9654-f25b33e1245b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e816fc4-1cc1-45ee-b933-3fff4174c976", "sighting_of_ref": "indicator--908be48f-e6f3-4690-9a32-32d9b48982e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f10a22a1-cf1e-4560-ad22-58ead0db0151", "sighting_of_ref": "indicator--908be48f-e6f3-4690-9a32-32d9b48982e4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83b504e9-b611-493b-a401-97eb486a5559", "sighting_of_ref": "indicator--b3db8628-95b5-45ee-a510-d87cb8782a00", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14837865-d635-4dbc-bc41-375d1e69afac", "sighting_of_ref": "indicator--b3db8628-95b5-45ee-a510-d87cb8782a00", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46945ad7-a049-46a8-9685-82fe6f5a2663", "sighting_of_ref": "indicator--f09f8b87-0370-4b35-985b-7798b2383482", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e18a8bc-9912-4f52-b705-f1e53cb6b4e5", "sighting_of_ref": "indicator--f34637c3-fc7c-4fbe-bdcc-476bb8f3d670", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0fb0d0e-0bff-46b6-9239-c9010f54469a", "sighting_of_ref": "indicator--3f57ea21-f7f9-44d2-ad98-95003d0b37bc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--732adb12-b4cb-4f7c-b01d-ff28042f46ff", "sighting_of_ref": "indicator--5cc82e6f-a2bd-4585-860d-079b8203b580", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5195a184-b638-46c8-813f-9bc7c8e5adee", "sighting_of_ref": "indicator--5cc82e6f-a2bd-4585-860d-079b8203b580", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e202ded9-06b9-4480-97a9-032f1991ef2d", "sighting_of_ref": "indicator--4b627f10-9d95-4077-8aa3-4c8fc935e9da", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9979ead4-c430-4f71-a5cd-b3aa4ee26cbe", "sighting_of_ref": "indicator--36f80329-ce11-435d-88b6-01ea220e58e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--740ce87a-3c79-4a87-a40a-cb2c39bb95ba", "sighting_of_ref": "indicator--3a7d4d5d-fc01-42fb-9d75-37fc21acd17d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e7ae6a4-749a-4991-a14c-8f956ee2dbcb", "sighting_of_ref": "indicator--0ba6aa0c-f077-4e3e-b85c-e1a284477c5b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce4a5868-83db-49fd-a52b-aad81a982d0e", "sighting_of_ref": "indicator--cc521fd9-cbb8-431d-815a-3945a82a3982", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--345b3a1e-92df-4a7a-a3bc-d9a12fbb1b9c", "sighting_of_ref": "indicator--5d148439-c897-49f8-a93c-621795d3ab43", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ad49c75-972a-432d-949f-8a5d60c7bc8d", "sighting_of_ref": "indicator--5d148439-c897-49f8-a93c-621795d3ab43", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3272dd7d-a6dd-4fff-9262-7c7c5ad38c65", "sighting_of_ref": "indicator--b492a09e-339b-4306-ac65-8c7011bfb35b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da4b58f1-6bb2-4e5a-af67-4767c0fcf22a", "sighting_of_ref": "indicator--eba41636-af4a-40f3-a397-906fbef14883", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f9b9c99-ee7d-46f8-848a-36af5e1054c3", "sighting_of_ref": "indicator--05fc3c1d-7077-47b1-a934-56405aee2305", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a1d736f-3aa8-4ba1-9459-03454253a827", "sighting_of_ref": "indicator--a20dd21d-8ea9-4181-8809-c32399e6636c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bfcc0e4-046d-42b1-9bad-358852e21a5e", "sighting_of_ref": "indicator--3f42ba25-eb16-4f6b-83e6-ea70e7105033", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2c27f2c-c1e4-413b-a507-452ce0955179", "sighting_of_ref": "indicator--3f42ba25-eb16-4f6b-83e6-ea70e7105033", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c46de82-22b8-47a1-b3a4-b9f383c93882", "sighting_of_ref": "indicator--37fe5e6b-0a11-4321-beff-eb9c6ab53cad", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--493990e1-be9c-4ae9-9442-b73b107b3d49", "sighting_of_ref": "indicator--37fe5e6b-0a11-4321-beff-eb9c6ab53cad", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--816a9b0c-8b75-4710-b46b-f1acff2ecc36", "sighting_of_ref": "indicator--426d6ea7-5fab-4cfc-83d7-3d135000cd1d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d362897c-705c-4573-86c6-24c9b8e13cff", "sighting_of_ref": "indicator--9cf4828e-e076-4ca0-8aeb-29b0e2b9555b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc5e7f76-3097-4514-886e-1d1277fc5bc3", "sighting_of_ref": "indicator--cebf4681-c8ac-4682-a5cd-b01e726ea38a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48e1c7fb-c654-4539-893d-06b3d8432cc4", "sighting_of_ref": "indicator--33bc07e2-ef11-4628-b08f-aae0b88b91df", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0290ef47-d66d-46b4-8375-8fedd9396932", "sighting_of_ref": "indicator--8c86fc59-3f0f-42fa-9b5b-9ac1ec615835", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5d0c193-e98d-4eed-8c79-5dcf0f6cad00", "sighting_of_ref": "indicator--8c86fc59-3f0f-42fa-9b5b-9ac1ec615835", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b24db9a9-72f8-4e4f-9ebd-c54ea3a78067", "sighting_of_ref": "indicator--190c5d15-7f5b-44fa-952a-0aa129f578db", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aedc81ed-c718-4c3c-b560-4751b3326629", "sighting_of_ref": "indicator--06b4100e-bb65-471c-84e0-b4f4c6f54750", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d77cf20c-0c25-4c2d-87f7-cefc75ae4d0f", "sighting_of_ref": "indicator--06b4100e-bb65-471c-84e0-b4f4c6f54750", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eeedd30-6681-49c0-8c59-c16ad12b306a", "sighting_of_ref": "indicator--cd38d8f5-36cf-4cef-9077-d2e0f00abf21", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fd6a233-7580-4a04-8c95-194faeb1e197", "sighting_of_ref": "indicator--212c8ad2-d3a8-415b-a45e-93c2e82931de", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d9aaa16-3f67-4c58-9327-ec17736935fb", "sighting_of_ref": "indicator--540f8faf-591e-40c8-9caa-1f66473ef08f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e8fae51-6068-49ef-b45e-61e377af2fb4", "sighting_of_ref": "indicator--de097436-8fcd-46eb-bbb3-a71189be5db1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df8e5e34-ba37-46de-a77d-4c869957f5c1", "sighting_of_ref": "indicator--c1b7b91f-37ee-4255-8048-65c3d8003a6b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe0737e8-5df6-4c7a-98f0-3bfd96193b11", "sighting_of_ref": "indicator--c1b7b91f-37ee-4255-8048-65c3d8003a6b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e08b215d-d63d-435a-8921-cc641812a709", "sighting_of_ref": "indicator--cedbc619-ef9d-4de1-bb31-fea989e19ea9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f77cb30-2eff-4f66-b83f-906b057a3f3b", "sighting_of_ref": "indicator--ab170aed-e9c8-4413-bc4c-3ba4a8f99d3f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c15a04d6-034d-4262-aebb-41c7913554a2", "sighting_of_ref": "indicator--dc1030bb-2f6e-4207-85f9-d0089eabbc92", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e4d06af-e83d-4d1e-ad31-43e45429a0e7", "sighting_of_ref": "indicator--c427b872-d26e-438a-9cc5-c6fe76d11524", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c020511-604b-44f7-90d5-c5aa631157c0", "sighting_of_ref": "indicator--e35ef310-cb5b-42d8-894f-b10bb8783b8b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--486699ed-ea95-4b15-b84e-19b649807b72", "sighting_of_ref": "indicator--d91f91f3-3705-4a1e-b88c-3e142135e50e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff999fd2-b61a-45c9-9069-7ac8ac32c1d9", "sighting_of_ref": "indicator--565bf3bb-e7fe-460b-b7bd-edd10bf0fbd4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccd624d1-6d80-487b-aa28-a635ed901c5f", "sighting_of_ref": "indicator--565bf3bb-e7fe-460b-b7bd-edd10bf0fbd4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b69d58f-4001-43f0-98f7-8cd818ddb516", "sighting_of_ref": "indicator--9ec9139e-b6c5-4bf5-950d-3d3b2a3ed119", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f66bb100-6725-474d-adcb-207c0593a097", "sighting_of_ref": "indicator--53c4c874-b64b-48ef-8780-9d7d7699d1f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1015cc1-dbc9-46a0-8317-083e78e493a7", "sighting_of_ref": "indicator--53c4c874-b64b-48ef-8780-9d7d7699d1f8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26309b2d-bfb4-4e49-8624-57682e3f0b4e", "sighting_of_ref": "indicator--d35ba709-6eaf-4eda-823e-dbbf347656f5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20d1d433-66bb-475d-900b-6e43b04d6988", "sighting_of_ref": "indicator--6edd96ed-967e-4456-bf82-5db525a90b5d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe60c20b-a8cf-4b1b-935b-266cfac755e5", "sighting_of_ref": "indicator--889914f2-66ad-4a62-ba6d-e2931e164535", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5329dd1-98e8-424f-9f21-fc28db80cdf9", "sighting_of_ref": "indicator--9ece07b6-ca6d-40e9-a27f-ad21cdee95ba", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf98c9de-11c3-4f4b-a242-e4fe50646a4d", "sighting_of_ref": "indicator--ee4b1bcf-eb68-436e-9530-550c009c619e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dc4c48a-1167-4fcc-968c-120d0f158201", "sighting_of_ref": "indicator--814a9f88-7cf1-4bfe-a501-52ae0c0aac89", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa922a1b-e1b2-4517-b63f-d78e647e24b8", "sighting_of_ref": "indicator--814a9f88-7cf1-4bfe-a501-52ae0c0aac89", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--855cad2e-94f6-4262-9c21-a3d2465dff22", "sighting_of_ref": "indicator--d5750aa7-dcef-4d61-9be8-eac65b89d3ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4857eed-3cf7-4c8f-87b7-f0bb8e6361d5", "sighting_of_ref": "indicator--1c91287b-5d55-417a-869f-551715a662a0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd37923d-8e86-42ae-a21b-255b53ac62ef", "sighting_of_ref": "indicator--72dc6484-d35e-4b0d-8814-f4db61aefede", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e92de2d2-85df-4883-9ecb-855a564252f6", "sighting_of_ref": "indicator--63ae377e-e4fc-4e4b-b051-7c35cfd67b07", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a2cbf72-bc60-4c46-9d61-c79543c36431", "sighting_of_ref": "indicator--4240bde7-7a80-4382-8f29-d4e7e0a7b4c9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--596e9829-4e6c-41f7-93a8-72815e8c2405", "sighting_of_ref": "indicator--65ee08d6-4871-4116-be88-2de63e22f280", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09061334-9b2b-42c8-9f8f-972f6002573b", "sighting_of_ref": "indicator--b4960b84-bf81-4f27-a4d6-91c127dceb37", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2668e41-8955-41c5-8fb6-908687f5c153", "sighting_of_ref": "indicator--be7852b1-ccd4-4aeb-b34d-6d662f709235", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ba174cd-0768-4cf2-9d22-714a835f929a", "sighting_of_ref": "indicator--0d4b4786-3f13-4195-a6de-61957b10931c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff774795-b043-40ba-86c9-54904f7bece2", "sighting_of_ref": "indicator--0d4b4786-3f13-4195-a6de-61957b10931c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72612e96-62f1-45ad-b063-bcbe932561db", "sighting_of_ref": "indicator--e9308178-3c60-4c4d-947f-49361e58a0b2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18d19d26-e476-42e7-9fda-d3d3f402329b", "sighting_of_ref": "indicator--8381aad8-853a-446f-932b-41385d00794d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68135280-fae0-4c7f-bc1b-a47cfebeb86b", "sighting_of_ref": "indicator--42090a9f-d205-4a62-8e11-e85072a47cf3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a31f1f8b-390f-4503-bfc8-931f7d2fce1a", "sighting_of_ref": "indicator--1641a9b8-8b15-4401-bf97-0a5b6157d1df", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17388cd4-4530-4d41-ba55-aa97e55c2f10", "sighting_of_ref": "indicator--1641a9b8-8b15-4401-bf97-0a5b6157d1df", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95d855cd-8c21-48a2-95dc-727ea1e307ec", "sighting_of_ref": "indicator--b978277a-8f6a-487e-8d26-d6a65abf0abf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7cf51e8-c8a6-46fb-b60e-61d3373638c8", "sighting_of_ref": "indicator--f84499a6-0ae9-4c26-868a-61a2b7032d1f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cce8be78-c88a-448d-a5c2-518ccdeb8b37", "sighting_of_ref": "indicator--f84499a6-0ae9-4c26-868a-61a2b7032d1f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab71551a-0b92-4fa4-a540-031311de6d8e", "sighting_of_ref": "indicator--2b20f795-a119-4803-9ccd-4c0d95802880", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dafc3dd1-529e-4f4a-a219-0de1c3d4b5d6", "sighting_of_ref": "indicator--53a76c64-ca5d-4d42-85a3-feb231b37466", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf53b333-b179-41ef-a86a-877480000d51", "sighting_of_ref": "indicator--2f9b018b-6319-4134-a64b-2ac549f83d4c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f37f7a00-4f16-43be-b50c-98de66ad0d82", "sighting_of_ref": "indicator--079c3543-fc53-461d-af68-36bedc01d530", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7873a66d-7b17-42cf-92be-1f0426155e91", "sighting_of_ref": "indicator--6239c46f-57c3-4e87-9cbb-c2ea75caf5eb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbfadfb1-1ce3-4d2b-894c-783cac52eceb", "sighting_of_ref": "indicator--f654adec-e7d0-4986-af8e-a21793c8ebe6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--696c989b-e784-4f65-aa23-059e7b0959d9", "sighting_of_ref": "indicator--f654adec-e7d0-4986-af8e-a21793c8ebe6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b51e63e9-d6b5-4811-b5f8-a811c07e114f", "sighting_of_ref": "indicator--788cc74f-fae7-4560-a5f1-b4fc38baf2b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d814c60d-c0a3-4bd0-aa1e-07b8da795f05", "sighting_of_ref": "indicator--9138095a-fc89-4555-a85b-c0141e8cdf53", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23079ac7-dac7-45b0-a204-2769fb88e2f4", "sighting_of_ref": "indicator--9138095a-fc89-4555-a85b-c0141e8cdf53", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8483dbec-5ec6-4d17-bae3-e402b04e6de1", "sighting_of_ref": "indicator--b4403177-447d-42d6-b506-79c541cf524a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09d17810-6a29-4dd1-a197-0ad4165606fa", "sighting_of_ref": "indicator--f99a04a3-77c1-4c68-ac43-40ff0a0969e5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a451fd0a-2f3a-4888-84d3-832383ab9a21", "sighting_of_ref": "indicator--bf524f79-06eb-444d-ae6a-e68c530e5e07", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b2bd95d-55ee-467c-852a-55ca303bdad0", "sighting_of_ref": "indicator--46f66be9-84bb-4b8f-9537-89515bc106a0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f97affe-3220-4628-953e-8bf69b78121d", "sighting_of_ref": "indicator--3c8c83b4-4306-4366-9006-76df87773028", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec924cad-5588-4d30-92c9-3aed01da011e", "sighting_of_ref": "indicator--fedff35a-ea79-4ccc-bb86-de3d9454f600", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e91e9798-6867-4c9f-bac5-0bcdb9c14927", "sighting_of_ref": "indicator--ad9c1980-be03-4bd2-93d2-858c4a5fb63f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e34a69f7-ce45-4775-a4f5-767b4fa2fcac", "sighting_of_ref": "indicator--9b09aa26-26f2-46a7-b171-362e852849de", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f10d4300-a443-4559-8740-c8d3df2bc70b", "sighting_of_ref": "indicator--163a5227-356b-4953-8f6f-76f4782c6418", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50d09c1a-91ec-4e45-91cd-77d65449f466", "sighting_of_ref": "indicator--832821e7-4788-4540-90e5-c65f32e7c862", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad18f982-e6d6-4ce7-ab40-f3aa941ebe75", "sighting_of_ref": "indicator--4e39d796-3b9a-4a37-9243-f17533cfe1c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6e727f5-d8b8-4d0c-8d5c-bd187b004b61", "sighting_of_ref": "indicator--5e35ff49-8f13-4cc3-b149-3ad061ab85ac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f10010eb-f558-470b-b9ca-77fc6e5f4009", "sighting_of_ref": "indicator--9e7d0dc5-0123-45da-b8e0-39139ddee04b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--572c950a-8549-4793-84e6-be2c3c833497", "sighting_of_ref": "indicator--868fe17d-e7a3-4b9c-a450-24ae748e2366", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11b8486c-4252-488f-8afb-19853faec817", "sighting_of_ref": "indicator--ec5875aa-0a0f-44dc-ac92-de219d6ac64f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3d44ec5-204f-4f8c-b9f0-099e5bc7495a", "sighting_of_ref": "indicator--57abd676-340f-4e3f-ac00-79b2f677aecc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63d642f5-d3bd-4d4d-9446-ecf0957e8eb8", "sighting_of_ref": "indicator--2b833cea-1ce7-4d34-9bd1-3ae404540559", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7dc1d95-2eaf-4cc0-ba33-f18fd2757dd1", "sighting_of_ref": "indicator--776f9b5d-dc03-47ec-aab2-878601422358", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd666c83-222a-42d7-a575-4464dbcc512b", "sighting_of_ref": "indicator--776f9b5d-dc03-47ec-aab2-878601422358", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--276e99e4-7596-4773-897b-369e05d8032b", "sighting_of_ref": "indicator--fe34d4fb-3c76-4605-ae08-4f203bb32677", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--badd50c3-f0f0-4ef0-9bff-e095f849dd49", "sighting_of_ref": "indicator--fe34d4fb-3c76-4605-ae08-4f203bb32677", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab02b1c0-aa34-46a9-99ed-03e559ec8d72", "sighting_of_ref": "indicator--9d9fb330-efb6-4330-b5cc-e537c64f24c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9da422dd-1115-4244-b4f0-e22e06a93c3c", "sighting_of_ref": "indicator--9d9fb330-efb6-4330-b5cc-e537c64f24c4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ce4a1bd-df99-40ce-a711-a0e9a34112b5", "sighting_of_ref": "indicator--f6745d26-f721-45de-a2da-0e0bd2005630", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff610fa1-dc95-49bc-9e7c-c5ce0fa26786", "sighting_of_ref": "indicator--53c12650-d996-4e8d-8d93-19fa6e503a59", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bf20207-f8c5-4983-9bef-80be66d98f34", "sighting_of_ref": "indicator--198dd7ae-0089-483e-99a3-fde8008e29dd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85031ae5-7828-4944-bc57-2962194577b5", "sighting_of_ref": "indicator--198dd7ae-0089-483e-99a3-fde8008e29dd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fc4c9b4-db85-4f57-9cb4-57c7737df46a", "sighting_of_ref": "indicator--732d46ca-69cd-4e71-b08e-76577e40d795", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4582370-a7c8-462c-8217-073ac039d11f", "sighting_of_ref": "indicator--50948efd-10c4-437b-9d40-4dbce5ec2483", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8072f75-d2e8-4a5e-b8a7-fc8896a9bb22", "sighting_of_ref": "indicator--6668e647-1d8d-43d8-ab5f-ae52eec1c0e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bfe9409-3cdc-482f-b999-a6cf8d91ad1e", "sighting_of_ref": "indicator--bf4065f3-e8db-432d-b7c4-674e51102daf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--796cd14f-fbc5-4f1e-9923-d20fa86bc250", "sighting_of_ref": "indicator--5d4f1683-9820-4464-92e5-ed16c6ccd173", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--339d54c4-b960-4b51-9654-561f82598734", "sighting_of_ref": "indicator--88d52020-4c92-4214-bebe-d2371d1d55b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f45cdf7-3fa3-4b0d-b047-0a7078f76dc3", "sighting_of_ref": "indicator--88d52020-4c92-4214-bebe-d2371d1d55b4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--898afb3d-d155-47f7-b5b5-c915eb23c5e2", "sighting_of_ref": "indicator--9371a06a-b441-41ec-9a2e-d4708f25556f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31fc783c-bc32-4826-88c0-9cf043ba9467", "sighting_of_ref": "indicator--fc171f07-b598-4fb7-bec1-8906128d4967", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1810237-b24a-49d9-8bed-15a161daac60", "sighting_of_ref": "indicator--a4207950-6e3b-4328-8b33-0569617032df", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2501762b-57c3-46b1-8766-056015f74101", "sighting_of_ref": "indicator--cb4c54ef-ca80-4aa5-bc67-937a3a70139d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d52627c5-f43e-4389-a916-8a187e0fdd4e", "sighting_of_ref": "indicator--01bf2e1b-493c-4e8f-a6b9-949498992577", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ae25ca7-6194-4079-8d7f-187ceedc51db", "sighting_of_ref": "indicator--935aafe6-974f-4df0-ba56-65c0ae10f7ad", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbb5bf21-93ca-4517-84c6-87132950a2a7", "sighting_of_ref": "indicator--38c8cbb7-c6ff-428b-9252-e650b95ca008", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--553b4b68-6f5b-4293-a376-5beb6ca745f9", "sighting_of_ref": "indicator--b45f1817-17cc-4bf5-af5b-6a9f9436e10a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60930b83-5b24-40f8-9f27-cd1479ab291e", "sighting_of_ref": "indicator--390b0f76-2ef8-460c-8ec0-6ce0f708d014", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cc8d368-4ebe-4070-929a-de242682c6df", "sighting_of_ref": "indicator--5246d6ed-d598-4d73-8666-90b249dcbb3a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a75a739a-1e1f-4a1c-b656-f66c3456d2b4", "sighting_of_ref": "indicator--b0bbf872-c82d-4186-b187-0c4f49e9f6a1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a2067bb-b363-4a69-a714-7cd959318419", "sighting_of_ref": "indicator--d91137c3-a3a7-4af5-86ba-54de0e7df720", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cecf724e-d181-4068-a0b8-8ec951e15c5e", "sighting_of_ref": "indicator--4d9df4f0-b806-4da6-9d37-6d9f820c03a1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b4a6128-7a2e-442f-820d-5c647ccb6a33", "sighting_of_ref": "indicator--20eedd39-a87f-4b43-8589-6fa72694b537", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75a18443-f1fa-4e8e-98e3-08e337a5cfe0", "sighting_of_ref": "indicator--20eedd39-a87f-4b43-8589-6fa72694b537", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86731155-f22a-4f9d-b49d-306c3f53d9ed", "sighting_of_ref": "indicator--277d7ed9-280d-408f-9c41-dd3e982a9f04", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52740033-ec91-4a25-80d6-efe98a5f063c", "sighting_of_ref": "indicator--277d7ed9-280d-408f-9c41-dd3e982a9f04", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8ff48cc-f276-4451-8639-275d9c747a43", "sighting_of_ref": "indicator--9ed8c5e4-727c-420b-8fef-fec91b67d068", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24670cf0-4242-4a70-906b-01733e28c385", "sighting_of_ref": "indicator--c18c1d26-61ad-4640-8dbe-6976e4bebe9a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6c9c48b-5c47-4738-8917-9e5489fd3156", "sighting_of_ref": "indicator--aa643531-b35f-4022-8c13-ad460e09229a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea902252-ddd6-46cd-99d0-48c379d255e1", "sighting_of_ref": "indicator--aa643531-b35f-4022-8c13-ad460e09229a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e18180b-4e80-4484-8ed2-51f6738fddb9", "sighting_of_ref": "indicator--3c7dc32d-4a16-4181-a254-334df376fd5e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b9c417-90f4-4ee1-9b00-35dacada36cc", "sighting_of_ref": "indicator--b2070f59-94e4-4893-99e2-a3c5ab3c5f86", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5f7bde3-9ec3-4bad-82b4-165eb1e24e9a", "sighting_of_ref": "indicator--5c0f3d55-0c4e-4374-bd42-ced28ef55828", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8cc776a-12f1-42b7-8869-e4f03cbd78a3", "sighting_of_ref": "indicator--5b63bfef-31a9-4187-ab10-703209f19792", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e36ab657-fd5d-4ca7-b5e4-cd82e62e8787", "sighting_of_ref": "indicator--de15c807-5f29-486d-9f0d-7acd7a5f7a71", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--960c51b1-9dbd-4f5e-97c8-46033612e0f9", "sighting_of_ref": "indicator--9b85bdac-5f21-47dc-9eea-c222289be8e6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc7595eb-4560-4fa1-9d56-c29010506d81", "sighting_of_ref": "indicator--9b78b454-6f2e-41cd-ab8a-3ecb3d89db4f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f7c8449-bf86-45fb-a002-93fc5c2cfb0d", "sighting_of_ref": "indicator--1af58c98-15b4-46b7-a236-f88341ef4151", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69e8e66a-91af-4e2e-bd30-04077d03c507", "sighting_of_ref": "indicator--e604702a-52b0-4c6c-8818-b0a1f174ae7c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dd5a828-44e3-49fe-a616-06feb9007d34", "sighting_of_ref": "indicator--d3b0310e-af78-492a-8d6a-e35854d3510f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1016c2bf-e259-44e3-b9b7-22c9dd4f702c", "sighting_of_ref": "indicator--d3b0310e-af78-492a-8d6a-e35854d3510f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb40fb07-cb6e-4fcd-972d-8e60941894ea", "sighting_of_ref": "indicator--95b972bb-5fa6-4d04-bad0-99829bfe11a0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5dcad1c-75d7-4905-9ac4-793c327b7690", "sighting_of_ref": "indicator--f99ba560-3cc5-47fd-8d5b-178771911c6f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84bd5bf9-142c-446c-98be-a6a2f1b27f3c", "sighting_of_ref": "indicator--cfd7e48c-5806-46b1-9606-a92c6d7b5c37", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcf6e6f6-8127-4e9b-96c6-94edf227906b", "sighting_of_ref": "indicator--58809f44-8391-4f20-89bc-0129d34b0ea4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb708c78-ab3c-4bb1-bed9-9e3342f9a4b9", "sighting_of_ref": "indicator--0908ec64-ab0c-42b3-a14a-4ed71a04b0c0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56c91213-5121-405c-92ae-c51bab0f0ee1", "sighting_of_ref": "indicator--cb4833de-d3ee-49b7-8c67-9f732bf37dc3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8202ba4-d5b2-49e5-8429-318831319a98", "sighting_of_ref": "indicator--e00116dd-cef2-46f9-95eb-e2cb061ddacc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89a78c49-28f5-4861-9993-56824efbceba", "sighting_of_ref": "indicator--7f3f1f84-92e0-4ede-93a2-899126e99d72", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db3296c3-6388-4bec-8207-aa8975323700", "sighting_of_ref": "indicator--7f3f1f84-92e0-4ede-93a2-899126e99d72", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3415dd1-e861-477d-bd53-c5ddcd67027d", "sighting_of_ref": "indicator--9cb966c2-f653-47cf-bd7a-381b023da3c8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d931a93b-a92f-40e0-88fa-45ee93d003f4", "sighting_of_ref": "indicator--bc44f7a7-56a0-4d21-ba85-6735c5abab31", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20e0c1de-539f-433e-ac0d-1a9e044c5b7b", "sighting_of_ref": "indicator--4d984c76-9d47-4652-912f-452f599261ea", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bdbd897-5085-4caa-a1bc-48497d713e38", "sighting_of_ref": "indicator--41bf9b1b-dd3e-4aa3-bc63-6f1c4207730e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d7b9da0-a73b-4f39-b943-08562cef2e86", "sighting_of_ref": "indicator--41bf9b1b-dd3e-4aa3-bc63-6f1c4207730e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e820b52-6568-4af8-ad87-b2b78139b550", "sighting_of_ref": "indicator--9b47bf9a-4125-4502-96f2-c933c36a0d9e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--781db6f1-8024-4994-b6e6-343e7be841c3", "sighting_of_ref": "indicator--3bc49d4d-5c05-42fd-8ca1-1533b90bd986", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--458f84c4-db6c-49c6-8dee-b87250c790da", "sighting_of_ref": "indicator--3e1f42da-3314-4f4b-a8e0-b9bdea3bb52d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef2c2295-6c35-4743-badc-8f9f518bb55f", "sighting_of_ref": "indicator--3e1f42da-3314-4f4b-a8e0-b9bdea3bb52d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32531944-f449-412a-a4a7-8c3df81a3a8c", "sighting_of_ref": "indicator--288d2263-5130-412e-9ce3-9a882262958b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--963569a9-806c-4c64-a814-2b5acbb6e62d", "sighting_of_ref": "indicator--dd56dfbf-0371-4a00-abc9-79e0d5b1ced2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48e1cdb4-c24e-4b48-85c9-74e957348673", "sighting_of_ref": "indicator--dd56dfbf-0371-4a00-abc9-79e0d5b1ced2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed8e80a8-82b7-4947-b8dd-8b5607f160c7", "sighting_of_ref": "indicator--5602cb7b-26bc-446f-bcd6-b20d12e1d981", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e82baaa7-81b6-4f0b-b640-c2775bf83171", "sighting_of_ref": "indicator--5602cb7b-26bc-446f-bcd6-b20d12e1d981", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ac2ade2-8345-45c3-93a2-8e1f02af4b6f", "sighting_of_ref": "indicator--65024626-ba00-411c-9d9d-4ceeb067510a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77355122-b944-4e49-a3f3-d1a31b5bff17", "sighting_of_ref": "indicator--4570b7c6-27c3-45f9-abb2-6afac882b7bc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7bccaae-b0dd-411e-9613-fca07bb247a0", "sighting_of_ref": "indicator--163d0742-c0ae-449c-a8de-bb0b5e4f8bc1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0fdc140-0b7c-43e6-888c-6ff26170fd20", "sighting_of_ref": "indicator--84a74f67-33be-414a-b1a3-1681eac890e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b87db70f-bdb2-40cf-a0a4-1632b6b4bbc9", "sighting_of_ref": "indicator--5f198c73-35b9-49ec-a71b-ccf981fd5d36", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c615079-8228-494b-b7e4-bf3e262aef15", "sighting_of_ref": "indicator--5f198c73-35b9-49ec-a71b-ccf981fd5d36", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f630a186-4132-4111-8671-9fd262614445", "sighting_of_ref": "indicator--f8ef7b8c-469e-44e5-b6bb-15c6180fbfad", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2732a6d9-3407-4b54-a0c9-18e3fc0d8b4a", "sighting_of_ref": "indicator--5d3be856-bb62-4669-9214-0874a77420fc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--937c62bb-ced1-4b94-bb04-f19daae25ae9", "sighting_of_ref": "indicator--ec7b7d8e-eadd-409e-ab99-39d753169947", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7880831c-0c30-47fe-aee2-b8b85aa988b3", "sighting_of_ref": "indicator--f3ef5bf0-c562-47c4-97e6-58e4a0334103", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f49267ac-3ea8-4394-8452-306e9bef959b", "sighting_of_ref": "indicator--f6afd634-8208-417f-a225-7c7255d6f72b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e799a53-bf40-486d-9d69-d589f2a4f8a7", "sighting_of_ref": "indicator--9bc64fcd-5ebf-4b9f-88da-9c914f4f4640", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ebbe386-a9d2-46db-b276-c25d4c7255b2", "sighting_of_ref": "indicator--27dcb13d-58a2-4756-afb2-0cfa7c80ba7a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0d0b1d7-4d99-43c2-b195-e021c12d5bdf", "sighting_of_ref": "indicator--5a7157be-6679-4c02-9516-4e074bd4b45b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5830b35c-3459-41bc-a916-f571c04e7cc6", "sighting_of_ref": "indicator--d2c22197-65bf-4f94-8ac7-7c78af8ca861", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d888c1a-7abf-4015-b7b5-1cd9b808471a", "sighting_of_ref": "indicator--8024b2c3-a320-43f1-be9c-de7b0bb08efa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2237ce1-1821-4e19-8108-998ba60ab762", "sighting_of_ref": "indicator--5551f427-5e11-4d9a-9186-d5327fa20f84", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7e4b1c8-795b-43b6-a6c7-fe5eb7981119", "sighting_of_ref": "indicator--c6729464-2150-490c-91cc-1a9ed75e4c83", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0547028d-a21b-4dd8-80d8-64eb5c80bea5", "sighting_of_ref": "indicator--357d4578-8ac3-47ad-a068-934cccf29c59", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--925f3625-c7ab-46fb-9ff5-338e60eadd0e", "sighting_of_ref": "indicator--e3d0d416-3da3-4fcc-9610-0b753cd38de7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf5c59b5-1074-4453-a0c5-c7d7e56f7c6b", "sighting_of_ref": "indicator--d42e45a6-758c-4cdc-92ad-e375b78d912f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76c275e5-909a-4be5-9227-6f6e5202cbef", "sighting_of_ref": "indicator--21a08fe4-4593-41c9-aa01-3e7d1d2f728b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16c94883-0205-4f09-acc7-bf55d51d06d9", "sighting_of_ref": "indicator--acaf89b0-e474-493c-9569-0d81a1d976cb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76c54476-ccd4-41fb-8eb6-6077b6dcad88", "sighting_of_ref": "indicator--acaf89b0-e474-493c-9569-0d81a1d976cb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a3d9e34-410d-4414-af22-227c8b91a1b0", "sighting_of_ref": "indicator--16c4bc36-aa4e-47d6-9809-dd29bd65442e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6bad9e0-e345-4a5f-acee-0c35821119c0", "sighting_of_ref": "indicator--16c4bc36-aa4e-47d6-9809-dd29bd65442e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96fbb2d1-2b8f-4314-acb4-721693bf0a90", "sighting_of_ref": "indicator--ebf8bb0f-255b-49c3-ac4f-efd3de649705", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7301152b-d8c6-4c68-bf61-f7ade464dcb4", "sighting_of_ref": "indicator--21b36f4c-7d5a-46ff-b55c-ae1554d3c135", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b71cac2c-cbe1-4b27-afd8-8ef9fffe86e5", "sighting_of_ref": "indicator--f4ee669d-c55d-42cd-bb60-eaa97d35333c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03482de2-1f73-4b6c-958c-cdd66ff3278b", "sighting_of_ref": "indicator--4f802666-a337-46dd-8192-4da2eef60792", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e92cb535-c833-4b6d-8975-6202ae4a922b", "sighting_of_ref": "indicator--0206c423-61c8-41a6-81d2-0522ed5dfc58", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f7d381b-a9ea-474c-b258-f11c3a1edc48", "sighting_of_ref": "indicator--0206c423-61c8-41a6-81d2-0522ed5dfc58", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbfdad81-29ee-4f0b-9e87-1802860709b3", "sighting_of_ref": "indicator--cbd48d66-deef-49d3-a481-5c373c97f900", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63e3bcc6-b7f0-46a9-8b64-24974a05eecf", "sighting_of_ref": "indicator--5a873699-947b-4502-a3ba-6f2a2f0f7cc3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16974f66-bf4d-4117-b28e-6d9367cd0760", "sighting_of_ref": "indicator--79b033c5-7da8-4305-8ff7-58a7c7e6d438", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0167a6c3-05a6-488d-b302-80ac983172a8", "sighting_of_ref": "indicator--4ee3e6e7-8cd7-45c6-bd47-c25dc7061033", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9248ae0-5663-4cc9-a25e-f5fd4ff7766e", "sighting_of_ref": "indicator--0fb66cff-2948-4aa8-ad18-b341dd63a650", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afbfe0a0-d64b-41ab-967b-6e3501604179", "sighting_of_ref": "indicator--eb88e843-a845-4ab5-9a90-12f036a7db45", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7dacd53-f647-4480-ae7b-d8e36143b2f0", "sighting_of_ref": "indicator--eb88e843-a845-4ab5-9a90-12f036a7db45", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbac9ea3-faad-49c6-b88a-2d7a0e11df41", "sighting_of_ref": "indicator--61b4ce6c-978e-47e3-afc2-d5080eb5e28e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9ab673f-d6d2-44ff-b126-e5c4ea602e3b", "sighting_of_ref": "indicator--eda3c6f1-f859-43d5-bfa0-b5f64deedd84", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1761fe0-c13b-4c8a-8253-66645522dfc0", "sighting_of_ref": "indicator--c7c90f4c-91da-462c-b33a-b2ab78b6af0c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86707eaf-ff8f-4e1a-8424-f70f47f6d1bf", "sighting_of_ref": "indicator--c799869a-f006-4b45-a1dd-2507709efcde", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5a91e1d-312f-48a5-b1ee-8f9aaba0ee18", "sighting_of_ref": "indicator--5f7c1a55-0c93-4273-90f9-41738d91866b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64364c21-2bf8-434c-be0c-1b11864cd7d6", "sighting_of_ref": "indicator--89785c6e-2d7a-4964-a53d-37e1f4fd48b8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe83677f-a07f-4c13-b482-d6af5f20b6fa", "sighting_of_ref": "indicator--89785c6e-2d7a-4964-a53d-37e1f4fd48b8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae179446-ad9b-40b6-a026-8338bd50e43a", "sighting_of_ref": "indicator--ec5dd500-d161-43eb-970e-1975a7132566", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a89f048-a83a-49c2-90fa-74a8d03aa72c", "sighting_of_ref": "indicator--ec5dd500-d161-43eb-970e-1975a7132566", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26953fab-fa61-4313-8951-18950745492d", "sighting_of_ref": "indicator--367a74d7-28ab-4364-adbb-df7e9ab5d3ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8aecc834-8fde-4262-95cc-cec00bbf2c0a", "sighting_of_ref": "indicator--ca4d8604-bfaf-4b19-9237-1c9613dc156c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e8c78e4-8b56-4b68-b3bc-1f4870ca689c", "sighting_of_ref": "indicator--99196b57-bd7a-40bf-b369-adc188f9c6b6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0b315e0-755d-41af-ae11-b0dd92e53951", "sighting_of_ref": "indicator--7adf976d-4da5-4258-ba11-e7ebc76ee361", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2550e99-97d8-404b-946e-ee8f1e83befc", "sighting_of_ref": "indicator--7bca5564-c3f0-4c9f-8127-3e0cb24bf717", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c518919f-b670-4206-bfb7-a79ac2f646b5", "sighting_of_ref": "indicator--459581a8-d486-4f6f-b3d6-bfc7e8c2b891", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b983ca33-e6b8-4e24-94d3-d5bff3ddbaf4", "sighting_of_ref": "indicator--82192680-0ce5-4490-9533-9acad7ef5495", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6416722a-35b2-4af6-8851-018abfc27760", "sighting_of_ref": "indicator--965dda86-e982-4ab0-a9db-f638e4d77a60", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e2a3cec-2d30-4f8b-a733-75f3e34e3c21", "sighting_of_ref": "indicator--965dda86-e982-4ab0-a9db-f638e4d77a60", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4e41de0-5294-46a1-bdc5-955549ae8136", "sighting_of_ref": "indicator--42ea7a1d-b353-4c46-a0b8-c92516200cdd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f6160c6-a800-4d8a-9421-a4f2242a645f", "sighting_of_ref": "indicator--3dc3fe2e-3602-443c-a672-e12fee08521f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faa6f49d-f06d-48c2-8095-e51b2db1416f", "sighting_of_ref": "indicator--c0742b67-f2f5-4bc2-9d21-6da67a2088ba", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb8d948f-b222-40b7-9a29-b18a73cccfc0", "sighting_of_ref": "indicator--cc5cb631-3f3f-4a93-b490-56899719a0d3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f35da00-cf7a-4092-b9ea-4e7193d69965", "sighting_of_ref": "indicator--cc5cb631-3f3f-4a93-b490-56899719a0d3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80789dca-c74f-4ef1-8582-047054d778d0", "sighting_of_ref": "indicator--613a0f60-c862-457e-8a8a-a17ce2910e0a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cb1c16d-d681-4f43-94f4-7692c2c9b3a0", "sighting_of_ref": "indicator--f98ab71f-63d5-4960-8338-b2af5060254f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9edb3791-c605-46ea-94fe-892ad06ec3e6", "sighting_of_ref": "indicator--7a916184-5918-4847-a545-7372ea5ee20f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acbdf23f-a312-4b4e-9ccc-3d76106ece68", "sighting_of_ref": "indicator--99b64fe6-b182-4325-a1a9-43eddf2fa011", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--835e3606-6056-4db3-8eb1-9d616f4d7dbb", "sighting_of_ref": "indicator--cf083a63-9204-492b-9119-fbb38081395a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbaf0dbc-fb53-4fb9-b93c-ff82505426f8", "sighting_of_ref": "indicator--1ad4c2c2-f020-4935-bd8a-e8b1651bc211", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04e53ecb-d3ef-400f-a108-017fbc617c62", "sighting_of_ref": "indicator--d06c2b8e-543e-4ec7-8ac2-371773cc747d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9de00012-15d8-4c17-a37a-6729c2d8b188", "sighting_of_ref": "indicator--15861480-7e73-4570-bdda-f98fe2faa097", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b04f915-ada2-4f97-9587-2d06efab43d3", "sighting_of_ref": "indicator--ed14bc92-1f74-4b39-b4b9-d243be391e0a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2932e24d-4b1f-47d5-acef-fafa58f37dbe", "sighting_of_ref": "indicator--53b9f5c4-dd85-4232-a5cf-a2cef5782b0d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36aa9980-1e4f-4b59-91e9-64784230b6d0", "sighting_of_ref": "indicator--59030488-4778-4d88-b389-6d634f450903", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a91cd161-89fa-4842-8e32-844084e2f75c", "sighting_of_ref": "indicator--d75a82b1-d88b-40bd-8a97-885948d9513b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55f3da0c-4b40-4e6f-b939-425da34cc190", "sighting_of_ref": "indicator--ab9a8b77-711d-42fb-b786-caea24a9510d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6112202-24ad-45c2-ba8d-4138dab55e66", "sighting_of_ref": "indicator--ad90c776-b11d-431f-a46d-64be502a70ab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--871fe12d-d361-4356-9af0-df3715384a43", "sighting_of_ref": "indicator--3ecc5514-8baa-4ce4-959e-e0a4c9a1503e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59c4083c-fbb3-4e2a-91df-2c9b3bca3f47", "sighting_of_ref": "indicator--336a535a-7ed8-4107-b47b-b94f395bfced", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99415410-3f01-4d2f-8f20-a806899f446a", "sighting_of_ref": "indicator--b3006886-c574-429f-8e02-67caab60cbbd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da4504e8-9fe2-463a-96f5-dfc5b15a4027", "sighting_of_ref": "indicator--28f79ab1-9faa-4a13-aefa-4552b3b76e57", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aea94b49-5783-4a6d-bbf8-357b2c0969eb", "sighting_of_ref": "indicator--f152d395-36e8-4291-bd53-839733264d41", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdfff971-3255-464c-a68a-43e09ed17df5", "sighting_of_ref": "indicator--8bece5ee-ebc7-4d94-8cb1-faffb77889ab", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2990ffa-d228-4309-9f4f-a1f860809f7c", "sighting_of_ref": "indicator--c5fbda37-6e32-4491-9d4c-00ea82a94a42", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04eb88dd-c3b3-4cd1-a06a-17c8b9e320b7", "sighting_of_ref": "indicator--5c9f8e1c-eb33-4fd8-8fa0-4877f14345ea", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65f33df8-f740-4d1b-bb80-aee28e33fbfd", "sighting_of_ref": "indicator--69394d46-f207-4dd3-b415-31a1307094e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85595705-a681-41e1-89b5-20fba1a61829", "sighting_of_ref": "indicator--d78193cf-1d5f-4a61-a7b6-58f287ecf998", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bce652a-0d95-4385-8ac1-4ef0f244d66f", "sighting_of_ref": "indicator--966d85e0-52ea-478c-849e-c33b86cce1ac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91936163-ff8d-4027-a1a7-402dc452d504", "sighting_of_ref": "indicator--0d03dbc4-7cdf-481e-a321-91d41a8c87ff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c509474-438f-4dc0-b855-a21d0277ed9b", "sighting_of_ref": "indicator--ad9e7e59-17c9-4751-bc3b-e1c5accedfaa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e3d63bd-1333-4816-8dff-b3074736481c", "sighting_of_ref": "indicator--33e6ec48-b6c7-478b-9961-cda86dff525e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26ffed99-7450-409d-80a5-fd5f4904d727", "sighting_of_ref": "indicator--d3ebbacb-da62-4f17-ade1-9cb29b1509a5", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da38b959-894e-4c18-ab6d-02782ab06e2e", "sighting_of_ref": "indicator--1c8fa269-f002-4999-9cc7-5582cc11d9b3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--766471db-6dad-4591-a98b-80e90a133583", "sighting_of_ref": "indicator--c79bff25-5ac4-4223-b628-aada6bdea6d7", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac4e6692-a59b-4105-bb60-e17ad8e782f2", "sighting_of_ref": "indicator--440b1823-d73f-4a9b-9e4c-3751be66e78b", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c1c6a25-e0f6-47f7-ad99-1fb4b637c889", "sighting_of_ref": "indicator--dfacf24e-016e-4474-8343-02ecf239679e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43ea5c5f-fa7b-491c-886a-505698bbd7fa", "sighting_of_ref": "indicator--ccb251e3-b21d-4803-8035-a9ff43da575b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4f35b13-1dcf-4167-8840-d36d743005c8", "sighting_of_ref": "indicator--4e0f5cb9-3d78-4add-bb0b-c64ca228daf3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0923fc49-a34b-4b2c-b8d2-a6db6a2f1362", "sighting_of_ref": "indicator--28a5b118-843a-4b25-9334-4b78a887de28", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96b5659f-0fb8-4077-ba5b-6c7f47ceb144", "sighting_of_ref": "indicator--9eddb540-55c8-4db2-b626-639b906b0135", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff84fdbc-1c6c-42e3-8fed-4fc1dc8f62ca", "sighting_of_ref": "indicator--104f1e15-ae73-417b-999c-41b4b87b42fd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b1c9cf8-58a6-4bb5-a5f8-0a56ed78d34e", "sighting_of_ref": "indicator--a20cc7e6-795f-4946-bc4c-36c730f3e06a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69855b28-d467-4b13-99d5-1c9bf49dff85", "sighting_of_ref": "indicator--1d7de407-efaf-4043-889a-bbed4268df16", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--755b804b-b613-4eee-89ef-f2b1a2f91804", "sighting_of_ref": "indicator--ab2ad294-7873-4d15-839a-553d10564d7b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35717180-d509-49ea-85a6-6d456d3e0576", "sighting_of_ref": "indicator--89e0280f-2afb-44b6-a523-f67a53f0030a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24412895-1376-4ddf-ae54-496cb99081c2", "sighting_of_ref": "indicator--89e0280f-2afb-44b6-a523-f67a53f0030a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3d69d68-a09b-4ae3-9fb3-bac8ef085a41", "sighting_of_ref": "indicator--a6271be8-3c03-4d1f-b1dd-29460de66ea4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50eb84de-1a50-4c58-8a2e-db9cf0c7638c", "sighting_of_ref": "indicator--f764ecac-e154-4491-a49a-53a120a349b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c21aedf7-5a0a-411b-8feb-33de2a675876", "sighting_of_ref": "indicator--2f32138c-9814-49a6-98fe-345b9f292aa4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8dbee52-16fb-4e8c-96a0-6938c5f088cf", "sighting_of_ref": "indicator--db4f76d5-a8c0-4c7d-8cab-13dc77735dd2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21bc891b-dfcf-493c-8dc1-81b2f5f373ad", "sighting_of_ref": "indicator--9a708f1d-10ba-4079-a271-f43aebb9da68", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f93210c-4131-420c-a6a6-4cef1b110d59", "sighting_of_ref": "indicator--9a708f1d-10ba-4079-a271-f43aebb9da68", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94ca1879-6f58-46fb-88bf-40fafac527a0", "sighting_of_ref": "indicator--20689cc8-566b-4cbe-87de-ff6e93af9766", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ce1b716-704e-4e56-93c5-343e51b3b875", "sighting_of_ref": "indicator--a37f31eb-5c81-4e47-8d80-734bb1e8a479", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc55c37a-7a45-48d7-9f2e-f51fd8c97377", "sighting_of_ref": "indicator--d39426de-ccbf-4325-9808-c03ff431f3c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fecb6bda-34b8-4be8-be88-917d926a7b94", "sighting_of_ref": "indicator--30ea6a53-6379-4638-847b-5dc4be934f84", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a5938e6-a498-4a90-a140-2af3c1ca540b", "sighting_of_ref": "indicator--baaab722-135e-4a1d-9622-07662ada13a4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68a72b87-a580-43a4-be42-b89d62471a42", "sighting_of_ref": "indicator--46687be7-ec51-4ad3-998a-21fcd1fdbd51", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3031bf4e-6140-45c7-a03f-67f9ad4bef14", "sighting_of_ref": "indicator--6fff257f-4fb2-4618-91eb-5d86416ce69f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a9f4de7-38a2-46b8-80ba-ab81f82dfb01", "sighting_of_ref": "indicator--9a2dd082-aec9-4d60-9fdb-4e790eb44a82", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efdc66db-aeb0-48e7-adea-d144171e1f03", "sighting_of_ref": "indicator--1911b9df-87cc-403b-8499-ed51bd0d32aa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18b8f717-148d-476e-af39-1dc274a1011d", "sighting_of_ref": "indicator--86b8e51a-aff8-4305-9025-96e143a5c44d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48f58ca6-b51c-4e38-861c-347ef3c70ec1", "sighting_of_ref": "indicator--b3fbaeae-fc96-4f67-9406-7d594d006320", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bb190cc-c40f-4bc7-9c4b-5964e26b0c61", "sighting_of_ref": "indicator--04ab7da4-ebb5-4bfd-a9bf-ec0cea70264e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c13e10ba-17ab-4cff-8804-8db318d3d530", "sighting_of_ref": "indicator--42ee5e83-317b-4f2b-b002-7038990a08f6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cb48739-68d9-41e4-a2bd-9f13156174e0", "sighting_of_ref": "indicator--a42eb435-88f5-4fcd-907b-b7bdab397a86", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--021a431d-6628-43e9-93da-bbbf14b1d9a7", "sighting_of_ref": "indicator--83c6099b-61b2-414f-b058-effcfd0dd036", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e695796-f67e-4bfa-95ed-f3b58194859d", "sighting_of_ref": "indicator--710ffc1f-aa67-40cb-adb9-6130f042879f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--732bb130-0117-4cde-bfaf-9db008246e20", "sighting_of_ref": "indicator--c40e58b0-5d2d-422c-8868-79efaa7f4c93", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a489c82-000d-48e9-bf99-beb0ff6f6124", "sighting_of_ref": "indicator--1c528a80-b9e0-4c69-998f-956094774b8d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5e4d5bc-b8ab-4b0b-b200-790a042988ef", "sighting_of_ref": "indicator--66f56174-fe6c-45d5-90e1-5eab5b68eabf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55ac2236-5c79-4669-86c8-7340bcc9308c", "sighting_of_ref": "indicator--66f56174-fe6c-45d5-90e1-5eab5b68eabf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c51b519f-ff01-4c9a-8bcc-3d2c0b228042", "sighting_of_ref": "indicator--458a1bff-6f01-4953-af87-8193dfa1c6ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--441dc8ed-2932-416a-a1eb-035a60c529f0", "sighting_of_ref": "indicator--77a9bfb9-a456-4553-8a83-0e66528c6cba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1edbb8f4-d99a-4d2a-88a8-f9d90886b29e", "sighting_of_ref": "indicator--536b9f9f-e895-429e-b5da-3ba6dacd0122", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1afda726-4aeb-4ca8-aaaf-11aac0ceed76", "sighting_of_ref": "indicator--0c597831-dc21-45c7-bd93-847cac9aafa3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eddbe356-82d8-46af-a30c-724f4991b7de", "sighting_of_ref": "indicator--ce3ba2e6-8f5c-434a-9d7a-a8141c76da2d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1aa4b7d9-a287-4421-8949-2633997beeb3", "sighting_of_ref": "indicator--fe23db11-eb56-4def-b568-33a1deed7ef0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22fc43fd-5446-46ea-a109-9d9591db74c7", "sighting_of_ref": "indicator--1015b319-ad7c-4b96-b319-d4820c6ea421", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--852b0a30-4693-41a6-a99f-1d96de8cec71", "sighting_of_ref": "indicator--29db27d2-7ce5-49c9-9d88-833a5cbc5919", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4248a080-bd38-4d24-8ebe-b3a7684d3882", "sighting_of_ref": "indicator--a86ef742-0e07-495c-93b1-c5137a7df43b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70cc82e9-94de-4ba3-b847-a9eab10b8975", "sighting_of_ref": "indicator--da8fa878-ca59-46fd-b72d-8ac73e01f6b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2d4246d-401d-4c89-b1ab-277477dcb3b6", "sighting_of_ref": "indicator--85db7889-de53-4071-912e-50f7b98a61e7", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c852c194-1818-400a-af3f-ddc5fcfcdbdd", "sighting_of_ref": "indicator--0e3643d9-d225-4e6c-836e-d86322a7117b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7799f47a-43b1-4e1a-9a86-3e5242b09d32", "sighting_of_ref": "indicator--0f1a7fc3-744c-4922-a1bb-c260b7f6adbf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--131670b1-07d7-41ad-8d0f-a47eb0426fb5", "sighting_of_ref": "indicator--921fdb0c-6482-47c5-9ba7-38d8bca1df43", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--023ea8c5-5a6e-49cc-a5ed-736c9f7bb0d9", "sighting_of_ref": "indicator--3a51b986-4fbc-42af-9ebb-b878351e560a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82e5249a-28c2-4089-9481-0242e406eff6", "sighting_of_ref": "indicator--0963dfc3-8630-4be1-a7d9-5bfc79d29373", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80d07a98-12bc-452c-ad75-b0dbd6bb22e5", "sighting_of_ref": "indicator--2f2e1701-ff13-47d7-a24e-7369e269485c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cbfcc27-d9f0-4647-8760-4b3696726da9", "sighting_of_ref": "indicator--5c06cd41-1606-4a46-98a1-663b9d65298a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da54c09a-3f81-48b7-acb3-cc2e27142642", "sighting_of_ref": "indicator--f31fa05d-d123-4b5c-8dfb-e75de7682c76", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b853bdb9-7ece-42cf-a32e-bf3d5e925ed5", "sighting_of_ref": "indicator--1b3549fc-4c71-4d74-84fc-c0c623d1a4aa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19f349bb-d391-4456-bc07-1666004e6af2", "sighting_of_ref": "indicator--d97f0cb2-b0d1-45f6-8951-632f1967f11c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93cea6be-b36f-449a-973f-00407e57a26a", "sighting_of_ref": "indicator--547c9bc7-b5fe-4063-993b-eb4c343b5a82", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1702a87-e1bb-4f8e-8805-68192fecc487", "sighting_of_ref": "indicator--99dc64ba-c207-4fa4-b5be-274d50ab1261", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dfe614c-35c9-4723-a430-159d710d05ff", "sighting_of_ref": "indicator--6f2d1fed-d675-48ac-affe-1c5a688f265a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d547f800-4641-40d9-8c98-f9ca0c911e08", "sighting_of_ref": "indicator--14a3416d-63fa-46b6-9337-55efd98af442", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4706bf01-f0a3-4a68-81c3-518c1398c62d", "sighting_of_ref": "indicator--f70931c1-b159-4c25-a7ee-b4927409490d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5cd3a57-9cd7-4523-a6d1-6af4d8cedccf", "sighting_of_ref": "indicator--67434d1f-8a06-4496-8e6c-66aa0f1c59cc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--465aa431-ec44-42d0-af22-9f5d505f159a", "sighting_of_ref": "indicator--ab7013f4-a4e8-4bab-9cfa-0408a9f2112a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e72e00a5-ed2f-462d-b629-5d2ba0de32ad", "sighting_of_ref": "indicator--31014567-b2f5-455e-bcab-b3f59215d61b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0c2202c-7b31-4de3-8e84-def5e3e8820f", "sighting_of_ref": "indicator--9195cf30-dfd1-4811-a1ed-baca3f212bf6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94a04145-b499-40af-8a85-a5747123ce69", "sighting_of_ref": "indicator--ef73aac8-1bfa-44b4-bc4c-565afc3f263d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a2eeda2-5c77-439d-bd8a-6b94bfe0580a", "sighting_of_ref": "indicator--ca0eb70c-e231-4d74-a7a4-5c1a931e1eb0", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05b000c5-2428-4386-995a-3ef922e5aeda", "sighting_of_ref": "indicator--efe1780a-dd0a-4f36-bf68-a4904e0103cd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b52975d4-854d-4090-9b03-0deb97ddcaed", "sighting_of_ref": "indicator--8a80bc27-f8db-491b-9c2c-91f39d59f85a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--884c4472-275a-42a9-a508-d985c6b98067", "sighting_of_ref": "indicator--a5821082-c011-4dcc-9573-28ddd244fa94", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef691f7e-76c8-4d3e-b19e-0bf9acc6dae0", "sighting_of_ref": "indicator--9b49a41d-ae9a-4a55-a40f-b97e9b84d167", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdca667a-ce9c-43d8-92d2-e1d7a1ce0c7f", "sighting_of_ref": "indicator--bb037201-bcec-4fa3-9d9e-9e55eed185c9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--091833ab-6d65-4313-95fe-d0ec44c527ff", "sighting_of_ref": "indicator--bb037201-bcec-4fa3-9d9e-9e55eed185c9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87033f4c-5a3f-498e-ad92-cccaacfe46ee", "sighting_of_ref": "indicator--060c7ebb-b6a7-4118-ac57-c6d5bfb3ec75", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfef5b40-62b4-485c-95c1-5548aca9eeb5", "sighting_of_ref": "indicator--6ad3ac8f-7d53-4dc8-8452-1ea7266a1a1a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb28bdd0-8647-4294-bf43-b9082a31a049", "sighting_of_ref": "indicator--a5d458e3-616b-4e74-b04d-89f710b17e4b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2272b399-7327-45f7-91d9-962b52ee7a95", "sighting_of_ref": "indicator--48596d5f-0433-464c-9af4-96faff545bab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62238ed9-6cf1-40e4-80d4-1e72314fff88", "sighting_of_ref": "indicator--77b623ad-1b9c-457f-9c1a-015aaded946d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aee9bdac-e487-498c-a1dd-996b3bb7b59b", "sighting_of_ref": "indicator--77b623ad-1b9c-457f-9c1a-015aaded946d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--782a3f8e-8fbd-477c-8a6b-49f5290cc156", "sighting_of_ref": "indicator--35dda5dc-30b1-494e-953b-417336cde483", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5b056a4-a06e-4054-90fc-7d92ebde34d4", "sighting_of_ref": "indicator--35dda5dc-30b1-494e-953b-417336cde483", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6f69aa4-b153-454a-a505-ea5e138870e2", "sighting_of_ref": "indicator--335fa0d9-0eac-48d7-af2e-3d70dee1c2e9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c29347e7-6cfb-4120-87f9-f7212cd4af62", "sighting_of_ref": "indicator--16a9b13d-3ebf-4798-a995-b67a036a6ac5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39938893-9df4-4aee-a828-5a6eeca2371b", "sighting_of_ref": "indicator--832c77a8-48b8-491b-a7f3-f96566bcf4d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80abbaf9-d8da-4731-ad2b-9a784c8093bd", "sighting_of_ref": "indicator--832c77a8-48b8-491b-a7f3-f96566bcf4d0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40bc9aa0-9a3e-445b-a9a5-d38498d16d88", "sighting_of_ref": "indicator--18656967-67a7-4c3e-9714-c5bb6863ae43", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6147b734-36f1-4854-943e-ddbe487c9fe7", "sighting_of_ref": "indicator--dcdeb667-c045-4b1b-b5dc-f88b3c25e4b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cba761bd-4c5f-473f-a4a5-456d38decd33", "sighting_of_ref": "indicator--beec3b05-159e-4711-b5f4-0f554e17b9a4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63c0dc6f-9287-4507-901b-f73e77d56e8a", "sighting_of_ref": "indicator--aa74bc13-78be-4959-b012-91a31ee080a1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f16ab3e-3fd4-4faf-b29a-b11c313ae328", "sighting_of_ref": "indicator--33b1f265-05b4-49d4-92a2-6dd55d26d228", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4deca649-f578-49c0-8606-b0733852eea9", "sighting_of_ref": "indicator--71a7f52c-6106-47c2-ac16-2a05c709ca0c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9b7021a-97a9-42a9-9f01-7ab8f366d2e2", "sighting_of_ref": "indicator--9ab0818d-56ca-45fd-b0d2-4801b60a5693", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1bc3c75-1379-4224-955e-5b0698c7f085", "sighting_of_ref": "indicator--5684394b-8db5-4cff-a1a1-1a378245c53a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8497fce7-3141-4f2f-b221-99eed647be1e", "sighting_of_ref": "indicator--5684394b-8db5-4cff-a1a1-1a378245c53a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a672b59-fc0b-4eb8-a2d5-459c8d587dc4", "sighting_of_ref": "indicator--00969830-d9f6-495e-8de8-7851504c9780", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2c28cd1-486e-4c02-9a6a-ce58a392c98e", "sighting_of_ref": "indicator--c08c17ce-ca59-4ade-9134-055a21acdb83", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a07eeda-9550-456a-b894-a991c1d4787e", "sighting_of_ref": "indicator--c08c17ce-ca59-4ade-9134-055a21acdb83", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00c7b34c-24ca-4bd1-94be-b12d4ef05712", "sighting_of_ref": "indicator--1f498da9-6b06-49ef-b9b6-f856fae2c6fa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--995c88b5-18c5-4425-87e2-5f004bced005", "sighting_of_ref": "indicator--1f9fa068-d665-452b-a11d-d6fc644576b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f37d430c-ab13-4fef-aa69-85261de5e09e", "sighting_of_ref": "indicator--9b80b250-c938-4ed2-89bd-e0094f1d367d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ac75d24-7de4-4403-b5c9-eca5f60b9cce", "sighting_of_ref": "indicator--b3a1ad61-1f27-4823-a015-f3b1546de2ee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8b4bfdf-b4ca-41a7-a6fe-afda84668be8", "sighting_of_ref": "indicator--5f799de7-2bbc-442b-9dae-0ad798dc306e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbc59f74-e37b-47d5-a592-a6bd7e3a55e9", "sighting_of_ref": "indicator--84efde15-2c49-4b79-9d00-c1a7612cd36a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10e8d73a-4508-45c2-b7ef-75c99b3dd2c8", "sighting_of_ref": "indicator--d90e5216-447e-4fdd-852b-6b6f683db60f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2771a751-855d-4359-a80e-b235cc3c9ba5", "sighting_of_ref": "indicator--f81b5224-bab7-4040-a967-f17d748960e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9f6e434-cfda-4825-b95c-8ca14e734ec7", "sighting_of_ref": "indicator--b24cc870-46b3-429e-ae75-5f2e89aede83", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--733c05f1-3c81-4c1b-b820-49eb87c099d0", "sighting_of_ref": "indicator--9863b9fa-3491-436a-aa33-e38dffb553f4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a230bdf1-95e9-45d2-986b-c7b3a00a8ebf", "sighting_of_ref": "indicator--9863b9fa-3491-436a-aa33-e38dffb553f4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a9b0159-8238-4b24-a2c5-9470edf81333", "sighting_of_ref": "indicator--fb0eb927-ce53-49be-9dec-47d2c99ed830", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf2070d3-3422-424c-9f14-c1babb950409", "sighting_of_ref": "indicator--fb0eb927-ce53-49be-9dec-47d2c99ed830", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df010d5d-0219-4919-a5df-0f21f20c1d51", "sighting_of_ref": "indicator--776a59e9-4f46-4072-9d1e-114d80bab200", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaa50306-c35f-4f93-af76-80023212c745", "sighting_of_ref": "indicator--2d05f61f-7253-403c-8216-c0000309d6e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebc58f81-3e0b-4cf3-8595-c5c11a1c4039", "sighting_of_ref": "indicator--2d05f61f-7253-403c-8216-c0000309d6e4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c750e97d-8446-4410-b54e-c816afa546dc", "sighting_of_ref": "indicator--6c864e60-c7a6-458e-8da8-8c106905bf35", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8e69fa8-cf02-44e9-a597-60ddc2b2a33e", "sighting_of_ref": "indicator--6c864e60-c7a6-458e-8da8-8c106905bf35", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--778f0b04-b555-4bd5-9b88-9097700ff943", "sighting_of_ref": "indicator--ee1fcfa0-4166-4942-a53b-46df9adc53f6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a024d9e-9c8c-42a6-bf27-56b5821499f8", "sighting_of_ref": "indicator--ee1fcfa0-4166-4942-a53b-46df9adc53f6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f17874e-7563-48bb-aad3-bab361126400", "sighting_of_ref": "indicator--df6c4acf-86ea-4bcc-8710-482199c34ed2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f1cdc77-a4ee-4210-ab46-407a0068de70", "sighting_of_ref": "indicator--a2ce31b0-42e7-4cf9-b35b-433670daf04b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c08215ae-6f94-4c74-be82-8afe01d8a0aa", "sighting_of_ref": "indicator--49b318a1-f8b6-4577-a123-ac4d33e609a2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49fcfffd-9527-40bf-827d-05fd15cb1633", "sighting_of_ref": "indicator--19dfe9df-3d17-4731-a850-f09ae4f9bacd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ee0a952-cba7-4fa3-b378-460b462eaba3", "sighting_of_ref": "indicator--19dfe9df-3d17-4731-a850-f09ae4f9bacd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88dcb03f-6987-4b53-8266-e3fd584f2120", "sighting_of_ref": "indicator--748cda8f-a2f2-458a-b116-216da94bf339", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78c0a30c-67c1-46da-9a72-e9e51189801b", "sighting_of_ref": "indicator--5990a8d7-3ba5-4b46-8a03-3c58d6c96505", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eda42ba-044f-479f-a73f-75b46be94ade", "sighting_of_ref": "indicator--5990a8d7-3ba5-4b46-8a03-3c58d6c96505", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b14fff1-d5fd-4cec-8205-67f1a7626650", "sighting_of_ref": "indicator--81e510cc-c229-4b59-b191-54a14dcf6a8e", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68114154-0635-4619-9cf4-cc27c52d990e", "sighting_of_ref": "indicator--81e510cc-c229-4b59-b191-54a14dcf6a8e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0935edde-8fb7-4d12-972e-8f23a015b3f8", "sighting_of_ref": "indicator--f6be3dfb-1ec2-49a9-9430-148f3dcdec19", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57cbffa8-3056-4f4d-85e2-075f043eb127", "sighting_of_ref": "indicator--2a5860cc-dc3a-41b0-8605-73718358c39f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f8561d9-b733-4b2a-b49a-1fb2ec14d694", "sighting_of_ref": "indicator--c79098f0-06f7-47f5-962c-cbfd51637328", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4361892-87ec-4c10-8dad-ae302968d0f2", "sighting_of_ref": "indicator--deb3d719-471f-4920-b517-ead7c4d609b1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01404e66-1b4c-4c02-a25c-41ad0bb3791b", "sighting_of_ref": "indicator--ae1da4b7-4f11-4911-9e40-a7a5a6814794", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f399c31d-b0a1-4aed-97c5-89bd16bfeb93", "sighting_of_ref": "indicator--1cdc2ed6-ba1b-4680-a094-4582bbf1160e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18b85056-18f2-4b1f-9ec7-7b30af6aa64b", "sighting_of_ref": "indicator--04d8d1d8-3c6c-422e-9762-bb59c0eadb2e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91fbfbb5-610d-4b3b-a3b4-642e8b82fc1a", "sighting_of_ref": "indicator--ff29ecb8-0535-4983-ab93-6b87b1b5457d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3d517c3-0d89-471c-82cc-658ef74a8dc1", "sighting_of_ref": "indicator--1f06f239-d025-4a31-b53b-072e6dfcd69e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6205567e-b6dc-4c2c-8b70-a129c888631a", "sighting_of_ref": "indicator--1f06f239-d025-4a31-b53b-072e6dfcd69e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fcbf3be-af79-43b1-be2f-d277a6bc41b3", "sighting_of_ref": "indicator--e21a52ea-38a0-4497-b94a-ac8bfad7f9c0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7edf40b3-a39e-4ac6-93d1-bcd5098b97c1", "sighting_of_ref": "indicator--e129083b-9907-4421-a230-1f728fc0880f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a84a80d-bac8-40ed-a32a-62a6865d1f76", "sighting_of_ref": "indicator--2956b77f-9153-4a80-b12c-7366b047fc37", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3c247f6-7cbb-4003-855b-03118a8babaa", "sighting_of_ref": "indicator--2956b77f-9153-4a80-b12c-7366b047fc37", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a923de6-9b85-4218-9c5d-ed304751b407", "sighting_of_ref": "indicator--9cba8b70-1bf2-45e4-b0af-6f4736c8f94f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57c14534-053f-40ea-adb3-63158147949e", "sighting_of_ref": "indicator--3218c5cf-1725-453b-9cd3-706da0c3ffcf", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b2b8a8a-3c43-4bf6-8c07-aea837279318", "sighting_of_ref": "indicator--aa36114d-a156-4a4d-bda4-390152cb4040", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c7d6e11-bac7-434e-8a55-b3b2bf257b00", "sighting_of_ref": "indicator--aa36114d-a156-4a4d-bda4-390152cb4040", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27037978-df82-46e4-a9bc-75ed3c9b456b", "sighting_of_ref": "indicator--cd351f70-be7f-4149-b4e6-1c634c218a03", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad23d6bc-998b-40e1-bcd6-bf01b4e402a7", "sighting_of_ref": "indicator--835a61d3-959a-431b-8101-015b65f65bbc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3eeb67f-f631-4a16-951a-6fea4653bd6b", "sighting_of_ref": "indicator--450110e1-fc1a-4a5c-a7df-e08f1cc9f30b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4a96517-99cc-437a-aabe-e43a8c4865a3", "sighting_of_ref": "indicator--36c0d05c-ebd5-47a2-9656-06df4dc00548", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--469c5212-ccaf-4daa-8d2c-21769ccb72f0", "sighting_of_ref": "indicator--cf53cae2-4f35-4fbc-b887-5c84939bb440", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3d1c7ee-4c7d-4304-a13a-5d5bb2d0016f", "sighting_of_ref": "indicator--5e7bbc2d-25d0-4695-a903-725a01bad251", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd729254-a56f-46e5-95b4-832c48e86fd7", "sighting_of_ref": "indicator--f9b26594-fbb1-4de0-8339-965b37fadcb3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85faf07c-3acc-4431-bd16-524650746ec2", "sighting_of_ref": "indicator--f9b26594-fbb1-4de0-8339-965b37fadcb3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb56b01b-3100-47f4-98a9-8f7db6ef8ad8", "sighting_of_ref": "indicator--e8d9b348-c21c-4076-a9da-333e42166a00", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b8c43a9-b8f6-43aa-97f1-8dd181615261", "sighting_of_ref": "indicator--fe40f07f-70db-4906-90f3-c790900c4fda", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a400409-c9e1-4746-866e-891f31fe3070", "sighting_of_ref": "indicator--fe40f07f-70db-4906-90f3-c790900c4fda", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c79ca7dd-599f-45b5-93c9-cb7914fbf874", "sighting_of_ref": "indicator--82551114-aa64-4100-8497-533d24689552", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c472b716-5fa0-4e7c-870c-f1ee8af12a37", "sighting_of_ref": "indicator--82551114-aa64-4100-8497-533d24689552", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38a0a23e-b88a-45f1-8745-0ee82bea2758", "sighting_of_ref": "indicator--f41a12ad-aa1a-4eb6-a8ee-4dbe97740b97", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa180cd0-225b-4eb1-9078-51a2f0e1614e", "sighting_of_ref": "indicator--f41a12ad-aa1a-4eb6-a8ee-4dbe97740b97", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--475e83c4-b13f-4e7f-bba6-e7006253c042", "sighting_of_ref": "indicator--1de954c0-7b9f-4478-b007-22793c6265d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73451523-a541-4ccc-af88-673adc8d17cd", "sighting_of_ref": "indicator--1de954c0-7b9f-4478-b007-22793c6265d0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb1617ee-7106-4013-a9af-da1adf3f16f4", "sighting_of_ref": "indicator--891f3a0d-0de8-4b45-b2c3-36425968a704", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deb1eb3d-0a21-478c-8cdd-10702608a170", "sighting_of_ref": "indicator--891f3a0d-0de8-4b45-b2c3-36425968a704", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db9cfe9a-683c-4a04-8c42-4b634db20d7b", "sighting_of_ref": "indicator--d5798c89-fe33-4cf7-9b87-924d8084c629", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1add466e-4c0a-4075-8787-9fbeecc3377d", "sighting_of_ref": "indicator--d5798c89-fe33-4cf7-9b87-924d8084c629", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ebbb068-72eb-4855-b158-39f656e32e44", "sighting_of_ref": "indicator--d20f8c3c-2bfa-48b8-917c-dccc32a1aa45", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac40354b-1f3b-4ae7-bd90-eecab5cd0d9c", "sighting_of_ref": "indicator--d20f8c3c-2bfa-48b8-917c-dccc32a1aa45", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b142972a-7114-4439-a665-c4b730a53591", "sighting_of_ref": "indicator--ce3ddafd-084e-4017-92e3-437c9831f906", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a236aac-1e86-4e48-9b35-5ba13a98ec9d", "sighting_of_ref": "indicator--ce3ddafd-084e-4017-92e3-437c9831f906", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fcc1f6e-c888-4460-b88d-9c4e18506a60", "sighting_of_ref": "indicator--da250b9f-1dce-4479-9eef-56a81320bea7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3b45215-b844-4ad8-bb70-f7f0b9b743c7", "sighting_of_ref": "indicator--123f4787-0c3d-4745-8982-0196708fbc16", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5615c479-e7a9-4b75-8a5e-14f21233416e", "sighting_of_ref": "indicator--d889203c-7b68-4ee6-95c2-98309d124098", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13c33c3b-f32b-479d-90d6-687479e6aeeb", "sighting_of_ref": "indicator--a13bdcb8-636a-457c-b7ee-a85fc113cbec", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a790aa9-6ba7-47ba-858b-0da538351043", "sighting_of_ref": "indicator--6d31c4ca-a7f3-4289-939d-39104a8f1237", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9990537b-67af-4a17-bebe-70c4feb37989", "sighting_of_ref": "indicator--6491a7ac-e6f6-4df8-869d-b64d55acdf31", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05f50589-fe47-4cea-bf56-af6e86aae1ed", "sighting_of_ref": "indicator--c0fea909-daab-46a3-afe3-0b7431fe5abe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54232187-a260-4e19-ac37-8e20502cd409", "sighting_of_ref": "indicator--123677a7-35e6-4dda-8919-78782682561f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--773948d3-a01f-451f-8b92-d0ff824e4cee", "sighting_of_ref": "indicator--d9dd6573-3625-4f04-867b-65d15ffb2709", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6d3dd95-4f00-4fb3-9bc2-dcebfe7f34ce", "sighting_of_ref": "indicator--90d6b9ca-5d48-4bc2-8362-728ea2ff9ab5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6e0d1e2-91ab-4df6-8b23-49d57cebbdb5", "sighting_of_ref": "indicator--52c53888-08a2-47e3-af2d-ac82a8aff091", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aa7c962-ec9b-4cc0-b82a-6aeed4a84dfd", "sighting_of_ref": "indicator--c7f51c8d-8aca-4b8b-8a6b-a45e17776594", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7da59467-e209-470b-bc1d-17f3127b4f3b", "sighting_of_ref": "indicator--c7f51c8d-8aca-4b8b-8a6b-a45e17776594", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e13093ab-3dcc-4ba2-ad97-1d1c71858f7b", "sighting_of_ref": "indicator--f3b4dceb-2ed4-46c8-9427-b129068ad7b0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0046b0b1-b3f4-4c06-9b04-a1b7fae53c89", "sighting_of_ref": "indicator--62fdf022-ba5a-49b0-bc39-dacd9ff932bc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36e17880-eb2d-4367-8142-3b04ca186a6d", "sighting_of_ref": "indicator--59c83646-9863-4c11-b3ac-ad9419fdd030", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c15f5a02-9d51-4bfd-9917-e3dc83fd9dc2", "sighting_of_ref": "indicator--094d3a62-8060-430b-ba5d-dd590c50d41c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ff0ee15-2f0c-4247-a915-6c1586e743f5", "sighting_of_ref": "indicator--ced0b53b-97ba-45f7-a79b-38e0d0f3ff37", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01d7308c-f186-41ab-ae3f-5fcf6980d4a9", "sighting_of_ref": "indicator--741e59b1-332d-4148-8731-a1bfd9fe1d98", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2969a4e1-d875-49e2-8cb6-295946c54fab", "sighting_of_ref": "indicator--741e59b1-332d-4148-8731-a1bfd9fe1d98", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86c39c30-47d3-4646-b890-762001a40f7a", "sighting_of_ref": "indicator--855ebdab-e5af-43e1-9a34-ba26b3d0c657", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3c6517d-02a8-4d92-9c29-e5f2ae39d922", "sighting_of_ref": "indicator--855ebdab-e5af-43e1-9a34-ba26b3d0c657", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01f55f89-27cd-442f-9071-44e81641aa74", "sighting_of_ref": "indicator--f9bb050c-5a22-491c-862b-7e9a52a15676", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94ec8d49-bc0d-40ed-aee6-483902f3f934", "sighting_of_ref": "indicator--35cedb85-5bd8-4526-beb4-be57d456241b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bdda454-9097-439d-a866-dee6ee7d75fb", "sighting_of_ref": "indicator--35cedb85-5bd8-4526-beb4-be57d456241b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c185a1e2-2f11-429e-87d1-31ae4011a087", "sighting_of_ref": "indicator--870e6928-de63-4d11-8e4d-5580df859a7e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55c0d206-1cbf-43ae-be99-52e027e87c73", "sighting_of_ref": "indicator--3eec5975-6cdc-4bdf-8e55-acebc4ae9edb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e09b180-8a86-4799-83d7-37da5110e05f", "sighting_of_ref": "indicator--4a7cd2dd-650c-4946-bced-12dea1309513", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3556a457-39d4-4644-a08c-eba90825dd30", "sighting_of_ref": "indicator--4a7cd2dd-650c-4946-bced-12dea1309513", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc8d015b-f428-4d8d-98e6-c430b43d301b", "sighting_of_ref": "indicator--7165e0bd-f566-48b5-b69f-fd834730eac6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a2100e0-e293-4c84-b5bf-5744ac285565", "sighting_of_ref": "indicator--659d19ed-0029-496a-8cfc-4855414e7b02", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd7c9208-96ab-440a-b95e-90cc1df7145c", "sighting_of_ref": "indicator--98374239-b6b6-4e34-b391-d67c16922820", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab7c6762-468b-4c48-9010-da1e20fc872d", "sighting_of_ref": "indicator--98374239-b6b6-4e34-b391-d67c16922820", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fca6f21c-6adb-4429-a1c3-90efb47e4cba", "sighting_of_ref": "indicator--9fbf88ad-1aa5-4247-a652-84bb2a633c9e", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f52cc8c-eda3-4347-aa42-f54847b0f5ec", "sighting_of_ref": "indicator--9fbf88ad-1aa5-4247-a652-84bb2a633c9e", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6853f41-36fd-45ce-97b2-4cd74e21a904", "sighting_of_ref": "indicator--01091187-21ca-4942-b8e0-8339a93a4500", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0572350-8c94-46a6-aea9-7f084b25abf3", "sighting_of_ref": "indicator--90c16c80-e10a-4593-993d-e0ce9e1073fe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdf4047a-f710-4c66-8244-1ce0fda2b462", "sighting_of_ref": "indicator--9a1282c5-2d87-4837-a34e-f3da4e713223", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80f85709-1f27-46a5-81af-838a55b90237", "sighting_of_ref": "indicator--35ffd01a-11bb-45cd-af0e-8979491c0ab1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c18bf23c-48d0-4f14-87a0-31bc54e3e9b2", "sighting_of_ref": "indicator--35ffd01a-11bb-45cd-af0e-8979491c0ab1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a13e1bb-7166-41f7-98f0-04b728a05557", "sighting_of_ref": "indicator--52b34e4d-ba42-4a37-8cff-ab523b1e06b9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1367b9ae-6906-4587-bec7-751793b41b33", "sighting_of_ref": "indicator--80a19aee-e383-4103-acdf-cfd718d34cfc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a243ceb1-170f-4ab4-aa5d-1bb99744ed4c", "sighting_of_ref": "indicator--7f54d1f5-8279-47b7-8a88-90b4e93e3a29", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22c89a7f-ced3-4de2-a34c-5ee9575be6bd", "sighting_of_ref": "indicator--7f54d1f5-8279-47b7-8a88-90b4e93e3a29", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bea70e15-3c4c-43c5-8858-5974cf6d8b84", "sighting_of_ref": "indicator--febd25e8-44bc-4204-ade7-aeb0219f9f44", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03ef7df5-17da-47e4-a07d-b1f41e1c3b1d", "sighting_of_ref": "indicator--febd25e8-44bc-4204-ade7-aeb0219f9f44", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50b8ca6d-d70c-4f51-a310-c893ada111fa", "sighting_of_ref": "indicator--6470349f-9020-4949-8375-da66a2831184", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5be5b78d-356d-45f5-b9e8-3c57aa73d6a5", "sighting_of_ref": "indicator--ab239498-7182-418d-ad1b-675829775c9e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b0da8c7-b883-493c-b775-520a8b7e5bff", "sighting_of_ref": "indicator--ab239498-7182-418d-ad1b-675829775c9e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7cec5b2-72ba-4760-bc13-ad070767f83c", "sighting_of_ref": "indicator--0a18e017-f771-407e-8f01-4ae5e17892a9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49fed312-4500-47ae-8dff-924ad081b2c6", "sighting_of_ref": "indicator--bf7c5c9e-ff0b-4fc3-8bb8-1fb98c7f754b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4cc4ad2-758d-4ff0-b82a-be52e35261f1", "sighting_of_ref": "indicator--bf7c5c9e-ff0b-4fc3-8bb8-1fb98c7f754b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5462b318-b329-4a99-87c5-09e2d184413f", "sighting_of_ref": "indicator--1254d1fb-9ef3-48c7-8cea-b9de5ee970ff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a91b356-cd0a-4181-bdcf-c633fd2776da", "sighting_of_ref": "indicator--f481fc9e-2224-4f09-ab7e-fd6d4d7c29c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73ba5227-dac6-4b03-a95d-2db7a8b8538e", "sighting_of_ref": "indicator--f481fc9e-2224-4f09-ab7e-fd6d4d7c29c6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bcbc0a9-3151-45d4-a872-18d7f33e9f27", "sighting_of_ref": "indicator--ae7cd847-994a-4ae1-91c9-f40f32a1fdf2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a54d9cef-4cfb-4a55-8688-9d29c326a981", "sighting_of_ref": "indicator--4a1d9082-c21a-45fb-b7ad-6efc290c1bfa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3a78b16-8e13-4743-bd09-bbb798b62e13", "sighting_of_ref": "indicator--54b81768-cfcf-4881-8ba4-286e5e38d480", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff693e16-8812-4f57-8142-46af037a1806", "sighting_of_ref": "indicator--7817b307-4d82-4f1f-9b29-8e2a5f31e1c0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b58ce89-95c8-434a-b305-8432f72bead2", "sighting_of_ref": "indicator--819c0f5f-30e6-4869-8c1b-64e0620b81c3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a07fd71-0a42-43d5-9c29-721cadcd48f3", "sighting_of_ref": "indicator--7accc57d-c0fa-4455-8b87-6617f786695d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--900062d4-e2f1-43bb-8914-edb1cbc70dec", "sighting_of_ref": "indicator--0732aac5-e8ec-4189-9697-ab7e0c9a3e9d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83d21128-de00-4878-ab10-d0b4094be203", "sighting_of_ref": "indicator--2b9710ac-6d7b-4e95-8197-4a56853880a2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d14955d8-54d6-4bbe-bb65-a49ef27dded2", "sighting_of_ref": "indicator--2b9710ac-6d7b-4e95-8197-4a56853880a2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8a704f8-69b1-430a-926c-2acb5851ff81", "sighting_of_ref": "indicator--f9b28c56-8fe1-43e4-99d7-9671596faa8c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dd758d5-f42d-4395-9634-0ee8dd1e1444", "sighting_of_ref": "indicator--217b74fc-6452-4425-9f85-0c462e3c48c5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--378734af-2e3d-4bae-b580-ffdf9dc07e56", "sighting_of_ref": "indicator--217b74fc-6452-4425-9f85-0c462e3c48c5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--299ea747-3d03-44a0-89d1-af92f5604587", "sighting_of_ref": "indicator--5f4a7242-7e0a-405c-b549-e86e18df6d2f", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b5617dc-0c38-4324-8bd7-e84443905d4f", "sighting_of_ref": "indicator--8e39a243-d36e-499c-9138-01885667cc91", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2023acad-f40e-48ee-9b6a-d2225a38199e", "sighting_of_ref": "indicator--c88c9e87-9b6d-4892-adbc-e2fbd85243df", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--208d3a0d-4d42-4ab4-beec-340bad9bff14", "sighting_of_ref": "indicator--c88c9e87-9b6d-4892-adbc-e2fbd85243df", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3238988c-75e8-425f-9ad6-07d17c5d0a06", "sighting_of_ref": "indicator--9f265f94-eea4-4a28-a5c9-90f2acc3013e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa14fa71-c480-4947-9aae-9f6096bfc203", "sighting_of_ref": "indicator--829eafbf-3d0d-4777-b707-c6a9f2270821", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3abb7f9-6803-481a-ba39-8f43045ca5c2", "sighting_of_ref": "indicator--829eafbf-3d0d-4777-b707-c6a9f2270821", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--582d2338-ac79-408e-8ae7-269c5cb9d1b2", "sighting_of_ref": "indicator--4fa3115a-fba2-470b-970c-59b6f65d1973", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ece90af8-5166-451d-80d7-7cb773ba8be4", "sighting_of_ref": "indicator--4fa3115a-fba2-470b-970c-59b6f65d1973", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39541561-20c1-4b3c-8ae9-f0a577eb6535", "sighting_of_ref": "indicator--54dac539-aed3-4461-b1c3-9e8b50abe280", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac7eee5-16d3-4ee3-809a-f27781340f1c", "sighting_of_ref": "indicator--5756e2f2-018e-420c-87b0-e555492dcf87", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b1930f0-4186-4e39-88af-d68899d2902d", "sighting_of_ref": "indicator--ca937356-ca63-4f64-9813-e5e15eebe4ac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07b06cc8-2450-4151-8e3a-ad68611bf795", "sighting_of_ref": "indicator--d5639d81-2684-4555-bb2f-7cd9dd24592a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88bb1960-8929-4c89-a6e0-64b8c7a3baba", "sighting_of_ref": "indicator--e15d6107-97ed-43c0-b03a-3dcd7e8fe833", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54bf910b-5d15-45d9-9849-4c52e9fce101", "sighting_of_ref": "indicator--920969e3-dd37-49a7-b23a-dd5f83e05489", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e14768df-039a-4cdf-9f3e-a5b64fe4efc6", "sighting_of_ref": "indicator--e0a860ce-f86f-434a-9748-ab0f16eb864b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c5581d1-a867-425b-9048-caada6790bd4", "sighting_of_ref": "indicator--e0a860ce-f86f-434a-9748-ab0f16eb864b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5874b776-8039-412a-b471-fcac2f03b889", "sighting_of_ref": "indicator--4ea65ecc-0489-42ce-a60f-faed0d342abe", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fafe8fc8-db91-490b-9113-9e3e0e86b58c", "sighting_of_ref": "indicator--40a66f5f-00c0-4b52-a917-6650b90b15eb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e5d08a8-7839-45b0-aafe-404ec3e9af31", "sighting_of_ref": "indicator--279545c3-e8ef-44fc-98b5-bf18ee2c6227", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b000179-73ac-420f-a84c-afb8da34d479", "sighting_of_ref": "indicator--b583491c-583b-4183-941e-728b3f7c6492", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ff5c668-115d-46c8-b825-a96de97dae22", "sighting_of_ref": "indicator--75169e12-5bf2-4f07-91c9-92b59a9fe58e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa3e9ea4-2906-4903-87f6-549a3e1be6cc", "sighting_of_ref": "indicator--a56e6d63-3a38-43a2-af2a-e0c06ff8a626", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4de14081-f4a4-4da6-bf6d-7af8a4ae29ae", "sighting_of_ref": "indicator--1d250b0d-f29f-4d02-90ef-b1f8fe604cf0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d2b1bb3-5b7d-49f8-931a-9ecdb829fe13", "sighting_of_ref": "indicator--a04f614c-0ec0-47ff-a584-132202babc41", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a072f747-87ee-4cdb-ae16-e7c444311356", "sighting_of_ref": "indicator--a04f614c-0ec0-47ff-a584-132202babc41", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5356874b-e25b-43e6-b602-4f5329711289", "sighting_of_ref": "indicator--50b20b83-0823-42cc-a398-1da3bf1a4b6c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--578ec5f6-ac86-4453-8392-da79621ef527", "sighting_of_ref": "indicator--50b20b83-0823-42cc-a398-1da3bf1a4b6c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11a1048e-3599-42fe-8d83-d00e73b50240", "sighting_of_ref": "indicator--27dee566-e37a-4a16-8c74-87cf42b3126b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0af10ab0-4931-4ccb-a92c-01d134e49549", "sighting_of_ref": "indicator--27dee566-e37a-4a16-8c74-87cf42b3126b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bf02104-af9e-47d1-b4c0-16f07f10a304", "sighting_of_ref": "indicator--1d58c6e2-5812-4949-848e-ac263869c964", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57c1d0ac-da4f-4680-bf91-7a0e3f525d05", "sighting_of_ref": "indicator--04cb4b6c-86a1-4645-88b3-dff215f43894", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bea36f93-7b76-4c88-a5fe-14bf37fb4a21", "sighting_of_ref": "indicator--76ba27ab-95d5-4a24-bd2b-24578415d497", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--245c949f-01de-40f7-af92-998661c72839", "sighting_of_ref": "indicator--4cd7cdab-7f86-4b52-a02c-157408dfb624", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a66a14dd-6418-4bd7-98cc-39df1f66b9ba", "sighting_of_ref": "indicator--af1e99b6-83ea-495a-a48a-d1a8a4b83a6e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1ec7000-60cc-41cd-8483-4b5d781d7bdf", "sighting_of_ref": "indicator--014bf4f5-5442-44dd-8ba0-99145751fda6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3d05662-6b0e-4606-a151-96fc7004b553", "sighting_of_ref": "indicator--816ea8b4-cc1f-4767-a25b-51c92c4bbda4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b51a9f4-ae02-4156-8ae4-505ec93b728c", "sighting_of_ref": "indicator--816ea8b4-cc1f-4767-a25b-51c92c4bbda4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34718da7-162d-4503-af94-8bc433c7a769", "sighting_of_ref": "indicator--3d6ae7f6-3550-45ff-859f-279e5fbb392e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f585ecfb-dbfe-4fd9-84e2-d29bd7143c4e", "sighting_of_ref": "indicator--1041d3b2-8772-44df-a93a-377af93ad7ad", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5edeccb9-5527-43bd-a769-8c80d24f6d10", "sighting_of_ref": "indicator--192d91e1-b5c5-4e5b-848b-3a3eb4da2eae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--292c166a-434e-4789-8529-b675f7d794a9", "sighting_of_ref": "indicator--d6ae6e87-b0d0-43fe-bc96-fd0a433a42bc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbebcc2f-1cce-4f39-aef4-9a4d7dcb3bac", "sighting_of_ref": "indicator--f54776b4-dc6f-45b8-bdea-4c040212c12b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffb613c6-6797-4f27-9261-ab45f9898f7d", "sighting_of_ref": "indicator--01f357de-1211-4d85-b432-665a45aa207d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c215b480-8ca5-4fbf-bb1e-8d5802a763cd", "sighting_of_ref": "indicator--43d1c74b-e22f-41e5-bea8-f8f278a5b48f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24319490-4184-4808-b32b-0a91b65d4848", "sighting_of_ref": "indicator--43d1c74b-e22f-41e5-bea8-f8f278a5b48f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8ae45f1-f2ad-410c-bc93-cd089d6d4ce1", "sighting_of_ref": "indicator--8431d7a6-5413-47d9-b583-eb29bb530686", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2cf342d-f238-40aa-a040-43d18ca95f19", "sighting_of_ref": "indicator--50428cba-565b-4e6e-9b81-48a738bbb87a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24659fe2-aebb-44ae-867e-3c6190639c80", "sighting_of_ref": "indicator--a8309c10-0065-4ff3-b762-950c5e599c5b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2af831d-9dd3-4c29-9d29-4705a7fbf563", "sighting_of_ref": "indicator--455aa472-f5e3-4ebd-aa26-8bd07597489c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d33bc119-6483-48f0-afbf-a368818f4a6a", "sighting_of_ref": "indicator--1d4c19eb-eae9-450d-9e83-a6200a2eed11", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--597bb847-be1d-4a2a-ab76-efca1424d0a9", "sighting_of_ref": "indicator--75425b42-595e-4a56-8636-da8a7138cf76", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e876ad11-16a2-42a8-a864-e865c16b2365", "sighting_of_ref": "indicator--4c46bb53-437a-4533-8bf1-8254b74e2219", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f3f9735-38de-49dc-a042-7688daf66778", "sighting_of_ref": "indicator--dbf8d8c5-c246-4db9-9342-e755afcbc65d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af04138e-b503-448f-87e4-d04c40f42c91", "sighting_of_ref": "indicator--f7de39b8-744d-4074-af41-e1914f897f4e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--229aa9f2-ef05-4ccd-b01e-7a28580421ce", "sighting_of_ref": "indicator--4293ef31-f539-47d7-b32f-81dbe0f112b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1639f415-94d3-40d0-9616-aa9e04fbda62", "sighting_of_ref": "indicator--2356cd92-b448-45ff-92a0-733a27612407", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7a88318-d1ea-4c74-a9e6-dd8ef6126a1b", "sighting_of_ref": "indicator--7ace08e7-3353-411c-b734-de20e0359430", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c1ce1a8-dd2d-45ad-89ba-e94662de3078", "sighting_of_ref": "indicator--0a161c18-11db-4618-a04c-bd57b08e67ad", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6ac3a4c-9975-46d9-8dba-04e752db7632", "sighting_of_ref": "indicator--c446feb7-415f-4fbd-9a5f-64cf80319449", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f96af99-1af1-48a5-a918-2bd2b6c6d336", "sighting_of_ref": "indicator--e5d99a54-cea1-48df-8f27-e0fa63342272", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c928ec46-f5d7-48f5-9b85-ca0afb5962ec", "sighting_of_ref": "indicator--072791b3-c955-4f41-b140-107c83a1a509", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71405707-2d2a-4090-a00b-887361a27282", "sighting_of_ref": "indicator--4533102c-ca0e-4d18-bc8d-ad7d0e6d34c8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--102562b5-1a9e-479e-81e1-e133e0871ad8", "sighting_of_ref": "indicator--d05da814-7b7e-418c-848f-597a9dfde8a4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c8f6101-d28a-4ebe-9f22-537ada25ee06", "sighting_of_ref": "indicator--efcf7529-2fa5-4231-9bdf-77e034dccec1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8bdd6bb-c28e-4e75-a96e-7bbafd48355e", "sighting_of_ref": "indicator--2df36a19-71df-4d3e-8239-73867b0581e9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c4e2273-b51e-413a-9ef6-0c43f651e87c", "sighting_of_ref": "indicator--06695e87-f6a2-49e5-b8fa-aa25b2917d9b", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9d890ed-818a-4383-a202-56f69aff4386", "sighting_of_ref": "indicator--cacbeced-165e-48a7-8110-0bf0b039b29a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc1353b2-fa3e-4017-b6ab-20ecac39d7bd", "sighting_of_ref": "indicator--f625540b-3dc5-439c-9ef1-a398d207be33", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--796f9562-dda7-42e1-b417-a1c9fbba7810", "sighting_of_ref": "indicator--256d3fff-4efd-4b8d-b298-f0e024c3dfbc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d5f088f-f722-4a6c-a032-eb330e13b89c", "sighting_of_ref": "indicator--9dcfa712-2e15-4f84-8763-5541a84606e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7131e07a-14c5-4ead-a91e-f9dfdefcf212", "sighting_of_ref": "indicator--4dd0d268-940f-4966-9116-bf5da2cef9ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6948e927-c8f5-440a-91f2-3177ea2b2fd9", "sighting_of_ref": "indicator--59a79601-4094-4750-a75e-2f9fbc1f54e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91a5ddba-e193-438e-be08-9af06aaf382d", "sighting_of_ref": "indicator--1ab25308-8de4-43ae-a327-fda87d4027e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88d9b5e9-7d0a-4152-b419-e8219579450f", "sighting_of_ref": "indicator--2335c81a-2a8b-434b-8218-eb1e935a96f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9782cd6a-2ffd-43e6-9df4-c97674de24b3", "sighting_of_ref": "indicator--c93cb78e-fa3e-4983-8213-6f8ef8e242c2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b7b964d-bb9b-40a8-a967-d8aee0f42b3d", "sighting_of_ref": "indicator--82ae389e-3852-4ffc-bd1c-a656410ae6f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1c101b5-bdec-4cd7-922a-ee7508bc45a4", "sighting_of_ref": "indicator--09a53e28-bfcc-458f-9a4f-c82c160523b9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f62361b-1524-47bb-86cf-fb7c277a961d", "sighting_of_ref": "indicator--209b6baa-8684-4bda-a98e-52cff737a184", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d0e1992-2dac-452f-b2e5-44f24ef9dfac", "sighting_of_ref": "indicator--17b4bde9-8cd9-40d1-aee3-3e74018117ae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--884ccd5f-aa78-44e5-9f95-5c477b9fbfc1", "sighting_of_ref": "indicator--dcea68b2-bca6-44a1-8d18-c323911be8e7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--891e7643-513a-4f03-b255-a135d41ec40c", "sighting_of_ref": "indicator--3916a9d8-0ac7-4aee-a045-1b63ac6e3120", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f22e6ae-6210-4728-8f9b-e99720daef09", "sighting_of_ref": "indicator--50e30d00-2a3a-4cec-884e-212d200437cb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ab0f305-758b-464d-9cab-b26ba752e089", "sighting_of_ref": "indicator--bf20ed63-7662-4481-8ecd-a48ba17a4d60", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e682aa8-ffe2-4b73-b165-62f3e54fcf34", "sighting_of_ref": "indicator--b74e1203-64b4-4742-9379-e8d1f397d5f6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f59b77d-0a57-4d0d-a7ab-cef5e2272d3e", "sighting_of_ref": "indicator--f5c0d659-8425-4696-8c68-979944f504ff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--588757f7-307b-4ed6-a7ca-7c71283104b1", "sighting_of_ref": "indicator--d0828965-7908-4efe-b68f-e0f1a32f2c6e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0a19566-bf52-4ca1-a1f8-9838df13b583", "sighting_of_ref": "indicator--797a939d-03e9-4dd5-99e8-24d7051cf40c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c044ea4-a067-4820-81a0-2220028d31ec", "sighting_of_ref": "indicator--68ce1d92-5ffb-4be6-9dad-ad80c3237756", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1268b893-9854-4629-9e0e-8446bfc497bd", "sighting_of_ref": "indicator--8590c898-cb51-4d2f-bc8e-40fe525ae547", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f2772a0-5f29-42e5-9713-10b2eb661dae", "sighting_of_ref": "indicator--b993ade7-01da-4f24-8163-e6dc28838e53", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bfa4e49-d3b0-4844-8f92-3dc032afc7b9", "sighting_of_ref": "indicator--72fbb53c-20b8-467c-b4c0-5248ffac16f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3804d2f9-2225-4918-b2a1-76aec5d3ba4b", "sighting_of_ref": "indicator--b480ed67-71ac-410d-9a6e-0374edec927a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c0ed1c9-7261-444b-bc5a-dc1fd5a51e11", "sighting_of_ref": "indicator--4d3bd8d5-b1b9-4f8e-b7ca-4fbfe4bcd5bd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac84497c-d15c-409c-8a1d-2c74a80c0383", "sighting_of_ref": "indicator--dde296fd-2221-4652-96a7-04225c9a63c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b90b75f0-cf48-4d17-b90a-ee15d137a3e7", "sighting_of_ref": "indicator--871e5cd0-277e-4c9f-8dee-c9a9cdf94584", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b63d623-9276-4dc5-bb07-2a7c8eb0eb6e", "sighting_of_ref": "indicator--75090e45-0987-44b7-a7bc-657ab8d2c9e9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bebcb18a-6e89-4a1d-8e8c-c6d32fd9f849", "sighting_of_ref": "indicator--2cc7f435-2bc3-480c-9b90-1a2a6bb18d41", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c3fcbc9-48de-42de-b2c5-26bd995f1ccc", "sighting_of_ref": "indicator--2aa17b4b-5734-4e64-b63b-df45ca1de083", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34484e8c-ceb2-40a5-a6bf-692762245c34", "sighting_of_ref": "indicator--5134ff28-7049-4094-b126-28683faa7bc4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90cd3189-81bd-4d77-b597-d436b8ef2b40", "sighting_of_ref": "indicator--3fe17ac8-53b8-4968-9ed0-5a65607d1bdb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1f8caf8-fd34-4144-b5a2-559ff1c2d277", "sighting_of_ref": "indicator--412afb3c-79f1-4967-be9f-b9bce11a41bb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beab26ad-d39e-4cb7-8fec-e0bc4cfb5415", "sighting_of_ref": "indicator--089c3d3f-1410-4de7-81f9-7d757a6f53d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f30a9ed7-4bd3-42b4-9059-0aafb6bba56f", "sighting_of_ref": "indicator--743910e7-e566-48d2-8ad0-2e149cfbd6bb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc62cae5-1833-439e-b251-c64d738342ad", "sighting_of_ref": "indicator--e08fd4e9-fc83-4dc4-8eff-3b216b515ba4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e2836c0-a22e-45b1-8321-b2e0f7765455", "sighting_of_ref": "indicator--e17ae327-56a6-47a2-b1fe-2e73128fe105", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ffc1df3-dab2-49f8-ae5e-c8d01892292b", "sighting_of_ref": "indicator--016d12d2-578d-42dc-85d5-1f13b5a33e76", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82b9c429-592e-4657-8998-638dc9b8b2d6", "sighting_of_ref": "indicator--be8d79c8-5bd2-4b18-a214-d845935adef7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef9d36b3-a038-448f-9214-52934da7c8c1", "sighting_of_ref": "indicator--44ffc9a0-06c4-4b6c-875b-3c49019eab8b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--924fa60a-8bbd-49d4-a256-56494f165663", "sighting_of_ref": "indicator--d1633f0c-6dec-4943-ac19-9177c7594273", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed3736f8-a18f-4acf-9d14-140e3933a9eb", "sighting_of_ref": "indicator--948574fc-9a64-40d0-86e6-137e81d37109", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26d4a8b7-5751-4439-8204-86a636ee6128", "sighting_of_ref": "indicator--ac4c489d-4c6e-4a68-b8a5-642820a1fd27", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a234e786-cde1-4cf1-bd64-a72e838b4851", "sighting_of_ref": "indicator--6f27b646-4145-4803-a5c9-728ed55f5775", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcaf02f2-0261-49b7-9dc9-dae651fa4803", "sighting_of_ref": "indicator--7ac34879-28cd-4c38-8ce7-4da3d6a283eb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--604b54b7-bae6-489b-8cb6-da27a46b74d3", "sighting_of_ref": "indicator--b3c99995-5ea4-4449-8bdb-5f2c6501bc43", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27773fd9-c105-4d39-a688-7c29df5351a3", "sighting_of_ref": "indicator--f1ce922f-e6af-4ff7-97ac-427371f516f6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8eac4485-c509-49eb-b03e-4c2080a38745", "sighting_of_ref": "indicator--b530822a-5b13-4720-91ec-18819545563f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9ca4749-acf2-46d1-a196-d67f2e748677", "sighting_of_ref": "indicator--de344d2e-aec3-40fd-8081-bffb918b88a1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46add84d-81b0-4c1d-bc72-bba2852f17ba", "sighting_of_ref": "indicator--2c432350-d6af-4277-aa2d-8c7afc41d561", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd6c6dca-2a04-41db-a66f-0e4866d02d49", "sighting_of_ref": "indicator--950ebc37-d619-4863-aa1b-c0c13685418c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c36096bb-2832-4ef8-9458-b076ed7aa162", "sighting_of_ref": "indicator--861bbecf-53fe-4bdd-adc0-397de69d553d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32cbc083-bd70-464b-a09d-b77f2f7770c6", "sighting_of_ref": "indicator--994882fc-52e2-4fa4-9776-5dc7d0342979", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f001b59-08f3-4aae-a7c1-ff9f8a8667bf", "sighting_of_ref": "indicator--e08c7eed-69a1-43bc-b316-50513b595075", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--789d6e0a-daa4-4bc1-968a-d7a8ef34c32b", "sighting_of_ref": "indicator--af1fc26b-0e34-4a12-8b87-c506159a8c18", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25eab5ab-f522-4d6c-a055-af62e93cbb2d", "sighting_of_ref": "indicator--06ee7929-9435-4715-9581-b6bd58cc76c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--893df030-c0cc-4296-92a5-cec4181bcbf6", "sighting_of_ref": "indicator--ec037f58-ad0a-40b3-8e53-690d78ca9d5e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0844f93b-83ab-4c31-9ea0-6dea7b136183", "sighting_of_ref": "indicator--314b3435-b539-45f9-a6a8-1ce0213cbb4c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1a9787b-ab4b-4023-8097-c0db5b5d13c6", "sighting_of_ref": "indicator--9d132743-3f82-4496-bb20-d3bfbad4465d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--800e1fc6-c679-4d1c-b7ad-13917c50c3bf", "sighting_of_ref": "indicator--44c5aa19-3778-4017-9987-c8452362dfe8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7c5e7ac-deb9-4c54-9d2e-4064044379da", "sighting_of_ref": "indicator--e6f1365a-d5ef-4c86-a1f2-11ea51f05320", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8365281e-0454-40f4-89b2-a76a4f3c4e1c", "sighting_of_ref": "indicator--3031ccff-36c3-4eb2-8702-87b7eda69d09", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e169b4d-3f62-481e-aba0-b26fa61ba1ad", "sighting_of_ref": "indicator--0b490e88-35e0-4c28-b2ac-1820eaf47c2f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12e708d2-9eb9-4a09-93d1-d6067b6649ad", "sighting_of_ref": "indicator--d26ce0f7-8c5c-4e77-86bf-cd547a5b1d4a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1144046d-d3f5-4d6e-881f-29d595b51ba4", "sighting_of_ref": "indicator--cbe57307-1e7b-4823-869f-2128cd1e951c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d31f85b-2671-4f7a-853c-354f38b9faf0", "sighting_of_ref": "indicator--b9957b78-eeef-4eb6-9e92-b3e0d04aba6c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdd9fc69-fff1-4e5c-8dc2-0e00dfa4ed32", "sighting_of_ref": "indicator--defd39bd-4541-4552-aeb6-3c74561aa3ba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d93da087-a7ca-4e40-b4c7-2f2a67f17ff1", "sighting_of_ref": "indicator--c4b0955f-cc6a-436c-a0b1-cf3b8943648d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b26c5e41-d0d0-416b-a6ca-f805e31f6ff6", "sighting_of_ref": "indicator--48984392-4fc9-4242-ad93-af98d2ca39e0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d213cc1-f4cc-482b-878e-4bcf3b82b37e", "sighting_of_ref": "indicator--65ca13d0-060e-4d32-a78d-ea4edfcdfabe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f60d777-ee88-44b1-934d-ebaf9c1c211b", "sighting_of_ref": "indicator--f0959158-9c85-4db0-b97d-5db0cb379c37", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27dd28a7-43b4-4d87-92c5-07434a2d267e", "sighting_of_ref": "indicator--c975211d-2d83-46fb-a1fd-cb49faa0193b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cae67d28-d971-492e-9ce5-8f45f2ed4f71", "sighting_of_ref": "indicator--af685c07-ee72-44a7-9a7c-4c24f3793d78", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef76f626-4b78-460c-ac1d-6499f9931d0a", "sighting_of_ref": "indicator--6d0e5646-f4f8-4be4-971d-e523e484ef1d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04741294-c45e-4e06-a6f9-e64f6b47af05", "sighting_of_ref": "indicator--aad0f457-ab91-442c-9daf-aa1cc5200e41", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4847369-5a2d-4398-9bcb-4ffff4937770", "sighting_of_ref": "indicator--25fb6f2b-eec6-46f2-823d-2d9aa169ba99", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--163aad27-b8b4-4c65-aab9-9892491d3626", "sighting_of_ref": "indicator--1d53e74a-15fa-49fa-a33e-998a62480aab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04e28a7d-d5d1-4e5c-9943-a76e7fac8b9a", "sighting_of_ref": "indicator--6a5045c3-6d3b-40c4-9543-9f209fb09a3c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5d4e631-9306-4933-a45a-3e004ed426cb", "sighting_of_ref": "indicator--c34708da-8896-4743-b0f1-db578e866b4a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6452a470-af22-43c1-8d89-6d557fa09ce9", "sighting_of_ref": "indicator--69c0f4a0-57a1-455d-8826-007bec4630c1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93233379-bd81-4be9-a5c8-b3c4aca12346", "sighting_of_ref": "indicator--387f9fe6-0bee-47b2-b7e1-39abd78d4636", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02d84508-b8d4-40e2-ac0d-152e5bfeef1c", "sighting_of_ref": "indicator--ea84bdd8-704e-4bc2-a2b8-4f44ef776bb0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc06bff8-b0e0-497b-aba6-ea3b49966ee3", "sighting_of_ref": "indicator--f1d47ddf-cc17-4e1e-a3b7-f981830e7f65", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad7725ac-8db1-4c59-8711-5ad27e2da538", "sighting_of_ref": "indicator--76336abf-af8d-44e6-bf55-5919102bd720", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4b051bd-e86d-486e-abf1-f767bf48e48b", "sighting_of_ref": "indicator--4bbac633-bf30-4ccf-abe5-33e868fa490c", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d04d816-c627-44b1-b7e7-a48d540a94dd", "sighting_of_ref": "indicator--c2ff0e4e-c94b-48aa-bfa8-85c9872356f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b443183-2798-41a6-b013-cb48d7bb00a9", "sighting_of_ref": "indicator--ca454ea9-57fb-4d7f-a971-e89f80c94339", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cd7da7f-8856-4ff4-9d7f-a5fae6ad69a6", "sighting_of_ref": "indicator--ffcc5aca-73c0-45d7-8c77-22a8dfaaacc6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee7b9aac-42c6-49ee-a6a4-2bfb54b9e8b4", "sighting_of_ref": "indicator--3fb42f67-5ca0-439c-b140-1af90b3aec1f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90a8bde2-e496-40c7-bedf-ec5fd5672367", "sighting_of_ref": "indicator--ae495675-0d76-4f7d-812e-d4f3355b4238", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d09c0fe9-182d-4cfb-8eac-ce114df906cb", "sighting_of_ref": "indicator--ec85a3d8-3c8c-40c3-92a8-2b3a5a6169af", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02c91f7d-5517-4bbd-880e-6b60279ff9f0", "sighting_of_ref": "indicator--e45c0276-f4c9-4b5d-8493-28cc73915f2c", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8808a7a3-3fd1-4271-9c22-c89605b66f04", "sighting_of_ref": "indicator--e45c0276-f4c9-4b5d-8493-28cc73915f2c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e00b165-03b1-4ac5-936b-cef0f51791ec", "sighting_of_ref": "indicator--6a84f5fc-5375-4cb5-95e2-ec707b9909e9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb3317e3-4bcf-443b-b111-49af86f04421", "sighting_of_ref": "indicator--972e78f3-8cf3-4553-9dca-68edf40ee3d7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22b0f104-e5f3-4ff9-8e77-f2300f032c6c", "sighting_of_ref": "indicator--d36c49e1-21c2-48e6-b665-fc9c2708cba5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--763f64b3-e93b-42f3-ad20-a0ded0ba0d04", "sighting_of_ref": "indicator--785f844f-a732-4621-9154-5cbaaf02e8e3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbe1fe32-2935-435c-9bee-8953777b5028", "sighting_of_ref": "indicator--8a806888-f564-4f82-8079-d40fa76b732e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df1974c9-158d-4dfc-bafc-5b1bd0fad058", "sighting_of_ref": "indicator--8a806888-f564-4f82-8079-d40fa76b732e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8513103-2bd4-4f36-b82d-a1a391f6900c", "sighting_of_ref": "indicator--68209681-fdf5-4654-b044-794d98f02542", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df8dac8a-471f-4d4b-90ca-9f91f1362567", "sighting_of_ref": "indicator--4df20f04-c567-410c-b84a-efedf8e5c891", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--777bcfc6-34aa-49d5-afea-b0a62c9d2a03", "sighting_of_ref": "indicator--d5a66e34-c71a-4916-af84-758d4f8ae577", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c8d602e-b90c-4c9a-928f-f8d01a0b9480", "sighting_of_ref": "indicator--b79b47b9-0b6f-4e6e-9106-461f667f4f5b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5327f349-b59b-41d5-b1de-a8611fbe13ec", "sighting_of_ref": "indicator--b79b47b9-0b6f-4e6e-9106-461f667f4f5b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a47df1dd-edd1-4c82-ad35-740d18a91449", "sighting_of_ref": "indicator--2de170fe-5d65-4e55-9e58-c378b19e7a7b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5f0f8ec-6524-45a0-a485-657a02e55f8a", "sighting_of_ref": "indicator--8e06871d-db2c-415c-9a90-ea7471dead17", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13d65b08-c94a-4ad7-ac42-ef0bb1082e3c", "sighting_of_ref": "indicator--07f422d8-80c3-47e2-a708-d346b4fbfd3c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47b3023e-2786-4ba6-abbc-6a0a3ac90195", "sighting_of_ref": "indicator--17eae0cd-e5af-4b7f-a0ba-6f6a436f9c45", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--956cd6b9-539c-4d8f-ada7-d64383d34e1e", "sighting_of_ref": "indicator--5589fad3-6914-4654-bb9b-57f0e1287bdb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a0209d0-a90a-42bf-a8e6-4b2fcd4a1153", "sighting_of_ref": "indicator--7fcca615-6175-4966-a934-a1f68ee7af67", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cc68882-6950-4a47-ad72-b7ae49901320", "sighting_of_ref": "indicator--e5ec345c-8506-4502-bb19-5457f0bc8a4e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fde8ccc-b2f9-4421-be7d-fc3e48c3a666", "sighting_of_ref": "indicator--45d868ce-d401-40f3-92ed-cf0c31cf7600", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10319b0f-8f67-49a8-bb3d-4152264de7ea", "sighting_of_ref": "indicator--45d868ce-d401-40f3-92ed-cf0c31cf7600", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fe35321-c719-4aa5-b52f-a82a4b5e2353", "sighting_of_ref": "indicator--11380e02-edc7-4c45-b736-077d1c9f4d90", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d327b53-fa75-40d9-8a83-196967225cb4", "sighting_of_ref": "indicator--3f9f8b67-add2-4d43-a78d-7eba45e6ea77", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--425581d6-ebb8-463b-9284-6884e8ad188a", "sighting_of_ref": "indicator--78f0af8c-7f19-4f06-bb15-3f6e1cd72423", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2191061a-0f9a-4ea5-9400-eae8fbcafe0a", "sighting_of_ref": "indicator--60e47849-12c3-4a01-8fe3-3c8bc68c747f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5beac0a-bcfe-4e3d-b331-9bac9a5e96df", "sighting_of_ref": "indicator--a53745be-1989-400b-8efb-86d939f152b8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0d8d5f0-0aff-4680-8f02-4c6dbf9ef0ba", "sighting_of_ref": "indicator--0a0a9840-b8a3-49b6-b409-e381d5d4c2e3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4ced9d6-13e9-4bd5-a027-be390127f8f9", "sighting_of_ref": "indicator--5610079f-f144-4880-bf06-351dbb39c927", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ece3e08-93a1-4567-bbbc-dd3e102b5740", "sighting_of_ref": "indicator--597f335c-d466-45bd-a743-044fa9d4c63a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6e05d1c-c791-4ef7-8a57-45cb45c7935d", "sighting_of_ref": "indicator--d94c8816-ed23-4b32-86bd-d3a0f218953e", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--390bcd90-d017-409b-9681-48aed7a4da68", "sighting_of_ref": "indicator--4592059a-f68f-4767-9e7c-858d3dfb90e9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50b8fb64-aed2-4e75-a00f-053671782915", "sighting_of_ref": "indicator--067b2459-c097-48c4-bacb-99e5b589213d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af368d88-634c-4519-bb2c-4c49d3cedfc6", "sighting_of_ref": "indicator--9d252a85-fcd4-4070-83ba-76c592ce8668", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--306afa16-6c65-40b1-8282-0a3ed9c751d9", "sighting_of_ref": "indicator--9d252a85-fcd4-4070-83ba-76c592ce8668", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26088d30-006d-40d5-8b3f-f420d901f852", "sighting_of_ref": "indicator--a42d2c2c-caf8-447c-8665-5b7392545ca7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2d8b1c1-f2b2-43a0-8d54-5983a7ae112b", "sighting_of_ref": "indicator--7ac2097c-2afd-46f6-bd3a-eaffe62cf704", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b298a5fc-32e7-4f13-8ff2-e6200e6e86fc", "sighting_of_ref": "indicator--e9ceed77-dea7-4f49-bd64-2fe297eecf27", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--055e1e26-3b7e-4a0b-acc3-6c078d521951", "sighting_of_ref": "indicator--ab700c28-6b98-48e8-ad65-b611463a8477", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddad3490-16ff-462c-bab2-adb65d2264f7", "sighting_of_ref": "indicator--5234af78-0683-429e-882a-5d0bcab22eb7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbdbf7c2-45ee-47e2-a74f-d7e9b1c4f374", "sighting_of_ref": "indicator--4fde46df-714f-4fc0-b842-ee359d17b7ee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f6ee357-51c1-4a29-b5a5-4175730f25ef", "sighting_of_ref": "indicator--a60dccf9-dac1-42d7-a05b-ca7aff3bc4c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18353985-aa46-4ae6-a083-7296d476340d", "sighting_of_ref": "indicator--1f1e4e0d-b596-4855-b0ba-8d313ff3e871", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af5a3615-6cf6-4eb4-b109-aec3fe595fc4", "sighting_of_ref": "indicator--756cf85e-0f76-4ec6-b194-4cb4cd77c383", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c5a763e-d00f-4a70-b8c9-b324c3886902", "sighting_of_ref": "indicator--5dfcb2ec-4914-4164-b583-af2179e14110", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfe79470-d492-4f32-a59b-35fb6b31d243", "sighting_of_ref": "indicator--bb9d02d4-9431-42e9-9684-760068fda683", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15fe0d36-21f9-4501-94ff-9ea4c4ee8361", "sighting_of_ref": "indicator--e3d7fb76-3aa9-4106-ba76-214b770983a0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae853524-bf5a-4a3d-b863-45b56bb9d180", "sighting_of_ref": "indicator--a002d6d0-e765-45c1-86b6-1d2aab9829a7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ec7f1cc-45a7-4b92-9e94-246e4292af04", "sighting_of_ref": "indicator--a002d6d0-e765-45c1-86b6-1d2aab9829a7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a549c137-5289-411c-8595-12afa8f2a7e4", "sighting_of_ref": "indicator--d8b452f8-cf15-4e5a-8f3b-b332c8b36c1f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--187c0c36-84ca-4b91-9b96-c1c3fd79cdf6", "sighting_of_ref": "indicator--7bc988d0-fa8e-4918-8ebb-418a581709f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb33fcad-d3b0-4254-adf4-5964496f2969", "sighting_of_ref": "indicator--7c6f2781-33c0-4909-abf3-088cf1077c8a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06f0a9b4-eca5-484d-9ca6-d51b35538cba", "sighting_of_ref": "indicator--d669ff44-06f5-4083-b5b1-8d48dc83c432", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f32bb47-d115-4e7e-bfa4-d8de68218f0a", "sighting_of_ref": "indicator--d669ff44-06f5-4083-b5b1-8d48dc83c432", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8fe78c8-878e-4e60-b436-28b29ec4155d", "sighting_of_ref": "indicator--599789e4-2332-49b7-860b-29252217a879", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6d811c8-b022-497a-adbe-0402ed203d32", "sighting_of_ref": "indicator--599789e4-2332-49b7-860b-29252217a879", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fa678ca-efc7-4abe-b1ba-62396250b2c1", "sighting_of_ref": "indicator--8add619d-d64b-4006-997f-132594812443", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88d1056d-c36f-4bf7-bf00-e0c05eed4f68", "sighting_of_ref": "indicator--8add619d-d64b-4006-997f-132594812443", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a315930-efb2-42df-8643-d35cbbac697e", "sighting_of_ref": "indicator--4ab28d2d-adfd-445e-a067-c5b33aeea739", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc28075c-0628-499a-b07c-3524793bb8c7", "sighting_of_ref": "indicator--2438fdba-c983-49ee-ab04-1fc31a8c0443", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0dbd857-e055-42ce-aeab-d312d824aca5", "sighting_of_ref": "indicator--896445df-5291-491f-9567-f495e86fa56c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--501880a6-7c61-499e-95ca-89ce829b0321", "sighting_of_ref": "indicator--119708dc-fb22-40d5-b7ea-7b2ad23689a5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--218c0523-6fe5-403d-9e45-e52533409ac1", "sighting_of_ref": "indicator--efa2860b-a0b9-4c05-b2f5-ddbc277d14e6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--025e98b0-dc81-421d-a12e-060207f3c259", "sighting_of_ref": "indicator--20557cf0-9368-4459-8091-ff5f223d8e16", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3715ccbc-8e1a-49e0-8c94-c7c1957ff3f1", "sighting_of_ref": "indicator--ff8ebecc-fbbc-41d8-9de1-008837d00294", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6361248-dfd3-464c-9c6d-70db55158ec8", "sighting_of_ref": "indicator--6ad7ea6a-50d2-451b-9eac-b9b3f6f72f51", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f6887a4-fa52-4c08-b728-bcabed060c2c", "sighting_of_ref": "indicator--1b558323-b9ec-4deb-a88f-02f8d18a2043", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2481772b-da33-4eb9-b654-0ee7a1232645", "sighting_of_ref": "indicator--228f0629-4f9a-46fa-9a55-e133d35b9732", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--128832ef-6d25-4436-9206-a202eef8de30", "sighting_of_ref": "indicator--5e439ab4-7afc-4751-9bb3-cf9fb930f33d", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb17c61a-a0c1-437b-ae63-269fe5325fd6", "sighting_of_ref": "indicator--eb45f0da-aa56-4613-8a0c-b5644d4d4b6a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe61101c-e613-4a5a-85af-3775ca42ab14", "sighting_of_ref": "indicator--eb45f0da-aa56-4613-8a0c-b5644d4d4b6a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a0cddaf-94bf-4e3e-87ec-4b20f4d0face", "sighting_of_ref": "indicator--40e7f9cd-7086-4626-ad0c-89d4cb2b6e03", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--670c8364-be7a-4bb8-97a5-0b9f147165af", "sighting_of_ref": "indicator--05f7ee52-8c5a-48ae-a05e-9a1fb8a06573", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d89774e7-5203-4e4b-a9b1-e1a4edaa0d26", "sighting_of_ref": "indicator--3ca6c3fd-23bd-4e6d-bcd8-33a0f36d7841", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7d18eb5-d235-4fdb-adb9-a2fb1435369e", "sighting_of_ref": "indicator--902fa465-197f-45b2-894d-6cf53356ba90", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f9043aa-d3e8-46ff-bc3b-c90130a66962", "sighting_of_ref": "indicator--902fa465-197f-45b2-894d-6cf53356ba90", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4534639-02b9-4f49-a434-fee02581780d", "sighting_of_ref": "indicator--1c8853ab-88c4-4032-864c-a7fbfb0c6534", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67a2c277-54e1-4e24-b49f-29d0d5c6c7ab", "sighting_of_ref": "indicator--5ac63513-1c6a-4ef4-9526-7945f86563d9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21a25b8a-e125-4060-b322-7ad6d7741901", "sighting_of_ref": "indicator--9735c5d0-ab36-46ef-8288-615a931b3ba0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--093825ae-3341-4453-960b-073b7429d305", "sighting_of_ref": "indicator--9735c5d0-ab36-46ef-8288-615a931b3ba0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f6447a1-abdb-476c-9f7b-13ded01303c8", "sighting_of_ref": "indicator--c074d7c4-d08a-456c-bcc4-25c704b244b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaf1d322-8c14-47eb-a32c-812ef44d928e", "sighting_of_ref": "indicator--b47c26a8-b2a3-4918-804d-76161dd42d95", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84ac826a-6418-4f2a-a729-d02eb0536394", "sighting_of_ref": "indicator--63820bb2-e74a-4d0b-9f78-12608a12be9e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7f4cae0-b210-42b1-8ef6-d818eeb56d5f", "sighting_of_ref": "indicator--51dcb39c-10a2-484c-a246-5d6be465f21a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a0cdd74-9d8c-4bc7-8892-92bda7290a75", "sighting_of_ref": "indicator--91f90123-4f80-4e62-a738-848541f4516f", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7519855e-249d-4c19-a44a-9880226c1063", "sighting_of_ref": "indicator--e65cf6d4-4cbc-4cf1-b256-97be607005ad", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad03a526-4942-489a-9494-bfa5f84a9e71", "sighting_of_ref": "indicator--1c3d0e24-7d9d-4b40-ac6d-01dbfb21e2ce", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e58231bf-7511-4122-92b0-6686781d9048", "sighting_of_ref": "indicator--09b4cd94-cc9c-484b-8bc9-b08bdd22e9f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4c3e8c9-162b-42b5-9840-88fecc1f4a33", "sighting_of_ref": "indicator--ed3dc805-735e-4ace-8b9b-a2cef5d51715", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc96b2f6-ef80-4e60-875b-e90f7f66ffbd", "sighting_of_ref": "indicator--c218a3ef-7721-494a-a7cb-51fdc329f507", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dd5600f-a643-4ac5-a5ba-158db3971259", "sighting_of_ref": "indicator--a5ccadac-3028-4c33-aeb9-4983a6561bfa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78275c61-e045-47e3-833f-e1d3d1bb8ef5", "sighting_of_ref": "indicator--ff4e15f5-9df3-4228-897a-f86ee57a2579", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef30c83d-1f88-439c-b837-9b113535f269", "sighting_of_ref": "indicator--45e03cbb-8403-43de-b66a-a8c109c21baa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4531075-b9a8-452d-97de-47677080ecef", "sighting_of_ref": "indicator--6e729786-5add-451e-a92f-8e72f38ac54b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c387ed9-4605-4c85-ae4c-61b867fec159", "sighting_of_ref": "indicator--3d415f44-1e14-4b9c-be18-ad4a2fcf45f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61e74d34-96a8-4708-9173-00c517bb67eb", "sighting_of_ref": "indicator--b519e1bc-1b91-42f2-aa6c-3ba6a19d3a26", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cba6041-f73a-4a6e-b57c-9032e6e8c934", "sighting_of_ref": "indicator--8170dd05-0d7c-4b75-bddf-b7bda6625a76", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8182014-95c1-4ac5-a1d3-0170be9a28bc", "sighting_of_ref": "indicator--0c000e7b-95a8-4796-8363-56b173c4473a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d40a6e7-0ae9-4186-8c19-6c3089ec8b04", "sighting_of_ref": "indicator--96c45dcf-dd02-4c5d-9c0c-48bde7653ac9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--969a9021-b640-4cfa-8969-4d6b3ec08899", "sighting_of_ref": "indicator--0c3baf0c-1012-411e-bfc7-17f606f69beb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cad162a-1b44-4037-82ae-97de57c7b6e0", "sighting_of_ref": "indicator--e2d2f2ba-25e6-4cb0-9caa-70d9b7a68816", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dd0e101-f437-451c-a228-7edeb68024c8", "sighting_of_ref": "indicator--3a72c0a6-be31-42b9-93db-ee0f26847dc5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c34e6fba-60dc-45dd-a8e5-7141dedc1340", "sighting_of_ref": "indicator--ae2f2d2d-23c0-4350-bf55-2492b19ac69a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20822f4b-e825-49c6-9599-7e0ec683228f", "sighting_of_ref": "indicator--d78fd225-2397-44ba-8b80-3dd52cd43611", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a07c20d-44e1-4bb1-bb11-ead632675810", "sighting_of_ref": "indicator--d1e24899-d211-4fa8-b6d4-709806200efa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d57ca810-1d09-4a5d-8b93-98f2c62ce77b", "sighting_of_ref": "indicator--d1e24899-d211-4fa8-b6d4-709806200efa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a6fba2d-a169-4dc2-afa8-d67ace5aeac9", "sighting_of_ref": "indicator--2832ee64-34a7-4e5e-a97d-4935caacb90f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e9fdeb1-ed55-4d49-8c43-d0972a76bac1", "sighting_of_ref": "indicator--fcda363d-2d8b-4ffa-8a91-a2c8a5f4cf59", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4edb27ce-c57a-4b17-addd-1049a3663dfd", "sighting_of_ref": "indicator--c2bb7b37-76e1-41cc-8680-d27abfe1be6c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8822e41-37d8-4281-b52b-bef443bf7086", "sighting_of_ref": "indicator--c2bb7b37-76e1-41cc-8680-d27abfe1be6c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--180eba9f-f04c-41a3-bbbe-86276dd2a285", "sighting_of_ref": "indicator--24d54c9c-3cd4-4474-9ec0-8ae1ad768978", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37c015b8-4cae-4cdd-8137-9a2ec7d1913d", "sighting_of_ref": "indicator--c470a9b8-1c93-4110-9fd9-fbedb77b53ac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5c2df60-5146-4779-ae0f-bdc3bb7dc14d", "sighting_of_ref": "indicator--c470a9b8-1c93-4110-9fd9-fbedb77b53ac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--205808b3-932d-44e0-98b4-d48eb41fdc09", "sighting_of_ref": "indicator--6b106519-76d8-4c47-a3b5-e48ef2719896", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdb6ec53-a8bf-4473-86b9-69eefeabd66a", "sighting_of_ref": "indicator--dbb495ac-ada9-4f78-b30c-389d2cafd28b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a23bf7f-e529-443b-b5a8-d59560c05a2e", "sighting_of_ref": "indicator--dbb495ac-ada9-4f78-b30c-389d2cafd28b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50f9af88-5a51-4e42-a3b0-22b5f44ded71", "sighting_of_ref": "indicator--9895cac8-7855-4d26-b7cc-7eaea9937637", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c4f6339-b1b8-4450-a64b-d1e665c15069", "sighting_of_ref": "indicator--c425a736-0654-41d0-8890-e679c1a0ce69", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--784ec347-30e2-4bfb-b1f2-45d758fa429d", "sighting_of_ref": "indicator--8190256f-6101-4a1d-adda-c28f98487d71", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12dfabd6-7dcc-4a75-89f5-841b29dbd7d7", "sighting_of_ref": "indicator--8190256f-6101-4a1d-adda-c28f98487d71", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e34d42a5-d13e-42ff-9f81-0335fe26a4ac", "sighting_of_ref": "indicator--98b9b0bd-2538-4d17-b86d-c8bd1718267d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7c166bb-88c7-410a-8528-886d1adfc399", "sighting_of_ref": "indicator--94cc6d6c-04cf-486e-8569-ff16a39b85bf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da829aa3-891d-4c45-a5d7-3df31435565e", "sighting_of_ref": "indicator--7e2bc404-4c59-4afa-9c42-2da15c55e9ee", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cc372e6-6852-4b26-993b-71cafa0619f7", "sighting_of_ref": "indicator--0680e3c3-cdc6-4352-adb0-0e6e56467660", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cef447a2-5c87-4aff-ac30-f4f8cd340b40", "sighting_of_ref": "indicator--6838cb7d-f817-40b9-aaa6-f94e7533a3af", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7f93a9b-4d37-470c-850e-5a67b14dec62", "sighting_of_ref": "indicator--a5b0fea2-3518-4bf2-b06f-2584f7a6a1ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26939af4-28c7-493b-beef-145467247624", "sighting_of_ref": "indicator--50208218-e4d9-414f-90f1-02113d46c36b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4009bd9-50f0-4b97-a59f-843f0ea7789a", "sighting_of_ref": "indicator--50208218-e4d9-414f-90f1-02113d46c36b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a46f9d0-0fd2-4c95-9739-93c56e16b963", "sighting_of_ref": "indicator--f76b3333-b54f-41e1-b5f5-30e2e6cfba88", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebc30ada-ed42-4ad6-b7d6-406bf62ea099", "sighting_of_ref": "indicator--f76b3333-b54f-41e1-b5f5-30e2e6cfba88", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d9bb95f-2798-4890-9157-a27acbc4643d", "sighting_of_ref": "indicator--193d0494-7fa9-476d-9322-cc128cb6ce18", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7d8a004-cc01-4699-909f-c8301f203674", "sighting_of_ref": "indicator--408dce16-101b-4b3c-b8bb-e3523997369b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb961ec4-cfc1-4470-8314-a03be2e97459", "sighting_of_ref": "indicator--ab64c720-67f4-4219-9538-175edc0a4f4c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f649585a-1e08-43bb-9816-ccedcf67ce9d", "sighting_of_ref": "indicator--3ad86ca3-7af9-4569-b9c6-e1f54a0f1902", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fce3e55-8509-45d3-b9d0-ab15f0867466", "sighting_of_ref": "indicator--e17eb922-556c-48db-8c70-6dbb6a14466d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d69984ad-abbb-4d64-8fc8-4b451d8f78be", "sighting_of_ref": "indicator--b4df3fe9-677c-4e72-be87-a88c5f5528da", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43bd196f-44c1-45f6-ba92-d89c883dcc13", "sighting_of_ref": "indicator--88002725-31e9-45a3-93cc-da22f62524bc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7d51690-dd86-4a68-819d-d884e06e2d9b", "sighting_of_ref": "indicator--54f08e88-9caa-4096-9d8c-c538351d5a57", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f8a8ae7-e1bf-4b90-af28-bf8f44ce59be", "sighting_of_ref": "indicator--54f08e88-9caa-4096-9d8c-c538351d5a57", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d90e5de9-d7a4-49a9-bb9f-58137be0346d", "sighting_of_ref": "indicator--09db91dc-649e-4c3d-ae15-4b6f89612a90", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--384d778f-c50a-4a49-b496-cdde7f8e5073", "sighting_of_ref": "indicator--1151afa7-2224-4428-bd0f-a1df5da622f4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d072ea63-fd22-435d-90da-ef39aa6604bb", "sighting_of_ref": "indicator--658e0a39-a0ca-4d87-a773-c3d07893e2aa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a888ab0-59c2-4a59-ac74-41a1974dbc4f", "sighting_of_ref": "indicator--e7b853bf-9f47-43c0-90ac-63f3a46e6036", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4258504d-28c0-44be-b565-47c854dcd45c", "sighting_of_ref": "indicator--6e050fd3-b7bb-49b3-9061-97bb5930f647", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e66b335-1894-49ef-aed6-f199ba7b5adc", "sighting_of_ref": "indicator--d8e97493-d308-4a22-806b-251bbbd83134", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec90beac-b724-4a60-be6a-9804bd7a880f", "sighting_of_ref": "indicator--e032b035-b234-4c75-a5b9-73c2cd662470", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8451fa16-0c0e-4d4a-965c-9aa113c1348c", "sighting_of_ref": "indicator--e3ab6b81-87b9-4bfa-bfcb-a78a2634f34f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--754ebc01-8a2e-4f11-b70d-e0d19fdf57cf", "sighting_of_ref": "indicator--e9afc5db-3926-4d50-98b9-cacf646eedb8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bd35c4a-966d-4dfc-9c4c-88a351ae6912", "sighting_of_ref": "indicator--e9afc5db-3926-4d50-98b9-cacf646eedb8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8348aa9c-0992-4359-af92-ee040813e9a7", "sighting_of_ref": "indicator--6aa4aaf0-1e6a-43f3-855b-c79ddbcf4e76", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06debf64-a9dc-4f88-bdcd-254fabda62fa", "sighting_of_ref": "indicator--6aa4aaf0-1e6a-43f3-855b-c79ddbcf4e76", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--515d65c2-66ea-4ce9-aaa5-71cd8fea6a3e", "sighting_of_ref": "indicator--45855844-03db-4ba6-8f66-2ee31f6c84c1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--390adfd6-7cb3-4285-81b4-d9cb3f75ee5b", "sighting_of_ref": "indicator--45855844-03db-4ba6-8f66-2ee31f6c84c1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad0fe7d1-aaf6-4bfa-a66d-a0a9b7661a4a", "sighting_of_ref": "indicator--d2e73e86-62fe-4a78-90f2-8f71a5a150f4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a4ea69b-69b5-4d2b-a63e-423474b281ae", "sighting_of_ref": "indicator--b65515d9-2e05-4d0d-be2c-55e9d593b647", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf3a0055-2463-4e51-8031-42354d107e6f", "sighting_of_ref": "indicator--c658db8b-647b-452d-acf9-89e30636ae60", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02f1c2b3-f22e-4c0a-b6c3-0e3ff9f0573d", "sighting_of_ref": "indicator--baeae0a2-ec27-44d4-b9e0-f647278f91fe", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5deb212d-5bbc-4729-b6f4-5f4492f35730", "sighting_of_ref": "indicator--8c48798e-482c-4daa-ac67-d53450e22548", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1bca4c7-85f1-4f3d-8a9f-000efb4eeb2d", "sighting_of_ref": "indicator--7a4dbb7f-c5d2-4704-b5eb-4db593733b47", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a38bc85-553f-4108-b5dc-a2cdf539466b", "sighting_of_ref": "indicator--c5b3de02-85f1-4f4b-b6c5-59b63aa745f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1214389c-73e1-4e1c-84f9-31dc00662747", "sighting_of_ref": "indicator--c5b3de02-85f1-4f4b-b6c5-59b63aa745f8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--087fe8b0-bca4-45c8-b369-76f821d595a9", "sighting_of_ref": "indicator--b90d30b0-490a-4fcd-9ae5-2386e689c176", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d0150f8-d0bb-4bef-a260-94d08de02b66", "sighting_of_ref": "indicator--64ceb921-a644-4e6d-825b-a747b16a2e5e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8c66bac-6d46-44f1-aa63-aa4d50e520e7", "sighting_of_ref": "indicator--21a3422f-4f3b-42eb-85dc-529f051a3dd9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca76b264-c9f0-48ea-b7a2-8d0b562447fc", "sighting_of_ref": "indicator--bd20bfda-73ac-47fa-a142-bc96ea5f7853", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55eecd4f-dae5-4647-b9b7-08a792bed917", "sighting_of_ref": "indicator--1cff1133-3794-44dd-b85c-90f356de7d62", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48124b9b-01f8-4d6c-8a9c-ad547bbc93fb", "sighting_of_ref": "indicator--e7321517-e677-4ec3-a40e-5a4110f11e8f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--770a3225-dc15-4cb9-b813-a3145cf3c2c0", "sighting_of_ref": "indicator--5e178e0c-d798-43ca-ac24-2ef168e87727", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c94dd109-a62d-4d97-8fec-b0d42da40cfe", "sighting_of_ref": "indicator--1ac848c3-f4f5-4c41-9daf-befa6682ed6c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6c2b516-4ecf-46ea-b8a2-a06b69c87bf1", "sighting_of_ref": "indicator--1ac848c3-f4f5-4c41-9daf-befa6682ed6c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81c713c3-5f63-4cba-bab8-6bca79650370", "sighting_of_ref": "indicator--852dabb2-26cc-4a61-89bb-7bb0599a3c0a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76cc9209-3953-4679-ab20-d3c1a562d35c", "sighting_of_ref": "indicator--107a269d-b97f-4c4b-bcae-850c5264cbae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3048a87b-9c18-4ba2-ae3c-103c1c23df31", "sighting_of_ref": "indicator--b32abfe7-a4bf-46e4-bb1d-b6aedf2d33df", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebf8e9a4-7c25-4f94-a4ac-d031e4ef1fa1", "sighting_of_ref": "indicator--7cffd5ce-a33a-4eca-800c-945947cffdc7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b91508c7-98bf-4c90-867e-80937c056c7c", "sighting_of_ref": "indicator--fbd9c6de-397e-4805-837c-a2444b56832a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--897d5976-8a76-4b1e-b682-70dbd4b099a7", "sighting_of_ref": "indicator--668d25e5-e0c4-4cd2-8a3a-dddd7078c0d3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8e92294-b4f6-457d-bacf-74b5e1047d7b", "sighting_of_ref": "indicator--b70d8e4d-f9ae-4dcd-bc76-65f2d05148e0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7323919f-4c14-4942-bb5e-8258ce1aee2d", "sighting_of_ref": "indicator--b70d8e4d-f9ae-4dcd-bc76-65f2d05148e0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bbf6fe5-6c59-4e96-bf03-aec4eec5ba90", "sighting_of_ref": "indicator--29e0df01-721b-4809-bf61-f31aaaf532d6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d406b645-617d-4b88-af5e-1a63b6e97706", "sighting_of_ref": "indicator--924820aa-975c-4fcb-a1ed-7654670015b7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--272ff7d3-0463-4a8e-a848-42216608448d", "sighting_of_ref": "indicator--95574ec0-8b83-4195-8b69-966573444b1c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f764e113-bc3a-4adb-890c-a5304f828628", "sighting_of_ref": "indicator--e40ecfc3-5b9f-4777-ad2a-31c2d0c5c888", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56fcde5d-4ef7-4611-866b-6f2e51adaff1", "sighting_of_ref": "indicator--60661b8f-67ad-41a8-acc6-01f6b4c5efa3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2643828-4930-4ba6-bb16-8cbe62f2b4d4", "sighting_of_ref": "indicator--2c69a59a-d891-46b4-8d93-2f02a234d40e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53a778bf-c456-4fb8-8318-fb9c9413b23a", "sighting_of_ref": "indicator--41a1d926-8bc3-477e-a662-9a18f1f4511f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34b9bc48-3ef1-41a3-bcfe-a2cb7f0372a9", "sighting_of_ref": "indicator--29d2bdaf-dd86-4daa-8b2c-aa76eeaeb73f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21e6b48f-c0e9-4704-843a-3c0adf164242", "sighting_of_ref": "indicator--101fd637-a84e-4849-ae03-e73cb90d190d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63679c75-5c46-4f87-82a5-c0fb78012f3c", "sighting_of_ref": "indicator--1d32e47e-672e-4cff-98b5-42cb77ff1d80", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4635299-cef3-4620-827d-718f35469bc8", "sighting_of_ref": "indicator--686409d4-c04b-489f-a023-014e7106f0a7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a8af5bd-4b3a-498b-b848-60306b1961f3", "sighting_of_ref": "indicator--5e940ad7-be1f-45e2-88d9-f700bad1d5e8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f71e8f18-1f30-430b-a2e6-2772352240c5", "sighting_of_ref": "indicator--382cd728-cac1-4595-8438-4f7e982b958e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0bf4623-0630-4710-8014-ac65fa522539", "sighting_of_ref": "indicator--bff82027-f887-47d5-a776-b65abc66cfed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dd973c6-54cc-4f15-a0b5-5d8c9f082260", "sighting_of_ref": "indicator--05f3886c-528a-4a49-b708-fa8bcdad9ca1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aebe3dca-0fdc-4c06-be5e-e23385f90885", "sighting_of_ref": "indicator--88e1c098-42a4-4cfd-a83c-1f0103f60e15", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70dc3789-6af7-4088-ba9d-11a4cbff3da5", "sighting_of_ref": "indicator--63ef39f0-a5f0-4b00-903e-562df84c367c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--048e9c26-5813-40f6-a120-e7e3d64a4255", "sighting_of_ref": "indicator--02fcb385-0a70-496c-b1fe-d656100a5f7d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b6a330e-5519-4e23-884f-9426a03383ee", "sighting_of_ref": "indicator--60da8402-8904-446f-b8fe-04fcd87cc0fa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acfbdc2a-230f-42a5-ad4d-0e00ca85c6e0", "sighting_of_ref": "indicator--60da8402-8904-446f-b8fe-04fcd87cc0fa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bf7ce08-2d87-430c-a426-3c95d122e0e5", "sighting_of_ref": "indicator--c699feba-31ee-49e5-ae18-64614a503b70", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36b0791a-5e1a-441c-8f0b-a5aeee3744cc", "sighting_of_ref": "indicator--c699feba-31ee-49e5-ae18-64614a503b70", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b36eb74-9ff5-4813-829b-69d2970661be", "sighting_of_ref": "indicator--af4aff95-e35e-4bc4-9e57-fcfd59ee2fd4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66ab7291-ce5f-4463-9d92-59e34bcfcf83", "sighting_of_ref": "indicator--e9799b0f-42d3-47b6-add5-95a4729a70db", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e02b050a-11c5-4ddb-9c56-3e3f3952b75e", "sighting_of_ref": "indicator--a01beead-382d-4152-af22-2e3b8f3ecc7a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6341d14-00f3-43f8-be82-a143e2b959b6", "sighting_of_ref": "indicator--5648085f-560a-44f3-85cf-85fd32832a6b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f08b11b7-3bea-4eef-a9f0-85394229b4ab", "sighting_of_ref": "indicator--3a91488b-4867-41f9-9c1d-00be9d26c5b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36f57bf3-4455-4f9c-b83f-9a3e929db790", "sighting_of_ref": "indicator--c01c6bf2-57ed-426b-9381-0e15ecae8850", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f569264-039f-4a82-a9f1-da450da611ed", "sighting_of_ref": "indicator--32f30156-9ed6-429e-8192-0f68bb034681", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--862049b5-a5dc-43a2-93ed-16fd1d2fe3a6", "sighting_of_ref": "indicator--68e8e905-f0a7-4a64-acea-ae00a4fd341b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07e8d1fd-b740-4996-9fe6-dcf68247d0e6", "sighting_of_ref": "indicator--6dbfdd41-03cd-43a0-b41d-9334d0783494", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--767b6c59-a1c0-49af-8c18-616e4976753e", "sighting_of_ref": "indicator--40972746-9b04-486d-b14a-1f06ce87f5ad", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77d20654-3b50-49c6-9471-b91df5dbe0b4", "sighting_of_ref": "indicator--5ed2b964-04bb-48f0-a53d-c3e8f5b90c4c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64a787f9-287e-4c72-a3db-8cb020365b08", "sighting_of_ref": "indicator--12089b96-681b-421c-bb49-f6efc0d1dcad", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64bd2358-b766-4d19-ac24-2f92fa13376a", "sighting_of_ref": "indicator--04d529fc-0b87-4723-a90b-be0884685be3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adbf7f5a-42c3-4869-b3d7-c99b2d94ea77", "sighting_of_ref": "indicator--04d529fc-0b87-4723-a90b-be0884685be3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d646bd53-1329-4205-8ab9-5f5931894a74", "sighting_of_ref": "indicator--d734ca3a-c200-4b6b-bd77-d83cdb96b22a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd49a2b1-292f-469c-b616-4d2d5f7e06b5", "sighting_of_ref": "indicator--46c7c459-c1fc-44c5-a608-0653506416ab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd18cb8e-81b4-49da-8609-d65224d9247f", "sighting_of_ref": "indicator--535ece95-e861-44db-9195-e15b4c3f9f05", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6662b4cd-13e6-4783-a24c-36163b301b41", "sighting_of_ref": "indicator--61ba0996-d64d-4dce-be8b-5a41e7ab5aee", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d352ac69-c135-4671-84f7-154fd60ec387", "sighting_of_ref": "indicator--e497aeee-9269-4e01-823a-681ebc9ea74d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8614687c-ff40-461c-90c8-10a01af2f548", "sighting_of_ref": "indicator--3b21293f-ec1c-42a1-96d1-8997977b6c1c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73210cdb-b4b1-4fd1-984d-ef940328cf63", "sighting_of_ref": "indicator--391faaf5-8c6e-4241-8b97-f880569f1187", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab8e4442-820d-4186-a16e-1695f8743c3e", "sighting_of_ref": "indicator--536f8baa-8bdd-419c-b554-a7a179397c56", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44d8b990-aeb9-48ad-82f7-cb66b65ba923", "sighting_of_ref": "indicator--0a14b848-49ee-42bc-b74b-f08660c7f1e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9a4d271-247b-4fd1-91d0-5784430f9b61", "sighting_of_ref": "indicator--0a14b848-49ee-42bc-b74b-f08660c7f1e4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca95734a-87f9-4362-9c9a-d21b9ef05adc", "sighting_of_ref": "indicator--081c10b7-d6e2-42ec-a9e5-b696b8992883", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1a5cbc1-6b67-4657-93a5-883cd0a36930", "sighting_of_ref": "indicator--081c10b7-d6e2-42ec-a9e5-b696b8992883", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87aa0c5b-7fe5-48db-b84e-850895b602ea", "sighting_of_ref": "indicator--d567317e-e397-4dc5-8210-d573502b613f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27500f17-c85c-4bda-a464-1249640eb127", "sighting_of_ref": "indicator--a2858f65-dd62-4235-9f2c-715e8aee9303", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10ec49ac-84b9-4c4a-8355-00967982be16", "sighting_of_ref": "indicator--68c8b581-836a-4c66-bb48-46f2f8cb5c51", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6a44d32-0b73-4011-b541-0eb64896af04", "sighting_of_ref": "indicator--0f0327a4-a4e2-4589-8719-bcbbe5d9d518", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--106f42b6-a24d-44ef-8694-bb31e2df6d99", "sighting_of_ref": "indicator--17b8eb10-0c62-4be2-82d0-5ea96b9089ab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c631ec3-fb3d-4d7f-914a-d5ca9836bdca", "sighting_of_ref": "indicator--e2a809b4-11c6-4520-92d0-395e52c3f103", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7a52412-89c4-45de-ad97-261eb2c92b02", "sighting_of_ref": "indicator--0dfebb24-b72e-43ec-8406-f44142b92124", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba5fb830-6ad1-4865-870f-7f988389ec91", "sighting_of_ref": "indicator--914631ed-9f69-45cb-bc0b-30ff8410d554", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92fb6fda-fecd-48d5-bf51-c00926d4efff", "sighting_of_ref": "indicator--353fd7fc-c94e-4318-a6a8-864a0a3a8c0a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1003b5ea-a0fb-49e1-830f-a5f183a98fb3", "sighting_of_ref": "indicator--9c65cc8f-5bc3-4545-9488-9fe68c21dc81", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd0a42e3-007b-46c7-b454-9e922ca921d9", "sighting_of_ref": "indicator--1771e242-8da2-4fec-b8c9-4d6de9bfa1ed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e18b4cef-345f-453d-ab6b-6c04b72bf903", "sighting_of_ref": "indicator--1771e242-8da2-4fec-b8c9-4d6de9bfa1ed", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eb8faf7-f8cc-4f73-bbe3-8cc6c29f5eff", "sighting_of_ref": "indicator--bd8a1772-133e-47c0-afd4-f4bac19c99d3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ee0764e-f921-4ea1-b2f1-5f0b10bd1bcb", "sighting_of_ref": "indicator--23242718-e17a-4f68-95b3-12106b393406", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b7b024c-45b4-4f3b-a07b-2b2e7f57d3c3", "sighting_of_ref": "indicator--0cb384c2-9be9-4e91-bfd9-ac514e62e2c7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd39857d-d9db-405f-92d5-93fa2dce82d2", "sighting_of_ref": "indicator--b18ecf72-cf98-4691-a44c-3591e582abbf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42b62d24-5de5-452f-abae-c317cdf2586d", "sighting_of_ref": "indicator--5a50536e-e5fa-48b3-a93e-39240a00c7f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8103bcb-7467-452d-9585-3bb05b2eafce", "sighting_of_ref": "indicator--b8d2bf2d-50ff-40b2-8a43-6a5db3928abb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27a37bc0-b9a6-4b3e-9995-5f325971d8db", "sighting_of_ref": "indicator--efbcc61e-2460-4755-9532-fa2050ce28f1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--428dbd66-2f73-4b17-941e-f26257f52776", "sighting_of_ref": "indicator--efbcc61e-2460-4755-9532-fa2050ce28f1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d11e8a9-cc00-4654-be92-5f46972f8478", "sighting_of_ref": "indicator--36338b7a-b782-458e-9a1d-5b4708d3308b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f961815d-3271-4142-a266-2b12ae918502", "sighting_of_ref": "indicator--36338b7a-b782-458e-9a1d-5b4708d3308b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea857f0e-79bd-4498-8a3e-4fd0348e4931", "sighting_of_ref": "indicator--b89fabf5-9ec8-4cd7-91c3-e122df9e1093", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9207cd3-b980-4985-bd12-eb4f6169bfff", "sighting_of_ref": "indicator--b89fabf5-9ec8-4cd7-91c3-e122df9e1093", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73e3285f-11ce-4f82-9c7b-6dac2b27d0ac", "sighting_of_ref": "indicator--71ee5260-055d-4ee2-b65d-8abb3629b6ff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b623569-2464-4e2c-8666-f6e92973aca8", "sighting_of_ref": "indicator--71ee5260-055d-4ee2-b65d-8abb3629b6ff", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d2e46f6-2510-439d-81cd-d344511648c5", "sighting_of_ref": "indicator--462ec585-4293-4e3d-8363-888472e1f117", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d37c1df0-96ba-440e-aca5-d5f74cb84201", "sighting_of_ref": "indicator--5b704f0c-b965-448a-837d-add95b790fe1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a848514d-b679-42c2-bc65-c1d07ff838c5", "sighting_of_ref": "indicator--04989a1d-db5b-40dc-96a6-0a45db82cb84", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26a03955-82cf-40b7-8237-2be9b13b3296", "sighting_of_ref": "indicator--710147ae-f586-4fc9-9b08-bc2db29e04ae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfd6b944-59b7-42ac-83b5-97d36e153108", "sighting_of_ref": "indicator--710147ae-f586-4fc9-9b08-bc2db29e04ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5f33720-09e1-4c11-8a50-9004936524d5", "sighting_of_ref": "indicator--af15350b-7ce6-4179-93dd-dccfb2345543", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c5fccc4-e413-4f26-8272-f29638c8b8f0", "sighting_of_ref": "indicator--551ef798-311d-409b-a741-1b0b09bf847d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6ed9f32-2375-459c-8469-b74eed9af54c", "sighting_of_ref": "indicator--00cbaa0b-4a28-4a33-9e0b-6ac3ee8d9301", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--986a17e5-a691-4721-99b7-93e77118792c", "sighting_of_ref": "indicator--0b369326-5154-4dd6-8a40-2a6b3cd86ec4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--581b773e-f0f2-4104-a812-d7d030f9fff7", "sighting_of_ref": "indicator--c71257f1-b444-41f3-8bbf-03260f8c60a9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d817c357-f7a7-45ae-8985-21836f46aa4f", "sighting_of_ref": "indicator--83942045-d8a8-4ca9-a32e-c4db3630226b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ac544c3-7240-40a1-82dc-d399d64ec688", "sighting_of_ref": "indicator--d01c9d3f-643e-48a5-8fff-9bfc38942ed7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7997567d-8961-4a4d-9e49-1f21f13fba58", "sighting_of_ref": "indicator--be6200f6-6614-4631-ac61-370c0bb0d4f9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba355cd4-9947-450d-96e0-667fd3c754b0", "sighting_of_ref": "indicator--be6200f6-6614-4631-ac61-370c0bb0d4f9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98c9c05b-48b2-4414-9003-ae32953ac8e1", "sighting_of_ref": "indicator--030690e4-16fb-4590-b7a2-56494b07d5b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--232e31b1-70f2-410e-9503-d18c6aec30b5", "sighting_of_ref": "indicator--13e710c8-3cae-4fcc-859f-b0511a5eba2b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c49da0e-8ce9-4273-923b-42222de2d2fc", "sighting_of_ref": "indicator--13e710c8-3cae-4fcc-859f-b0511a5eba2b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bc8e49e-c08c-4add-a64a-4c49abcb872a", "sighting_of_ref": "indicator--142542f5-39d3-44aa-918a-a0dfc9bf2cf1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0d49a41-a07f-4a4d-a71d-6c51450366dc", "sighting_of_ref": "indicator--142542f5-39d3-44aa-918a-a0dfc9bf2cf1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--152a1464-8eb2-4278-9367-80ed47a0c402", "sighting_of_ref": "indicator--7deff233-f019-43f8-b05a-082573b00f0e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73e5f3f9-db7d-43d2-9233-3c1e3f84aa31", "sighting_of_ref": "indicator--1059690b-03dd-42c3-9f17-854273fe3e20", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86af52ed-f01f-4f1d-9f01-bb64f7f4935c", "sighting_of_ref": "indicator--6aaa4397-7220-4d4a-bddc-2b1c26087541", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de57fdd7-914b-4a9e-8fc9-ce209174486b", "sighting_of_ref": "indicator--5ca415c8-c3ac-4aaf-88a9-d2063da24558", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de693210-f921-4f00-82af-8d42de2630ed", "sighting_of_ref": "indicator--e79a92b1-cabd-43a3-a2e9-3dbf45451bae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f4c744f-db31-4100-908e-ceb218ccafe9", "sighting_of_ref": "indicator--5d87e68e-1bda-4d28-b24f-955eb21fb453", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7ee10d4-9dfc-44af-be0f-28ccb5401747", "sighting_of_ref": "indicator--9e9bd239-a5b9-47c5-80a8-158b299deb4e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b916c5d-62f7-470e-ab5f-098c0a10d34e", "sighting_of_ref": "indicator--3f51f695-0e5c-43ab-8d06-8ac667c381a6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86a2cccf-6820-4bf8-a043-40b9b109c3fe", "sighting_of_ref": "indicator--4b612c84-47c1-41ea-a305-73b6218861b8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2b413c9-4554-4a08-8ddc-fb7684877563", "sighting_of_ref": "indicator--b4233f2c-6ee1-44ad-9cf2-cdfd22a8162e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--213a401e-063f-44d2-8c1e-1817f635e91c", "sighting_of_ref": "indicator--4b7b3377-211f-4abb-8980-1eeeb9d1864a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88ec3fa9-c771-4233-be8a-6d8176ed5ea1", "sighting_of_ref": "indicator--202e697e-0d4f-4524-9cbf-9df60d5f852e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afce6f5d-5a7c-462f-ae46-fe9fcdf3fe21", "sighting_of_ref": "indicator--198dca25-14e6-4f2c-a13c-6a2e4337d83b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21fc01fe-3ade-43d8-a516-6791999d487e", "sighting_of_ref": "indicator--f2e1142b-d73c-4dc9-8f2c-8a09787f3bac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dfdb02c-0707-4172-a156-9ab91decc208", "sighting_of_ref": "indicator--a730017a-e7a9-4267-a5d8-86d4d52006cb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a569257-47aa-46f7-9050-2e436b42f716", "sighting_of_ref": "indicator--b8c1b7cf-07ea-4b29-a3b6-74ca8ad8bf9a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3930da4a-c091-47d4-ada7-7ad4529fe94c", "sighting_of_ref": "indicator--21a1fc94-c20b-40d2-8153-9bcf4a369f1f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aa3e941-af18-4860-843b-e3e5d2a8515e", "sighting_of_ref": "indicator--e5ea54ea-ea13-47c6-99a6-d751ce693020", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c6336b3-61e3-40f2-a006-c1225fb3ccfb", "sighting_of_ref": "indicator--e486dac8-f695-41b3-8976-8eebb1c44c56", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20e28ac7-a804-433c-8b65-25a7973a39b3", "sighting_of_ref": "indicator--a9be742f-aad0-450e-b3f9-d2a8267e0c5a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6597e38-6d88-48d7-9e97-93ad80afcbac", "sighting_of_ref": "indicator--52e1f3b8-c8bc-47e2-bd5f-89d02a817020", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70f61671-d5a3-48ee-a68b-3ea64c9c5239", "sighting_of_ref": "indicator--52e1f3b8-c8bc-47e2-bd5f-89d02a817020", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af1493e6-c8c3-4a10-a9e3-be741865c331", "sighting_of_ref": "indicator--01d94fa8-7a58-453f-a537-f35965162e31", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--443cce55-8d0b-461b-897d-b0ad04288b02", "sighting_of_ref": "indicator--5bd96b75-1c1d-47be-80c9-b64dacbcaf81", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d9cee6b-360c-47f8-966f-5418fb953291", "sighting_of_ref": "indicator--410def8c-8c67-4e03-8812-0da523742352", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b674d23-0b89-48e2-b018-a63bebb2d7b4", "sighting_of_ref": "indicator--9dc4969a-124f-4a2f-ae22-b5b3b4a15e99", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9adfc876-c68c-4a30-b861-40f6397aeac9", "sighting_of_ref": "indicator--1d75e45f-3499-4cf9-9e0e-9efe786b0061", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae5fb123-1be9-49a4-80e2-8f3a3c0442b3", "sighting_of_ref": "indicator--903c8506-5663-4a59-b338-5f68eb4b547c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3576ef22-601d-48c3-b421-f157e49c527e", "sighting_of_ref": "indicator--fc290d8d-7d77-4302-8272-600ac11abe18", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8af01bf5-3c90-48f4-a0ca-190959b6230f", "sighting_of_ref": "indicator--cea2a1e4-0014-443a-be25-dfd81e491d94", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edbca0f6-437a-4568-858b-f85d5d8f4578", "sighting_of_ref": "indicator--c131df03-2087-4aad-b518-7fd16585c134", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a4f03fe-d9b6-4b91-9b18-8c1fb3f2bea5", "sighting_of_ref": "indicator--5cbc4e79-c550-4403-b3df-7bd7ea6f9f7d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2378242-fe3f-4869-8f15-87ddd48cfcb4", "sighting_of_ref": "indicator--0cf0dfb7-23a1-4eed-9f60-b354ea04319e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddf48029-aba0-4517-91ac-d9cb2ab948ec", "sighting_of_ref": "indicator--38a98cfe-61a7-45dc-b01b-23b5a330c35e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd872207-b3cc-401c-b4ca-cdc64faf0a85", "sighting_of_ref": "indicator--a58baae3-d215-448c-916e-8ea35a75d39d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--753341f9-41ad-4518-a807-e6652fa2f83b", "sighting_of_ref": "indicator--a58baae3-d215-448c-916e-8ea35a75d39d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92afa094-40d5-42c2-839e-c91c7882f31d", "sighting_of_ref": "indicator--b7bfbe34-39ff-4814-98c0-4a0d9a2e4fa5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5cc9263-2dea-40af-b030-5de1cdf87205", "sighting_of_ref": "indicator--de405cd1-f415-44ab-b92d-03e4cae7f6c2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82fe4422-e53d-483e-b31a-c6330e3bf1a0", "sighting_of_ref": "indicator--fd8f6203-7636-4965-8944-a96e30cec8ec", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f2bd2c4-1da4-45ee-bbda-ce2a44710f62", "sighting_of_ref": "indicator--6ca0eccd-3aef-4b37-a584-95fcd0583890", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3378c5d6-8766-4cfa-a66c-3c166f323676", "sighting_of_ref": "indicator--5809cf99-fffa-4588-8507-b9541a62fe33", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--828fe4d7-c272-4e9f-81a2-b2042ce8bd43", "sighting_of_ref": "indicator--173de7db-66e2-4033-811f-6e6f8ad83f3e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0224360b-5676-44b2-8241-6649691ba093", "sighting_of_ref": "indicator--91eca07d-5401-44d5-9b2c-5c67a2b3cbb2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe8f234e-4135-41b1-bbaa-6402f1ac3ca9", "sighting_of_ref": "indicator--e9b27e73-9257-4a0c-a4fc-8e8c364cbd9e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cf39123-b23c-484f-a667-42ef91e49e91", "sighting_of_ref": "indicator--77285a4c-7543-41a9-b2b7-3e35b72571a6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2f749ae-81f5-4681-a756-f574b03a5807", "sighting_of_ref": "indicator--77285a4c-7543-41a9-b2b7-3e35b72571a6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a31ee2c-06b6-48be-a4bd-57bd5da4d91e", "sighting_of_ref": "indicator--da9f3d8c-e613-4049-8f6b-32771d227c3c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c9de824-0eb1-4b02-ad78-4623faa522ae", "sighting_of_ref": "indicator--d7ff90f9-471f-4e0e-949b-87544510f00a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8443a230-0216-4301-ba86-e12ac2b459fe", "sighting_of_ref": "indicator--84e4fca4-c2f5-417b-8008-c321dc3c1a45", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ae987bb-655e-4409-a155-7618d832bb76", "sighting_of_ref": "indicator--4ad47bef-9e2a-49e5-8f6e-b671d5802612", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a07c582d-920a-4351-8734-aba6a4fb6677", "sighting_of_ref": "indicator--a2d0b82b-95a3-47e6-bd48-ebf142a37b75", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fe326f0-9a72-44e7-9d13-e556fd88c2bd", "sighting_of_ref": "indicator--388dfd43-54c0-49bf-96e9-adbb16006a7e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--909f218c-4227-4e7b-b043-16de6c523cfc", "sighting_of_ref": "indicator--f3aa98ad-aa6d-4e26-9cd0-b2b9508974be", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2b95376-9f4b-43ba-a7fc-1ccd25fbb362", "sighting_of_ref": "indicator--9ebb1c2f-f55e-4318-aa41-efb9275d643a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f48e488-cab3-42a0-8b02-e2aa56201846", "sighting_of_ref": "indicator--9ebb1c2f-f55e-4318-aa41-efb9275d643a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5af548e7-9674-4895-ad7e-2018f173c3e2", "sighting_of_ref": "indicator--bf8cfb10-5edc-425e-be15-855768b677c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a04113ac-f147-47ea-8ed9-e21a7cf7c14a", "sighting_of_ref": "indicator--a9f29629-e246-4639-89fd-206eebf9a30a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ae6549b-3400-4518-94e6-ac41945d8800", "sighting_of_ref": "indicator--a9f29629-e246-4639-89fd-206eebf9a30a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0032a23-f630-4db4-bd3a-6927126c79ca", "sighting_of_ref": "indicator--cc637e98-18e4-461f-a4df-bb95155a1523", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86881f75-9897-467f-88d3-214ee7f315d5", "sighting_of_ref": "indicator--e25f0315-18ad-4c83-8dbf-37975fa7bdec", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f828cb75-3fb7-48d0-8cb5-48379ee6cc61", "sighting_of_ref": "indicator--8c45eb59-5511-4c22-9308-35b17248b73a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1786945-31d8-4ae1-9652-4f1be94c572a", "sighting_of_ref": "indicator--8c45eb59-5511-4c22-9308-35b17248b73a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75e7a5a2-bb81-437d-a060-5b7c58152d4d", "sighting_of_ref": "indicator--2e0a466d-860e-4079-99c2-04545b3de9f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a7c346f-3dfb-4e75-a8d1-3bcb0f79a80a", "sighting_of_ref": "indicator--bab9fc98-d3f3-4400-9819-478b2d30fcde", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6049d352-ce8a-46f5-98f4-64150082e991", "sighting_of_ref": "indicator--dc594e86-56ef-49ba-ae5c-c874036a2eeb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d5ccd20-7c50-4cbe-8db3-ea979100b1bc", "sighting_of_ref": "indicator--d764594f-3075-487a-9d67-38e25d5e09c3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c13ca1f-5b69-458f-b07a-f50caaafd2a3", "sighting_of_ref": "indicator--94cbfa0e-4b09-4795-81c6-1e626920dac1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56aeb443-ea13-4518-baef-2d61ef71e5fb", "sighting_of_ref": "indicator--58622a2a-1161-49f8-9017-ac046d25139e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdbfa6cd-f945-4cb1-aa80-16e8845aa12c", "sighting_of_ref": "indicator--03201add-adf5-472d-9506-d04ad98c8a21", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9265339-c7c9-4bb3-a1a1-362ed5fb2d34", "sighting_of_ref": "indicator--03201add-adf5-472d-9506-d04ad98c8a21", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e6aaa93-9b6d-4e88-b0ab-8a36ea56170e", "sighting_of_ref": "indicator--c32ebe73-706b-4a08-ab96-6e35bdab9767", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--313858cd-f1ea-4a29-a855-48293f033af9", "sighting_of_ref": "indicator--a8ad0ce9-b259-4a55-b8dc-8c0d13e2daf1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a51da67-30aa-4f48-b10f-0ca125e06cf5", "sighting_of_ref": "indicator--32ef65d1-951d-4407-b8fb-1cfa3777c9df", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92fa02be-9c7d-4eb2-9b25-2cf4180b6e9d", "sighting_of_ref": "indicator--32ef65d1-951d-4407-b8fb-1cfa3777c9df", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06219639-8364-468f-8f53-93d9291faadd", "sighting_of_ref": "indicator--926b0335-8141-4da4-87ee-e34131c07631", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08e0ec16-53ed-4bd0-afb6-5e6050b8611a", "sighting_of_ref": "indicator--6f88bf74-61b2-4807-85c6-769c47ecea92", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--597e3a34-8dca-4136-80d1-8e64162d655f", "sighting_of_ref": "indicator--6f88bf74-61b2-4807-85c6-769c47ecea92", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--531c6348-a6fe-41b4-9a93-1e89983acd68", "sighting_of_ref": "indicator--6924ad34-31bc-4b32-bbcf-70c1d006eb6c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d541fa9-f977-4452-955a-87d3451aa416", "sighting_of_ref": "indicator--9cbe1643-ec23-4864-8210-314273433b8c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2bb536b-2359-4a53-b279-8507fb668c05", "sighting_of_ref": "indicator--3d743014-e45d-47dc-98cf-dc9e67d99652", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57dcaf85-7d78-40b7-9c13-e9ecd5a58fa8", "sighting_of_ref": "indicator--3f2f64d4-be6d-476a-a8ec-be9ec9afdc00", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddc2e214-17fa-4b57-a1a3-4c5f8b2f8166", "sighting_of_ref": "indicator--a177d95f-beb7-4c74-b63d-95744184b979", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65b2f1ff-9359-4420-aebc-c53daafd919b", "sighting_of_ref": "indicator--78123f44-0803-4f6e-84e1-863edf2910f8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1947d17-fa09-4a5a-97a0-41d41d6cb66e", "sighting_of_ref": "indicator--ae1bed9b-130a-4859-99ee-1ce954070965", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cecd279b-13d0-4863-9c2c-e2c417a8ac81", "sighting_of_ref": "indicator--725d33b8-3c27-4888-a3e7-0874d9bea2db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d6cd712-ac54-45d8-9cf9-ab14989be2b1", "sighting_of_ref": "indicator--725d33b8-3c27-4888-a3e7-0874d9bea2db", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34f3f39d-dfc3-4fe2-ab01-9f2a76a0588a", "sighting_of_ref": "indicator--4f7cc82a-2809-40af-b0ff-c1e67c7b48d4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9adf796-e8df-459d-b525-569c3f8ef6ad", "sighting_of_ref": "indicator--ca6e48f1-4a32-4af4-8af4-49882c781173", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--509a33d2-e74e-4f50-8b6d-671f63cc6304", "sighting_of_ref": "indicator--04972831-3fab-4e7f-ab70-7c37dcea7cbe", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7ad791d-e369-4acb-ad2b-d432f97cd56b", "sighting_of_ref": "indicator--f6cca4d9-08ef-4a16-afa4-b085deb46964", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc668eb3-3aa5-4562-8b5a-9a142cadda88", "sighting_of_ref": "indicator--337fe26c-9e61-4c17-8eb8-48097aabde23", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ff08e5d-4f08-4236-800a-99051bde02e6", "sighting_of_ref": "indicator--e23bcded-8eb5-4719-bfd1-6b2152b48b12", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0c552de-3f9b-405c-b97f-a0388baf779e", "sighting_of_ref": "indicator--de08c53f-e48d-4582-8c0e-5cb6119e3069", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4fe62b3-c2bc-4560-9620-38920099a777", "sighting_of_ref": "indicator--de08c53f-e48d-4582-8c0e-5cb6119e3069", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d74aa73e-6e3f-443d-b148-e4930adb2c57", "sighting_of_ref": "indicator--b2e519f7-d946-4bae-8bc2-8e0489f88440", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--163108ee-0b24-465c-a2c5-8948cd554e5a", "sighting_of_ref": "indicator--20663682-5a0f-4b60-a7ad-c71817001c14", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ca98858-a74d-4e6c-9eaa-913b509a378c", "sighting_of_ref": "indicator--9fd5ac70-a9ce-4ebf-8470-e9f70c51e3c9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4befd9b8-cc66-4c24-8cf5-90adc73bf22e", "sighting_of_ref": "indicator--bd7748e3-646b-4889-bfef-2852de7e4866", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9367b989-d346-444b-891e-362b31092c45", "sighting_of_ref": "indicator--bd7748e3-646b-4889-bfef-2852de7e4866", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1d89486-3060-468a-b480-c4939fdc5a46", "sighting_of_ref": "indicator--68710899-0033-4600-bf4e-91e23c293a12", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dd4cd5b-b42c-4f9c-a02b-fd00819a65c1", "sighting_of_ref": "indicator--a4d14e74-8b00-453b-b7ff-cd1c1b1f6438", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9160df9-a2d1-4119-89a3-aa23d51110fa", "sighting_of_ref": "indicator--14642c52-ddcb-4d2b-912e-846f64e0f381", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f7b2301-d344-47d0-8630-6daa106b94be", "sighting_of_ref": "indicator--8e50080c-b3f8-4f44-b3f5-40583e9e18b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea5b32f2-0600-42c5-9ab5-4cafbea45554", "sighting_of_ref": "indicator--627672f0-12cf-422e-bece-e9a1abdaea7a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fff3f3a4-479e-499f-b346-010ad155818d", "sighting_of_ref": "indicator--70656450-d76a-43ab-873c-ec61b1fc845b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a77eb9ff-039f-44c1-b206-7615ed567295", "sighting_of_ref": "indicator--ae584ef0-747d-40af-b100-e47cea9ec2d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--926cb16d-89da-4c44-a485-4dce61a608df", "sighting_of_ref": "indicator--16b43abd-7392-432d-8a75-f57daa1750d7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed74a861-89aa-4af3-aa6b-0def56330f39", "sighting_of_ref": "indicator--7a64cb97-48bb-401b-94e1-eb424e65c1b8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39235bb2-5573-4e48-ae51-41dfdf424a94", "sighting_of_ref": "indicator--36e191c8-9d6b-43cd-aab9-38ab52791158", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74faa204-2b38-40a3-bf30-07d349385248", "sighting_of_ref": "indicator--36e191c8-9d6b-43cd-aab9-38ab52791158", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79ad5bd3-dd75-471a-b18e-ed785c7523c1", "sighting_of_ref": "indicator--e4f5b244-076e-4524-a4dd-43c3c7a6ef69", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9a2c20a-5998-4dc5-ad05-732674d62284", "sighting_of_ref": "indicator--c4a3e293-c239-4ff3-83c7-8ba8c1616e8d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f60e0ad4-24b6-4cf2-8dc4-ebc95ca51642", "sighting_of_ref": "indicator--0c722fdb-cebc-46ee-a5da-ed157f9a368f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23bfb1a6-28db-4566-9efd-e30c1649e6ae", "sighting_of_ref": "indicator--94b8403d-b748-4575-993b-a6274d32b6bc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e340e96d-4e26-4311-8e21-51d1d6e2a3d5", "sighting_of_ref": "indicator--fdde8e2f-1b71-407b-94c3-ecaabb3326c8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb9df458-d0e2-4a9e-a39c-a2ef038fc779", "sighting_of_ref": "indicator--fdde8e2f-1b71-407b-94c3-ecaabb3326c8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fa7ca8f-168f-4d11-8b11-bfba563815bc", "sighting_of_ref": "indicator--7c5f118d-4d1d-46ba-b360-83ccbdc7c1c6", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09f92dfa-444f-453e-bf63-7c1e96d1d495", "sighting_of_ref": "indicator--faf48fdf-a52b-4ed8-95cf-e0af03f80769", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3547df4e-f7e4-431e-9e21-fa3f107e46b3", "sighting_of_ref": "indicator--c2b4b939-c713-4170-a264-929bbbbd178c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e600a010-f932-4de4-bcb1-be879391b963", "sighting_of_ref": "indicator--aab73c9c-7a57-49a6-b0aa-8f452df46fdb", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49846552-6bf4-4354-b12d-1f3aa6fbabfe", "sighting_of_ref": "indicator--16822ae6-bfab-4765-896a-72d0ee733573", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d93a9f5-30dc-40fd-bc42-33b1d6ada435", "sighting_of_ref": "indicator--e0c68ef1-8184-4b0e-a8b5-46b1d5a8acfe", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--244e1ee0-a492-44bc-8e79-dd41f663739d", "sighting_of_ref": "indicator--99a4a229-ce5e-4f85-8fe4-812506817bcf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e16bb6f7-3d92-462f-9e44-567ca46d1369", "sighting_of_ref": "indicator--cb3d3e86-b420-48dd-93f9-2c2c11c6ba6c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27f62a13-d90a-41f8-b765-ce1c25e57c89", "sighting_of_ref": "indicator--1024c244-cde8-40a5-bebc-51cee42eac1b", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfbabc1c-c0af-4df4-a9be-81f69672690e", "sighting_of_ref": "indicator--dab987b3-ed27-437d-a6e0-2dc49b2b777f", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04d7e101-6025-4f8d-84d8-fcb6cce32e2e", "sighting_of_ref": "indicator--4b8079b3-cb1f-47bc-b65e-5e8310ea3435", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf25ceb2-5c3d-4228-8224-5b77ffca9cc1", "sighting_of_ref": "indicator--8a67ec18-edde-47f2-bb50-c6472278f2d4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df0c6184-e3dc-465b-91c2-228f04e8abc8", "sighting_of_ref": "indicator--22d5e809-de1c-4700-990d-89478935c90c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7cf085e-1b25-4bd8-96d5-34048dcfb3c8", "sighting_of_ref": "indicator--893f456a-065f-47c2-a0f5-d5a2618b70c3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92fd3936-c46a-45c0-9415-e6f91b9b7a7a", "sighting_of_ref": "indicator--f4a91ac5-3016-44ac-90df-2006334f8f80", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45fd9220-6826-4bf4-af49-7d6a0393c893", "sighting_of_ref": "indicator--f4a91ac5-3016-44ac-90df-2006334f8f80", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e08a6406-34ea-45c1-ad57-b4c848c930c3", "sighting_of_ref": "indicator--af5ffb82-3f59-4228-a13b-e385e84d0c63", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3ac434a-e875-44d1-9a9b-3404ddee3ab5", "sighting_of_ref": "indicator--8ec93c29-cf48-4c2b-8582-8bfb1ed68a18", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41ddc27b-a4c3-41ae-8250-638037c813d4", "sighting_of_ref": "indicator--7eb3b033-9e77-49f7-8ba0-f8923d7aa3ef", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6c44ec8-85c3-453d-b610-415214ed65cf", "sighting_of_ref": "indicator--e654b140-3860-4546-a56c-b4828c7d3aa2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--904d8bbe-ad43-4199-828d-d3470d69d522", "sighting_of_ref": "indicator--70ebaaee-6b0d-457a-9907-3e5731ac1be6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70329418-832e-440f-9182-ff14f231c48f", "sighting_of_ref": "indicator--20c5893f-e7b4-4691-bcb2-f409d98e3832", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7e83ed8-e5a9-45b1-bac6-1c3f8bab86d3", "sighting_of_ref": "indicator--0c2ef05b-50a6-46ba-a083-e0a7cb56a75d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a21218f9-d03b-45a0-8592-ef5c502b270c", "sighting_of_ref": "indicator--9110fed1-5607-4c9e-83ee-911aa0046292", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f5b3e43-b848-46ad-8e6e-db1ccfcf617c", "sighting_of_ref": "indicator--116c0e1f-6504-40fc-bb07-1968ef5434e8", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a899d56-da38-44f6-a804-c66cb99658dc", "sighting_of_ref": "indicator--d73ab2d9-ad23-455d-a306-80b2d212e7fe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6e19ab2-9615-4615-b88b-b005d1b2e87b", "sighting_of_ref": "indicator--f00ea6d1-9e7c-43c7-9f2b-731a5d54e7b4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de3a025d-f8df-4409-80dd-9530103c11a5", "sighting_of_ref": "indicator--80a156a6-8523-42c6-bcd7-37a62ecfa074", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b14dd292-38bf-4294-8e91-069898315b91", "sighting_of_ref": "indicator--013a4f62-c699-46f2-83e5-997c859c7ea4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7684a0ed-d9e7-4eb5-8387-a0a582f3f11f", "sighting_of_ref": "indicator--013a4f62-c699-46f2-83e5-997c859c7ea4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c92cd8e0-b060-4884-8cd2-113bc4b43008", "sighting_of_ref": "indicator--332a8d5c-92cb-4f84-8c48-8fc61443b5c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f9b6fbc-b5f2-4327-a4a7-4e810213858f", "sighting_of_ref": "indicator--b7c7429e-c112-4ea3-9a0f-d694586a1bc7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41aa204c-8c00-4f8c-9a5c-12a4def8da17", "sighting_of_ref": "indicator--cff8bfc1-c6d3-4ee2-b0f8-964e51e6e6c4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f28a25a-6d62-458b-b162-2164992e7cf1", "sighting_of_ref": "indicator--262bcdd8-122e-4ebf-9a50-bbdad32c2122", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4d5f2fe-a9d4-4ac3-85cf-e1b0ed2d07cf", "sighting_of_ref": "indicator--b9a7457f-fbd9-4377-aa1b-6843d897b317", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fa4bb95-b1ff-424e-95af-894219dd5d59", "sighting_of_ref": "indicator--d412704d-3b0a-4d37-abc3-c5f04638bf60", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff7d3961-6d08-4b94-b054-fc1a494d1465", "sighting_of_ref": "indicator--b0830938-d84b-426b-a749-32432be3b2aa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77303f2e-3187-419a-b5b8-44bcabefbf2b", "sighting_of_ref": "indicator--9576cfab-edab-4fb0-902c-704735d9e341", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c899d35-922c-4217-ad16-a76c8c1ea3ce", "sighting_of_ref": "indicator--63308886-ba20-4216-ad72-97c00d58aa87", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22d6d6fa-d739-405e-8248-24735c382baf", "sighting_of_ref": "indicator--2279100b-8a07-49ca-b9bb-3e51c333d936", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af624f08-507a-4aa1-b7e8-4e5f5ad53b93", "sighting_of_ref": "indicator--a9a23b0b-1547-4d8f-a56f-27dfd05b2fe0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae61dba0-f19c-4dfa-988a-f9d0ada2fc73", "sighting_of_ref": "indicator--ff6478ba-96a0-465a-b675-3b7324fc4c3a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c72937ee-4b5d-4d74-84b9-2ca81fd02817", "sighting_of_ref": "indicator--9426d34b-c212-4560-9533-0306cbeb3b9f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0a90108-336b-44d7-a55b-a3b947852460", "sighting_of_ref": "indicator--929b1293-7354-49d5-9f32-f2bb47f40fdc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aeabdf29-88b3-4d30-b58c-1df178282bab", "sighting_of_ref": "indicator--93376726-d1ff-46cc-893a-5560035e56b8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03bd50d3-07f7-4708-8240-ab5880f3196b", "sighting_of_ref": "indicator--e7f5edb2-a181-49f8-bae7-a66d83526aea", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--766eaf2f-c187-4384-8209-bf82bb32f066", "sighting_of_ref": "indicator--c678caf7-f0b9-4b02-905e-c0cd7936d390", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f64011ec-a1af-4df2-8bd0-2c21898353b3", "sighting_of_ref": "indicator--7b5c7fea-57c1-41df-af61-9a29c3180672", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63426be1-e8a2-4eca-b213-15398a549691", "sighting_of_ref": "indicator--7b5c7fea-57c1-41df-af61-9a29c3180672", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3ca2458-ddff-468c-a2e0-11c71a56c88f", "sighting_of_ref": "indicator--581e534d-5071-46c5-a2dc-f52d47b45739", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34840569-ae49-4bbb-aae0-8f40cabc4a01", "sighting_of_ref": "indicator--7804e661-a40c-41ac-b286-473b4559ddaf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b618c02d-5c02-4e18-b5dc-942335755735", "sighting_of_ref": "indicator--07ad955d-7874-4ef9-8653-9b0d33db01e7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdda47ba-150e-49b5-9a3b-a642dda103c6", "sighting_of_ref": "indicator--ff47f73e-81ed-4b03-96b1-b53a8504b67f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7ebc267-2103-4327-b6f2-08d27bb094be", "sighting_of_ref": "indicator--ff47f73e-81ed-4b03-96b1-b53a8504b67f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02a5fdf2-92b6-45d8-a73d-739cdcfac905", "sighting_of_ref": "indicator--4c36b322-855c-4df1-86ee-a11817658a49", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c698e39e-f83c-4f48-a67d-f4be2ce6ccd5", "sighting_of_ref": "indicator--b2029ee3-8250-46cd-a4e6-b70cd4ab310c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b97d54a8-ab78-4876-9989-7b6b0e117473", "sighting_of_ref": "indicator--b2029ee3-8250-46cd-a4e6-b70cd4ab310c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c87ce4f5-0fb1-413b-86b8-4cb98c30fdd9", "sighting_of_ref": "indicator--e764159d-1bbd-4794-aa81-e6d04497170e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a8c9be5-6b24-4942-931c-0e65d15ee9ab", "sighting_of_ref": "indicator--fd90f2a1-8009-4b96-8912-d4951076b1d1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6942347-7a3e-4ea8-922c-e82a16794b99", "sighting_of_ref": "indicator--b54c58c2-abf5-4c02-976c-ec1f5749a112", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--160c44c7-c357-4ee9-83a6-d54ec36b49e5", "sighting_of_ref": "indicator--ada0307e-be2d-4924-afd0-7c82e5bf4320", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--350e38a3-4f44-4afb-939a-4f8df1cd4e69", "sighting_of_ref": "indicator--ada0307e-be2d-4924-afd0-7c82e5bf4320", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a6b5a78-e200-4303-8438-97439feb9323", "sighting_of_ref": "indicator--f54e5ba4-6a02-4c9b-89b3-71a4f2dc27fd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83b34502-80d8-47d6-95e4-3ac6d0efd553", "sighting_of_ref": "indicator--7724655e-8ff1-47d4-acb7-b26c6c63dcf9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a0355e8-4047-49a2-9310-f1d7e21c2384", "sighting_of_ref": "indicator--db9d2b4a-25b1-45d6-996c-85b7551fbeac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79fbfa9e-36cf-4ff5-9ddb-d01717a4ed25", "sighting_of_ref": "indicator--566d7966-e794-4f68-a1b5-113a0dab6e3a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11307e75-55cb-4bb3-b228-e1031db68abb", "sighting_of_ref": "indicator--3b84a8c5-dc26-4f68-9ae0-e22fd126cc0a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--545802fa-0dde-44b5-b1e4-602d3ceafc59", "sighting_of_ref": "indicator--f31d08b3-3ae6-4816-93ac-0cf2840ac829", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0246975c-34d1-48d3-850c-adb82633b069", "sighting_of_ref": "indicator--ecb578e7-6a90-4387-8306-f991e225c521", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f63dfd7-092a-4112-a018-1e898c1d8ab4", "sighting_of_ref": "indicator--248c01ff-a758-4db1-b7fd-637c94c5ffda", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8afb1305-d6d2-486b-914a-6eb71ff95836", "sighting_of_ref": "indicator--f86c5b86-64db-440b-98d5-6a3c6ca6ab26", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--486554a1-be85-455e-8e76-1c9e303ff468", "sighting_of_ref": "indicator--c587b24d-f9eb-43dd-9967-96adab104412", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2961486-c7ea-477d-b9c3-87e6ec39f22d", "sighting_of_ref": "indicator--e51cfdf6-3340-4b2a-90c2-d51ee6642935", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69787b3e-d1ea-4971-998a-3c33650681c4", "sighting_of_ref": "indicator--e51cfdf6-3340-4b2a-90c2-d51ee6642935", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc377adb-82c1-478c-a60a-fc2163e8f6d4", "sighting_of_ref": "indicator--dfe56700-2b87-4c62-8937-9393d6d4350f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--378514c5-d8ac-4d67-a424-0634127077a3", "sighting_of_ref": "indicator--dfe56700-2b87-4c62-8937-9393d6d4350f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e9e031a-71b9-4ae3-968e-2b465e2fcdb2", "sighting_of_ref": "indicator--301e0ef7-4aae-49de-ac10-a98d7210c596", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccf5b967-1106-412c-a673-bb9e71be6654", "sighting_of_ref": "indicator--b64ddf5e-7119-4209-b681-5483a00c6bd7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38c57151-d9f1-4d53-a0be-3859c59f39a0", "sighting_of_ref": "indicator--38d85689-a74a-4710-9d5a-6dd150dfee79", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9a3e10c-b56a-42d1-9be3-c6d5aeecac72", "sighting_of_ref": "indicator--83462aaf-4bb4-4f33-9344-fac27d77ab01", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e1c90a8-44db-4409-8570-a6b13b95f726", "sighting_of_ref": "indicator--83462aaf-4bb4-4f33-9344-fac27d77ab01", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49bc9d38-fda7-4803-b258-d755ca3ca59e", "sighting_of_ref": "indicator--3edaeaac-7b75-469b-b643-1acfacfc3fd8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5cdbd85-0bb6-42bb-a824-83c90952630d", "sighting_of_ref": "indicator--490534e4-599f-446c-ab97-5863b82dc9a3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--803aa51b-894b-4e27-8eb5-24602a428049", "sighting_of_ref": "indicator--d38ad603-c613-4eb5-a029-22055f0415c3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2e2c1b4-4b92-473b-a751-3d701875899d", "sighting_of_ref": "indicator--01c5e66f-dbea-4f5f-8622-badf52a08cdc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--329434e0-84eb-4f94-bc72-d1694a656f2f", "sighting_of_ref": "indicator--5d6a1594-6069-465a-bc03-cf6a174a4a1f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e79a84fe-312c-42cb-961a-470bf448d607", "sighting_of_ref": "indicator--64f1489f-1070-4de0-8053-53c745ffe57f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38bc419f-fb5a-40a6-a155-e12e3f17e812", "sighting_of_ref": "indicator--64f1489f-1070-4de0-8053-53c745ffe57f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4409b7f-b4bb-4b89-abf5-b2849194adef", "sighting_of_ref": "indicator--cd4bc813-215e-4a94-936f-48a79153e509", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dec6ee1-8e51-48f1-8696-f08d362e43e4", "sighting_of_ref": "indicator--9fa76d53-43ce-4001-bfa7-9a60f0876487", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af3925ba-0bcd-43c9-bfa4-96f89aa2ee09", "sighting_of_ref": "indicator--26cf72eb-20a9-47ff-ae82-dac2dda1fe85", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee22c3a9-7c71-41a5-82dd-1b7f96be31fd", "sighting_of_ref": "indicator--4d1ccb1c-95c9-4e0a-a09b-31cdba78354a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40cd3c65-457e-4ef9-bd99-35892c68fcde", "sighting_of_ref": "indicator--dc93f491-2c3e-46fa-b122-0832da86c039", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--078a947d-7ee5-45d1-99e2-aa7bbf35fe9f", "sighting_of_ref": "indicator--ae268782-8a28-4c81-9e93-fb056c3084cd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72cbf3e6-7e31-4894-b213-f4dc4cd51936", "sighting_of_ref": "indicator--ae268782-8a28-4c81-9e93-fb056c3084cd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bbdd821-e650-436e-9c58-61a56f913d54", "sighting_of_ref": "indicator--7538c816-bc6e-4931-8c12-a77159f16d98", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3c55ba8-200a-4962-80d6-2d24b2c3ce2f", "sighting_of_ref": "indicator--db83456c-987a-4172-902c-4c926b39e1e0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf545796-27bd-4876-a1e4-cc5f5f9f9ba5", "sighting_of_ref": "indicator--beb4d1d4-20a4-46d9-8b61-d4cb6a78b73a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--775c9097-c5aa-4303-bc1b-0e0ac4f5f16d", "sighting_of_ref": "indicator--7c31dab0-bfa4-4a98-a894-a96f5a9f37cd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6a149dc-dc02-4225-8453-c9a5863c46ab", "sighting_of_ref": "indicator--a144784d-017b-453f-b4cc-4c316ad94571", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41007e3c-ae20-4516-be57-a6226bbaec58", "sighting_of_ref": "indicator--55de6da8-eacc-4a2b-942e-eef03d83d0cd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c64f457-fc28-4ea8-af2c-86cc2d24c42d", "sighting_of_ref": "indicator--f19957af-c5d6-4f8b-a5d9-2292c92a7750", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e68134f2-f0ec-4f0c-ba91-eb13f8be80bd", "sighting_of_ref": "indicator--06abd6f4-d2af-4a2d-8a17-ffac8e62d1d1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6167f079-8a1a-4ae8-905d-c5e96118354f", "sighting_of_ref": "indicator--a3225b09-ed9f-4f26-9cfa-cf075d6cb253", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74bbce0b-5294-40dc-a53a-04545629ce1f", "sighting_of_ref": "indicator--35f67723-f69b-4642-871a-246312500721", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--248741e1-f4ac-4bf8-a98f-3c9550e1c71d", "sighting_of_ref": "indicator--f31ea476-c9f2-42d0-a43e-c2a0fa9d5152", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b79b3baf-2028-4cf4-9344-1082e2a86d31", "sighting_of_ref": "indicator--c5af9508-a993-48c3-81c4-521382259628", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c230e8f-a4d1-432c-ae3a-7b29dfb76e38", "sighting_of_ref": "indicator--4a3a00b1-4950-4be8-ac73-ff6409d2d633", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a44d228-3c6e-4686-8d37-d8a4c9133d84", "sighting_of_ref": "indicator--b8f87879-223b-4b58-93af-e9317494800e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64a79d31-5ab3-4fba-be6c-25e008b15ed7", "sighting_of_ref": "indicator--e48cf900-ad0a-4f7a-a5b8-f35ff87d5dca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69b0ac20-bac5-487a-985b-2b93a1125960", "sighting_of_ref": "indicator--0466eb16-fbe1-4410-bcd6-7c924ea7534f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--118b3682-f66f-406a-8ad8-f0810a480c99", "sighting_of_ref": "indicator--e6450b95-c292-451b-be20-a209c2add453", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d263f0d1-cbe9-483d-83dd-7f2d23c84967", "sighting_of_ref": "indicator--eb62a5f9-7cca-415c-9a3e-0ccea677794d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e7b2cae-0011-486a-bd3a-e5ed7e014a42", "sighting_of_ref": "indicator--8d465b33-d83e-4a6f-b587-6613b7cb8f1c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5e38f59-e25a-4f04-8d87-ee295b5f3307", "sighting_of_ref": "indicator--23ef5283-3dba-481a-89be-6a2b3012af21", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0c3a670-35e1-45b1-b54c-72ac07a63bcf", "sighting_of_ref": "indicator--23ef5283-3dba-481a-89be-6a2b3012af21", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e51ea2ed-7482-4de3-a55a-6b661873b33b", "sighting_of_ref": "indicator--71387943-2fa5-4b9b-b1ad-072cf3d56089", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--708dee89-20c7-4ff8-a1a8-557fdac92212", "sighting_of_ref": "indicator--9dc436de-7df0-45d3-96d0-e491ec39c25f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37a9fb6e-791e-4205-8f1e-c7ace6c50cca", "sighting_of_ref": "indicator--16ef765a-c989-4842-8a55-d9aa24787cf9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f007650c-4f4d-45e4-ae65-95b05304ca6b", "sighting_of_ref": "indicator--fd6f75d6-ee8c-4a37-8c57-d5d0bed5d5c0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1885d762-03c0-4a6c-9edd-b6956edcc338", "sighting_of_ref": "indicator--3c0d3ff4-590d-4758-9370-110aa3d421eb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79859926-eb68-4965-83cb-b517b4921fac", "sighting_of_ref": "indicator--54c973f9-c0d7-4aed-aa82-3dbb771b1efc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12fc186f-6437-42ad-941c-dc35d345ebb0", "sighting_of_ref": "indicator--55f7f4d7-a8bf-4c0a-88cf-be96f8cbc8a9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24c52793-f2b2-4c9c-a3fd-2d3a7405d5b6", "sighting_of_ref": "indicator--221c1acc-0525-41ed-b3f6-c8242c5e1809", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f3df9eb-9dfe-4a93-abf5-b81bc77aa0a4", "sighting_of_ref": "indicator--4429dd0c-d75b-4c6c-acf4-03f915c10bf6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--590423f7-6090-4f1d-b546-5f79b64d0c30", "sighting_of_ref": "indicator--4429dd0c-d75b-4c6c-acf4-03f915c10bf6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--515b2398-f01d-4417-8615-9a5e796da43f", "sighting_of_ref": "indicator--2b568996-9087-4f19-9622-c1fd9e4c6485", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af6b9230-a736-4a98-a38a-5f424fd8d3a7", "sighting_of_ref": "indicator--c792f6dc-80df-46c6-89e8-c310f9844810", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--090f8355-a93d-4f0c-9d47-5c19a65c238c", "sighting_of_ref": "indicator--61d10d37-5c53-4289-92e3-4f79068800a8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9062e8f7-f777-4864-9377-1b5ec34bfff8", "sighting_of_ref": "indicator--ccbd6af9-7d4d-440f-aa1c-4e7dea3d035a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a689b45f-59b3-464f-83cd-5688c5915961", "sighting_of_ref": "indicator--82644d44-27f9-4118-a98e-54ce77521846", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76247f07-0f87-45c5-82a7-a60e6a01c95f", "sighting_of_ref": "indicator--7a91c668-f7ba-41b7-b745-d9d4d0dae416", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21827e1f-a891-45fd-af58-1758b23762bf", "sighting_of_ref": "indicator--ab861fd0-3310-461e-a23a-239f75589ca7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3040b9ab-4191-4208-8bc2-1e2c7f449570", "sighting_of_ref": "indicator--c89bcb55-4a39-4f26-90ce-dc551db26d6e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--311db150-2a0e-4a9c-96a0-7ca82ef45557", "sighting_of_ref": "indicator--1814c6b8-be38-4944-980d-e7639626379c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36e8f73e-f8a4-470d-9c49-f533605861ef", "sighting_of_ref": "indicator--b4266fd0-cf9d-4bc4-af9b-3778d3ebd724", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9757ca96-88a4-451f-96d5-28672f656383", "sighting_of_ref": "indicator--b4266fd0-cf9d-4bc4-af9b-3778d3ebd724", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--723eb3f2-1dee-4348-a075-99a2519284a7", "sighting_of_ref": "indicator--d3022166-e085-42cf-b598-667f7378769c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daf435a9-aa9d-499f-911b-cf27d84478c4", "sighting_of_ref": "indicator--d3022166-e085-42cf-b598-667f7378769c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3727e7c8-6cfc-4a0d-98b7-2004505cff78", "sighting_of_ref": "indicator--da6c38b4-3c9d-4c50-8822-f292a9069a01", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1515843b-c8a7-41c5-bf36-6c257f46b51b", "sighting_of_ref": "indicator--69fec9e9-0cd0-4f38-b496-ff05ad762519", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89c46b59-d735-4eb0-8129-b8581162614b", "sighting_of_ref": "indicator--69fec9e9-0cd0-4f38-b496-ff05ad762519", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1caa3cc-8a4c-45c6-958f-467f056a3b95", "sighting_of_ref": "indicator--a618e001-3140-4d8b-bd5b-0833a77a7ecd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--569eabfa-06a5-4388-87dd-efd959229458", "sighting_of_ref": "indicator--4332e1b8-9471-41ce-9b08-f01b79a96164", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a09b507e-d598-48bf-9038-5d9a765090a8", "sighting_of_ref": "indicator--d26bf38c-e797-4b8d-a35f-030328d9536d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0946f140-7340-4bd8-b20f-340c2023f95f", "sighting_of_ref": "indicator--dd3693d4-c672-4290-91b2-19a47c9478b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01e3b4c4-bd4c-45b5-ab3c-8f8feecfc1da", "sighting_of_ref": "indicator--dd3693d4-c672-4290-91b2-19a47c9478b7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4625b983-34ce-40c9-92a7-f5d94997e761", "sighting_of_ref": "indicator--fd4e434e-b46d-42e2-b34f-5b0ba6b1d109", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02d9f200-330d-401e-b4e7-35339df63e77", "sighting_of_ref": "indicator--5511a827-22d8-425b-bc68-d1f1d1c717c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d1a1d6b-214f-4854-bebc-5014885f8481", "sighting_of_ref": "indicator--0b71ca79-2ecb-48f5-8a1d-27b94c12f18f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce9adcdb-7bd4-46be-b42b-afe7f8c3e078", "sighting_of_ref": "indicator--e1ba056b-e0e8-498b-a941-2392cb445d1d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab11d531-e816-43a7-a29c-dec5de5bb55a", "sighting_of_ref": "indicator--b03b8508-0bd9-4764-af91-422e6ab043d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01863481-5527-43c7-a458-5f92af4fd659", "sighting_of_ref": "indicator--6bfa0031-6311-43ad-9a60-46bc7db1bc83", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d522c32-4049-4d44-9755-47f59c1e35e2", "sighting_of_ref": "indicator--6bfa0031-6311-43ad-9a60-46bc7db1bc83", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8ea70ed-6d0b-4929-abbe-de514d7fafe1", "sighting_of_ref": "indicator--7eb7502d-9858-46b6-ac2c-ad177a51111d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--781b77b6-d840-4fca-b7f0-d2f9fa36eb74", "sighting_of_ref": "indicator--8f94a28d-1700-41ae-a72f-a723c2766c2b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9882b07-0b40-4fe8-9769-ff361a442994", "sighting_of_ref": "indicator--e26c9fb0-ab4b-4508-8a78-40ee72577618", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bc6a5fb-4354-4cae-83d3-ed5bc771d80d", "sighting_of_ref": "indicator--3c80c72e-52bf-461b-bf04-f6b7b5bd0a6a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b35e64f-953f-46a2-b339-1db3e66d6aba", "sighting_of_ref": "indicator--b74dc6f1-2cc3-46fa-88b5-d7aa5f3f8b91", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da6d6e37-28b5-43da-b82f-762c8e433ab0", "sighting_of_ref": "indicator--894d5ccb-9f68-48d3-95f6-e6ed9a75ee8a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2def2846-5367-4846-9123-e6436e977e21", "sighting_of_ref": "indicator--44c87cd3-5781-42dc-8b26-b4ae2ff0fe63", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc5130eb-51f0-4584-919d-f774cd0c817f", "sighting_of_ref": "indicator--0ef81808-8dee-41ef-8ba1-2550642b3bad", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e93d036c-1fb5-4306-b760-3b8b9ef6af4b", "sighting_of_ref": "indicator--2e0fd8de-fce4-4f94-bda4-8e9c369f1693", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5bd070f-11a6-428f-ad8e-c56429321b2f", "sighting_of_ref": "indicator--daf39418-79cd-42a6-958d-2e01c102be46", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b6400ce-65df-4486-9dc5-fa03dad76f21", "sighting_of_ref": "indicator--0db01ede-ec67-458e-ac04-b97641c84645", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6589c418-819a-4b55-a43f-b242a542f786", "sighting_of_ref": "indicator--fbf8630c-3a79-4e6a-8b16-f197f6f2b919", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e92507e-ac4c-4187-a8e8-6715639b0dd1", "sighting_of_ref": "indicator--854dbab5-75e1-4393-b79b-c8a1d8397b5e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85e50022-938c-48fa-b470-42caa0d1b7d8", "sighting_of_ref": "indicator--486293c9-64be-4b37-a216-0f9df6de4ebf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7ab5ebd-8914-4119-99e3-f4954de08a15", "sighting_of_ref": "indicator--33de0d57-88b7-41d3-b3e4-47af99f92c83", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b84c96ab-2d08-411b-a476-d3c5a15d76ad", "sighting_of_ref": "indicator--4fed9258-5038-44eb-bf31-32c3d12cb436", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05bed809-abd0-49c4-8f18-4cc503bd006e", "sighting_of_ref": "indicator--e1cd9bb4-e539-4fb5-8447-c814e2f70571", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63a6f5ac-773f-4f5c-82eb-d6478d4e95cc", "sighting_of_ref": "indicator--b8780d6f-8fdd-435d-a287-83769e8d0f3e", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d299775b-c167-4bb6-9f20-715a776588b5", "sighting_of_ref": "indicator--21f5a11c-fe98-443e-95d8-9c4fbc96f5dc", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83297ec5-97cd-4da6-b5a9-ed87cd040eed", "sighting_of_ref": "indicator--25e52fed-83aa-45a6-98b2-cb25c1a017c3", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9281422-ae80-4c5f-9054-1f7302fca9dc", "sighting_of_ref": "indicator--2f3ce5f1-490c-41ab-ac1b-1f045c47469d", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5d7eac2-5990-40fb-8db0-d89cada0ce51", "sighting_of_ref": "indicator--d8721686-ee7b-4a1d-a655-704dd64a693d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--821449bc-f51b-426f-a6b1-6cd387f3d809", "sighting_of_ref": "indicator--d8721686-ee7b-4a1d-a655-704dd64a693d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83243961-b295-47ad-ba58-19930a313411", "sighting_of_ref": "indicator--a7e3516b-d9f4-44e2-b01f-e166433c3de2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37035d3e-72e4-497c-a86a-b5dbc427a3ee", "sighting_of_ref": "indicator--16082ec6-29c6-4b1d-886d-40d516f43078", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--414f3965-9f9b-446e-9d29-1dbf41959547", "sighting_of_ref": "indicator--a8438e05-3db8-4428-a8f1-4b094bf8b66f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7559f6fe-4359-4c0e-9a6a-155afff4047d", "sighting_of_ref": "indicator--75129d65-6a8e-49b3-8323-1fde0acde570", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63b2b7b1-26c7-41b6-95b9-8efb68c54eb3", "sighting_of_ref": "indicator--75129d65-6a8e-49b3-8323-1fde0acde570", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11991854-2fa6-4576-b8a6-ed9835b76a5e", "sighting_of_ref": "indicator--f1ea16c8-f554-4784-9f24-59297f4cf6f5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d3d7a8f-5503-497f-b8bd-937663c7e439", "sighting_of_ref": "indicator--27c14dad-6597-47e0-b6e1-84b5446f80bd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89cf2c05-29d9-421e-a40a-2f19a48cc876", "sighting_of_ref": "indicator--de407454-83aa-465d-81d8-1d4baa94287e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--433cd97f-0b86-491d-b233-7648e95b2897", "sighting_of_ref": "indicator--ae02c317-8b85-4333-a3f4-6e48e79f4802", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91c6fa24-0467-46f3-9d28-dcecf81d01a3", "sighting_of_ref": "indicator--4342eee1-4b0e-4b5b-95ee-1b24b794bdef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44851fe3-aee2-4d0b-adac-da82d303e6b3", "sighting_of_ref": "indicator--a77fe45e-1bbd-4c6c-9220-8f709de0fcf3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84271dda-040c-48e6-8e2e-890ccd9544ad", "sighting_of_ref": "indicator--50ee1bf1-b985-439d-92b9-b2020778d3a4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b01b44e-4335-44ac-8836-bbc4847c01ac", "sighting_of_ref": "indicator--191efb16-6bb4-4626-9a77-2c73feea10cd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d92e1936-3389-41ce-b01d-2b118138743d", "sighting_of_ref": "indicator--573c86cf-340a-4d20-980b-229e80798777", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--003ff7ed-1538-483c-a2e2-b5621875ea21", "sighting_of_ref": "indicator--4b9e9b85-d16c-4900-a354-b824223a8964", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0ffc30d-8ccd-4478-a525-4dcac6c17184", "sighting_of_ref": "indicator--df1bd043-bc01-4563-97a5-17b3f615fd5a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--164d9fe3-9b42-400b-9441-38fe2ee787b6", "sighting_of_ref": "indicator--df1bd043-bc01-4563-97a5-17b3f615fd5a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--663ce199-18cb-47a4-99b8-893aa47e56b6", "sighting_of_ref": "indicator--6b983346-f693-4080-ac3f-6fb9f41c267d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa88adb3-3487-4d2a-a526-ec1788446e08", "sighting_of_ref": "indicator--23252421-d577-43a4-b38a-011dcf5187c3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80e0a5ef-e827-4d24-95e8-8f989121fc22", "sighting_of_ref": "indicator--9497256c-66f6-4cc9-bab3-16cd89590433", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb5b0b91-96cb-4a55-976f-f4b53bc13554", "sighting_of_ref": "indicator--91066ed2-0a5c-4d18-8326-01073ba75827", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7b3302a-90c6-4da2-ad5c-1c80283eb607", "sighting_of_ref": "indicator--274549df-c6a2-499f-bd05-e867cd5e9799", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb6fa3c2-d63c-40ef-8ab4-0aa8b4cf3b1e", "sighting_of_ref": "indicator--6b049e8e-f0f0-4024-85e0-1aa5dfb0c91d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c04c6090-ad66-4671-ae4a-89073538957e", "sighting_of_ref": "indicator--62e4318e-3afb-44f4-8a56-824be9089620", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--191eceb1-aeda-42f7-b291-3932fddd274f", "sighting_of_ref": "indicator--761e4620-900d-46d0-a01c-858e7ab226a4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--722481c7-d9f6-4dfb-bfdd-3f42d5b2b269", "sighting_of_ref": "indicator--a1d215d8-82bd-4deb-a094-8bfce4ad0920", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96dd6117-e83d-44f5-94b6-ad86a1ec840e", "sighting_of_ref": "indicator--41086772-ab1d-4217-8f75-86bcc20968dd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab46afe3-96bd-40e9-b870-1353e413c989", "sighting_of_ref": "indicator--c5b990f2-f94f-4523-9754-d5915ea1f841", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb80c90c-4e40-474e-9a58-5178a5cd5f0b", "sighting_of_ref": "indicator--217d6fdc-97ff-4a84-b752-c8edf0a8e864", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d815611a-87d2-4670-85d3-f266bbfdcfe3", "sighting_of_ref": "indicator--4d2f6b62-6347-428a-8c02-18c68f708977", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--371f5bea-45f6-4e86-8b9f-a16d49b38e27", "sighting_of_ref": "indicator--08a3a4db-9111-43ea-85c7-0d2fbd7a4473", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d9228a7-cd0c-4767-b8a0-685dd028482c", "sighting_of_ref": "indicator--7fce45e5-be05-4f0b-9959-e4e524ada31a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16249967-39eb-4edf-bf29-d34f84ccdb05", "sighting_of_ref": "indicator--7fce45e5-be05-4f0b-9959-e4e524ada31a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13077277-1b65-41a7-9bb0-06807a8acd70", "sighting_of_ref": "indicator--4b03aa89-f5cf-46f7-bb02-3fe9dc07af10", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa870000-8a27-4f78-a371-c4875940b38d", "sighting_of_ref": "indicator--9e6ff46b-a0b9-4696-936a-95b6437dc13c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e60045d-521f-4182-9f5d-0d9cb3602647", "sighting_of_ref": "indicator--742dc7c0-1d0c-4d49-a5cc-53928d9ce9f5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2c1202f-b2bc-4edb-91ca-bbb9ba6ff912", "sighting_of_ref": "indicator--a62fd911-f682-4b37-a84e-198ba4ff8681", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b9834dd-aee0-4fc8-8382-4132fb367643", "sighting_of_ref": "indicator--044116f2-bc03-4879-b4d9-73da54f05c51", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b9d61fb-8fa8-4c66-a785-2238c65fde57", "sighting_of_ref": "indicator--87218974-2272-4c9b-aed9-f37849514d1f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31c665a0-db4f-406f-8639-f0ce5b701684", "sighting_of_ref": "indicator--6fea9b80-8a24-4213-8e6a-96ac0bb79737", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d09c651-ea38-4ed9-97f3-5c6b624ac4d7", "sighting_of_ref": "indicator--30a6b6f0-cf71-4c75-9995-5b5ebbf6593f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99b00551-ec16-4f09-8d89-11746e1f1a22", "sighting_of_ref": "indicator--4c957f7b-10c2-4e4e-9905-47950d809402", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--874aae0b-8353-4ebd-b048-1ee77688382c", "sighting_of_ref": "indicator--f4648a02-2038-493d-a9e4-b15fe899f01a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a948ad5-44ee-426b-891c-9a1a9917c4c9", "sighting_of_ref": "indicator--22c7773e-b04b-43ba-bbef-4f05bb7d2a18", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adc4536c-c36e-4cc8-8932-a0ed41e5c159", "sighting_of_ref": "indicator--07953f06-42ee-48e4-80ea-b545087830b9", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36d8326a-a2f1-4c87-9922-d8632188ff62", "sighting_of_ref": "indicator--98d9112e-f26f-4d00-87ab-3a4c43bce6af", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ff8a3ba-05bb-4a97-b24c-8221a6133399", "sighting_of_ref": "indicator--93313e43-5460-42eb-9ddc-c330d797df58", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75f88bc2-f75d-48ff-b309-eae102e5ac1a", "sighting_of_ref": "indicator--93313e43-5460-42eb-9ddc-c330d797df58", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d040ff7-2c8a-43f7-b531-88c2f1ab1bd8", "sighting_of_ref": "indicator--76ab0d01-73f8-4680-9532-a05749474f99", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3dde0b2-e037-488b-bd76-6a3093003560", "sighting_of_ref": "indicator--389ccf55-1409-429d-84ee-e258a783481a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b97eb44-dab4-48d7-a08f-dbb0bb16f17d", "sighting_of_ref": "indicator--2d753a7d-d950-4cdb-87a6-73181f5af05d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a74c2bd-cacc-4206-b2ef-f11f09c79816", "sighting_of_ref": "indicator--364210cd-1c70-4ce5-8896-f48e3faf979d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c21b807a-6928-4bc0-81cc-d3182ac46e18", "sighting_of_ref": "indicator--e9f7ed6c-4b7a-4730-908e-13dba27a6c70", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c74f500-63bc-4fc6-88b0-202ab90bda71", "sighting_of_ref": "indicator--ffe204cd-3fa3-4690-9b46-d80a612626e7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b07ae55-4198-46f8-bf4b-37146596b41b", "sighting_of_ref": "indicator--ce70b5dd-dad1-4351-a938-23d0e3756c60", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ae4a667-0769-4a27-ad31-28bce29b5d41", "sighting_of_ref": "indicator--ae046115-c603-4ba2-9c22-9d50b11b993b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49d4dcac-a5fe-46a1-ac1a-fc98c1123be6", "sighting_of_ref": "indicator--3f385868-3258-4e0d-8c32-13992ee24e15", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26164046-0d64-4528-8220-4c8dfd6b6740", "sighting_of_ref": "indicator--aaaf7d38-6daf-4537-90e4-4099153a5d5c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7bd4c2a-941c-4bdd-9725-19bf71f2dd40", "sighting_of_ref": "indicator--239a6152-304e-4d83-ac6a-d730f1fb0742", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a78b1cac-344f-4d65-97d3-32a853de5791", "sighting_of_ref": "indicator--1b1fa7fd-cdb4-4107-be76-5ba224de5a52", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d91c061-9a39-44cf-a7f9-0cef25b84ce6", "sighting_of_ref": "indicator--bba242d9-9a5a-4e21-b222-dc5d7ed546c1", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f84a49e6-9769-49d7-8287-d7f93800936a", "sighting_of_ref": "indicator--4cfb6b12-168f-4c73-86f4-10bba95fe350", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aad4b87-40e5-4d9e-9fac-858dde1b0e18", "sighting_of_ref": "indicator--4c5e8bbf-4985-4d15-84f6-dcc5fd02068e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6aeabcd1-03a2-4e2c-881c-950aa647ab70", "sighting_of_ref": "indicator--2f74626a-d491-454e-a840-44869b599d26", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92073069-c017-4533-8327-cee1d917d0be", "sighting_of_ref": "indicator--ebaa9b04-1b77-4e84-bd03-04dd3c1d5f8e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddd2c7c5-c5ea-4a21-a135-cd9bc101d12c", "sighting_of_ref": "indicator--7f132b52-3945-4d0e-9303-e8d8b11c49ef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2778936-750d-461f-9a12-a24847a0487b", "sighting_of_ref": "indicator--8f97a228-4300-4203-8378-c03832b92aab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--405a6ac4-a949-47b2-a84a-a266e1d59d85", "sighting_of_ref": "indicator--c00a64e8-7035-4e3e-bf24-bad62faebe09", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5bd56ed-7673-42a5-849e-8e63666dc6b3", "sighting_of_ref": "indicator--25c166c2-5004-411c-b75f-a6af72a42907", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82d59a3a-9feb-4980-bd67-c2e3c09ecfe8", "sighting_of_ref": "indicator--8c9ab15d-d6ce-415b-b4e3-845888cf5280", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cca8e932-f8c7-4929-94a0-c200d8051388", "sighting_of_ref": "indicator--2609c7bd-de28-4cd3-aead-e82bbdebe790", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7fa5077-a5b2-4379-8f88-31e030bc208d", "sighting_of_ref": "indicator--5c9fc7ef-94c6-4a93-8cea-a619a2684305", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76db2c03-0dc8-431d-8303-094e153bf734", "sighting_of_ref": "indicator--5c9fc7ef-94c6-4a93-8cea-a619a2684305", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93bf6619-601e-43b1-9809-7f04cbfab69c", "sighting_of_ref": "indicator--0f0bb8f7-29a7-4e6d-9ba5-0f07064ba224", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6316a8e3-908e-4750-b617-5c97d3ff3323", "sighting_of_ref": "indicator--d0274091-ed99-43ab-a9f5-415ba8aea27f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38992810-483a-4c38-a5b5-7f091cd18da6", "sighting_of_ref": "indicator--a3b820cb-aef6-4ca4-a029-00b9300043ac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4fdb1d6-202c-4ded-89ef-8452728f2d2f", "sighting_of_ref": "indicator--a3b820cb-aef6-4ca4-a029-00b9300043ac", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41c324ed-30ed-4797-a7a5-780bf9c362ab", "sighting_of_ref": "indicator--004d8694-1003-45e8-b5e8-3887c8f11688", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1f5b783-60c1-4911-8286-3eaae12b10ee", "sighting_of_ref": "indicator--8b505514-2be1-401b-9e9b-dd1519fd9641", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81cca8bf-7971-45b1-9f88-c3f9c90d5e70", "sighting_of_ref": "indicator--8ed8a17e-4304-4f25-8089-e5e12399be4d", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--380f6cd6-8755-47af-a2b5-7a53759cb28b", "sighting_of_ref": "indicator--bf29b167-018d-443f-9875-9ef23f2c4c05", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e423b45-ec68-4cb0-a7d5-94837d02ac46", "sighting_of_ref": "indicator--b2ec020f-4392-4126-a9e1-35b635bdfc5f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68f19316-5635-445a-ad2a-c598f456ab14", "sighting_of_ref": "indicator--27ebf73b-6121-4826-a7e8-d22d160b9c89", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89b384f5-e308-4d13-9d2a-a184d6bfb8f7", "sighting_of_ref": "indicator--c9a38c9d-b8de-4972-bce5-e3e4c7ac597e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37d176a9-5ec7-4060-9183-0913b74cf427", "sighting_of_ref": "indicator--1f0c2f40-43d3-4463-9875-7abcf0bfd06d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f96a8f17-746b-4bdf-8c0a-fb08e3da1749", "sighting_of_ref": "indicator--003218bb-8f36-4020-89f4-e0dd5bc38c0b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01d15955-6874-4aac-b98b-a4bcaf1aec3a", "sighting_of_ref": "indicator--db8558af-18da-46ab-83d8-8c61e939673a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff42d978-dacd-4abd-aae0-5ee1d9ecef6e", "sighting_of_ref": "indicator--6574b9c2-1301-460b-aa15-19e6957f4544", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd23133c-9dbc-425d-9645-1b56adf16aef", "sighting_of_ref": "indicator--3050a7d8-cd95-4477-b5f7-99c056b59cf1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb47af6e-35b2-496c-a193-854b9ede8ec5", "sighting_of_ref": "indicator--7430cdde-e71d-460d-be89-e74f98d24514", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a238301b-0bc7-4fc3-a0bf-e541083db609", "sighting_of_ref": "indicator--305cc8ce-29c7-45a2-bf21-6801362c1bb0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5b849c1-121c-4d96-92d5-f45951565f82", "sighting_of_ref": "indicator--2e728c9d-86f2-44c5-9dca-e242e6c03121", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--153c8356-7ee2-4f7b-999c-645569241bae", "sighting_of_ref": "indicator--69e74f71-d178-4363-9367-0fee0f8c4452", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fea68840-e32c-4a1c-be3a-6911d74afa8f", "sighting_of_ref": "indicator--fe605e04-37a7-4851-97b2-f97014df5ba2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4af6e00-21bf-40c6-aa36-bf18d0d6cffa", "sighting_of_ref": "indicator--791f272c-c509-4ea5-b562-d0da19b2907c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b80928c-8c1e-448a-8abd-8adf8d18df06", "sighting_of_ref": "indicator--1d455e5e-195e-4efd-bc6c-c4f107b7c345", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9a82f4c-b781-44d6-af9b-06d0c38e2bb5", "sighting_of_ref": "indicator--f7dedd74-5b62-4210-aad8-af0147c3c50e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--822b8448-024b-4a00-b5c7-887e32b8e3f6", "sighting_of_ref": "indicator--ce38e598-6405-48a7-8d57-0e15dcd5793b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1afdec45-888e-4640-8586-c7bda08eeae1", "sighting_of_ref": "indicator--37498462-46ce-4c10-869e-954b98fa254e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de230174-ca84-4f39-bed4-401305f2f5a7", "sighting_of_ref": "indicator--827aefe4-8914-44e7-9794-f652e468761d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17a9bd4d-2191-4066-b1fc-844e165ad98b", "sighting_of_ref": "indicator--ab7d993f-5f3c-41c0-b0df-fd9f4f1e3045", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4101fcdf-ca80-4f00-bfd7-223463aa767d", "sighting_of_ref": "indicator--3e3dc9e4-16fd-4359-90f9-332ce572fde7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d8bea0e-9af9-470d-83da-acc1168add85", "sighting_of_ref": "indicator--3e3dc9e4-16fd-4359-90f9-332ce572fde7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0220c98a-8f27-49e4-b1b5-43bf0edbc150", "sighting_of_ref": "indicator--df69ad20-e8e9-4fb3-9c64-396726bdb82a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c33b3e6e-9c41-4fcf-93c9-0e1ca52089db", "sighting_of_ref": "indicator--ac2286ce-20eb-4060-8916-822d77270f1c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3748004-8b51-44dd-95ba-4ad234fd025f", "sighting_of_ref": "indicator--2b24a9c8-b98f-4c36-9b28-4ade319ba951", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fed5154-2ad3-4b47-94f5-f05ea7e44227", "sighting_of_ref": "indicator--6bfbe9b0-d942-416f-802f-6de60fed9bc3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73b7acc7-fe75-4fa7-9f0f-89adac1e3ac2", "sighting_of_ref": "indicator--6bfbe9b0-d942-416f-802f-6de60fed9bc3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f285b65-9bab-43ff-96d6-62e29fe04cfd", "sighting_of_ref": "indicator--02f6eea6-5acf-48b7-93c4-9b3dc0b6e74b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--befdb93e-a476-4903-9989-fd686c2b57ea", "sighting_of_ref": "indicator--02f6eea6-5acf-48b7-93c4-9b3dc0b6e74b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0485167-68d7-4fb7-afc6-861ff2bbc5ff", "sighting_of_ref": "indicator--50ebc5c7-312a-4a66-8f71-ad3f66c0149d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c6b8ac8-c113-481f-ba9b-8cb2e0af2cc9", "sighting_of_ref": "indicator--3ca9362f-daff-4d90-82fa-722b3618c9d9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5dee0b7-ad1d-41a7-bd2b-3cb4203c5799", "sighting_of_ref": "indicator--3ca9362f-daff-4d90-82fa-722b3618c9d9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a6d86c2-7904-4c9f-ad58-037e2421cfca", "sighting_of_ref": "indicator--d541d1a1-8bfa-43bd-b770-a9273a3df26e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51994592-def7-42ef-9c74-8a72d89ef709", "sighting_of_ref": "indicator--d541d1a1-8bfa-43bd-b770-a9273a3df26e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e2e1353-2375-47d1-8520-30d18d77b792", "sighting_of_ref": "indicator--58c3b170-5797-4ca9-9f0e-7cf5e47cd8fb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3ec50b2-af92-48c7-b018-f59649093854", "sighting_of_ref": "indicator--58c3b170-5797-4ca9-9f0e-7cf5e47cd8fb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cc4a3b9-76ec-475c-a713-aaa6a6e0f6be", "sighting_of_ref": "indicator--1315f0a5-eaef-4089-aab0-e3d225203537", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--862386d2-66f6-4f18-a322-e87965581200", "sighting_of_ref": "indicator--1315f0a5-eaef-4089-aab0-e3d225203537", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84c8226b-3d90-4cc0-9046-137213083fc5", "sighting_of_ref": "indicator--23ae8402-07dd-4ce1-bcd5-bbc3729b1ceb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c583fb3c-8f38-46cb-b7cb-cc9e11ab96b4", "sighting_of_ref": "indicator--23ae8402-07dd-4ce1-bcd5-bbc3729b1ceb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a06b9d49-63dd-4d5a-9e4a-7abd8246b3cf", "sighting_of_ref": "indicator--f02949e3-8079-45aa-83f6-cea291d5d067", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cbc41f6-37f3-4d4c-84f0-286482fb7789", "sighting_of_ref": "indicator--5e8ceed1-daa1-40db-8f12-27fbea4d970e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b00a1839-631a-47de-bc82-76beff128262", "sighting_of_ref": "indicator--653cf8a9-99e4-4206-939b-b3c9e2074aed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5039a096-b17a-4c19-b081-72791ec2994c", "sighting_of_ref": "indicator--c19162cf-0b21-4401-82e7-ec4a7831d127", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c16e9095-e432-4e50-96d5-7c1b180f4057", "sighting_of_ref": "indicator--c19162cf-0b21-4401-82e7-ec4a7831d127", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5957d20f-6a25-40ed-8b5f-98d0ae2b664a", "sighting_of_ref": "indicator--ec31248e-8d26-411a-812a-6d0627741f5a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--048d293a-3459-40bd-bb8c-eb7b6a94a506", "sighting_of_ref": "indicator--ec31248e-8d26-411a-812a-6d0627741f5a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--164c5e5f-8cec-436f-9586-a0a246108c52", "sighting_of_ref": "indicator--89c6cf28-0d1e-48f7-96e7-91d1d85e62ab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a9fb05c-61ef-4491-9868-6d765922b2b7", "sighting_of_ref": "indicator--89c6cf28-0d1e-48f7-96e7-91d1d85e62ab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a59b5bc-561d-49c7-858f-d46598b90ead", "sighting_of_ref": "indicator--7819f655-1c80-4381-82d0-b8d97c6b21b0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e2eba43-78e8-438e-8581-6dcad395ec7e", "sighting_of_ref": "indicator--7819f655-1c80-4381-82d0-b8d97c6b21b0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dea294a-a8cc-4402-b936-1a3e67a70116", "sighting_of_ref": "indicator--c738f010-bf7c-47a7-85d7-982e2a103cfe", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fe44f0c-a2a5-4c5d-bb1e-30c8519e3ea5", "sighting_of_ref": "indicator--735ea068-7ca3-411c-aeb3-9b715046d6f2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34bfa5bc-450b-4785-980f-23ca24cc8312", "sighting_of_ref": "indicator--702d74b0-7989-4fb2-9c6d-c71407b441b1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--247322d4-1ebd-48c9-8493-285de9f5273d", "sighting_of_ref": "indicator--c758b574-71e8-408d-9401-a8ceb8b1c02d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcdd5f3d-1b80-4c4b-8f7a-675818ea90c5", "sighting_of_ref": "indicator--5457a668-4ebb-4114-ab03-cb24e75ff662", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2def63d6-a8eb-4ba3-abf0-18c97b4b77cb", "sighting_of_ref": "indicator--064ea7ac-e6a8-4796-971e-beca988f0b10", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a6022f4-c526-40ee-80d9-807991e0732f", "sighting_of_ref": "indicator--9f2a600c-0a79-43b2-9ee5-28ad3269fd97", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c12feeb-23ff-4d97-b8e1-7a8558523174", "sighting_of_ref": "indicator--c6e112db-887a-488b-95bf-48f72589d6ab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dad21584-c346-4a6f-8e3b-62d524c8ab76", "sighting_of_ref": "indicator--32629aed-f1f2-49cb-bb03-6c5c47349c95", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b0988d8-d240-4dbc-8110-2926cfa0bac6", "sighting_of_ref": "indicator--75c3cb49-ca5c-48dc-9249-93eb3ba2b36b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df29fc65-a1c9-4172-8033-0dd9bb7ec4c3", "sighting_of_ref": "indicator--6a30e234-1ee9-43f4-a110-bdffa72348b6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0e852b6-97fb-4d79-bdde-0c9d69be2274", "sighting_of_ref": "indicator--00e47941-b2c6-4336-a3e4-3bd6cfd322c0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f93bbf5-5178-478a-905d-3c2a0fb15bdb", "sighting_of_ref": "indicator--4c1c6cf6-8fe0-4cb9-b264-81ddf6d1f69a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5c6d33d-6990-4d21-9418-49d7f341300c", "sighting_of_ref": "indicator--1ce45554-5955-4b97-abac-ada5a3a88634", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3066392b-1773-42a8-8b9b-340cf96cc28f", "sighting_of_ref": "indicator--28714fec-5614-4a96-9bc9-43bbeeb7558d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48462a3b-5fce-4a94-92dc-f3f4375e5165", "sighting_of_ref": "indicator--fd5ca301-c82f-4c19-8406-5cb8fcfa3229", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f2de9e9-7a55-47cd-bf10-358e27ab6a7d", "sighting_of_ref": "indicator--83383faa-cbf5-44c8-a3f4-579fca31bcb5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48999ded-089b-4d18-be84-17752a8494c0", "sighting_of_ref": "indicator--febe7b2d-f4c6-4b0b-9e01-ded5619af495", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b4751f0-a792-4682-b755-dec4fc264e13", "sighting_of_ref": "indicator--febe7b2d-f4c6-4b0b-9e01-ded5619af495", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58852405-f5c5-4627-9043-a860297f5281", "sighting_of_ref": "indicator--8edd83fb-3b73-404a-9a06-06fdff8bbfa9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69343507-7f58-4696-8469-94608671a499", "sighting_of_ref": "indicator--f927b150-b518-420f-a3ef-67d15f20d360", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc0c1a9d-899e-49a8-9a74-c000c2d526e0", "sighting_of_ref": "indicator--97f85e77-c453-46f8-ad41-853bd5861d8b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6470cebc-0869-45d9-ab22-13d22230a15b", "sighting_of_ref": "indicator--97f85e77-c453-46f8-ad41-853bd5861d8b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f609dfc2-ef73-4213-b211-d6a642989a81", "sighting_of_ref": "indicator--a0022e14-716a-4958-8376-96d07a35cdf9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0da40a47-69ea-4ec6-9b0a-0c06786675f5", "sighting_of_ref": "indicator--f2424e88-4dad-42a3-b5c9-e640b719f0a2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1d533f0-3f57-4456-8536-4d214b3e74cd", "sighting_of_ref": "indicator--31a378bb-83c6-43c9-9e37-9719ec60338e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2468c7b8-7de5-4baa-8e7d-5f9b8756c901", "sighting_of_ref": "indicator--1eb6a1dc-fe0e-47ef-a6cc-25d23675fe33", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d44194db-41e7-46e4-9d00-3a9cbeb6982c", "sighting_of_ref": "indicator--5128e947-dd49-4ef6-9261-35fac174dc04", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ffebfc9-0ce0-4cd0-b202-92b8fe705f57", "sighting_of_ref": "indicator--a21798d8-cf2d-4950-b9c6-0ae5b669cb87", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d06bd047-ecbf-4311-b8b0-240a49fb07d3", "sighting_of_ref": "indicator--b3e3746a-a975-4ba6-bba1-911b1345d1da", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b9f1883-7955-4a02-ac8e-7bb5e51db3b8", "sighting_of_ref": "indicator--82de821a-0168-47b9-bd85-682927b67178", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9425fcbf-a44d-4724-b3b4-4ad0d4887e1c", "sighting_of_ref": "indicator--08dc15b0-7524-40c2-b052-0c90780bd2a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6dd2cb6-8ffe-4956-a69e-2fb4ca412236", "sighting_of_ref": "indicator--6f50f565-e2fb-4b23-a7c7-d647e172d326", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28f3f949-e8ca-435e-84ea-518f61e01360", "sighting_of_ref": "indicator--09f2909a-66ec-45e1-a5ef-723d5071be45", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a6566bb-3fc0-4d2e-a9be-3bb77913fb92", "sighting_of_ref": "indicator--0272b149-6e45-473a-9db8-fe465c8ff23b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce4e8d93-4745-4f31-bbec-ca49b72eb99f", "sighting_of_ref": "indicator--0272b149-6e45-473a-9db8-fe465c8ff23b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f00e36d5-fc80-4982-8558-b6d945b19b9c", "sighting_of_ref": "indicator--ef9997ae-199a-446d-aeb8-43c3a09ad40e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--775ee130-c755-40ee-b90b-ab69f1df1611", "sighting_of_ref": "indicator--8a378d5a-ff74-4ae7-8c80-355e26a7cfc6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--829d1f24-6853-4d2f-9e80-8f5e93a2b4f1", "sighting_of_ref": "indicator--106fb331-7414-40f3-a8ee-bde076f94baa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d27a788-8b54-465b-83df-6388e8fd5a02", "sighting_of_ref": "indicator--1fccff75-983c-4ca6-a235-d75a4d941a29", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15106740-2f14-407e-8af6-1204c23264d0", "sighting_of_ref": "indicator--af3e3849-be17-4c37-9d51-4bfc95730ac5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a49c97ac-0d05-4a82-a2f6-d6894cab42c9", "sighting_of_ref": "indicator--d3c89bdb-b810-4a72-81e2-f4e869a5c0ac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5084a557-c58a-44d5-ad51-908999ddfd43", "sighting_of_ref": "indicator--dff9bf84-ff8b-4d2a-8859-5bad5f9908ed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--396f095a-a346-471a-8952-b1900f9bcd1c", "sighting_of_ref": "indicator--a1414e1e-c74f-4356-8794-4d8ccaec1361", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b418c6d-ea29-4152-8133-c81a0b3915d0", "sighting_of_ref": "indicator--18073964-a357-4907-bb1b-19dca865692c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67416a33-9cb3-451a-a02d-d4176e4f55e8", "sighting_of_ref": "indicator--18073964-a357-4907-bb1b-19dca865692c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a895fe4-63ed-4f32-8721-e3c5b65af94f", "sighting_of_ref": "indicator--22e0f073-94ca-4f50-82fb-9f8388b64548", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ed0a70f-5d4f-4b90-b5c1-13300cf088da", "sighting_of_ref": "indicator--671d3243-30d5-46ac-898c-8434e5a1e87b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d6dd9f4-b405-464d-be3b-8258340510f8", "sighting_of_ref": "indicator--41be5c31-07c1-4b51-b197-494cdcacf53b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20636883-18e2-49fa-acdb-cd0654e105af", "sighting_of_ref": "indicator--b26e1491-4b96-4a96-b00f-e44742d376b3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9311de55-2783-42d8-92e1-c9a2a9a9d2b4", "sighting_of_ref": "indicator--2460789e-1e48-414f-b2ba-074fba03b8cd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--699e565f-a99e-4ccb-8add-1d137a87145f", "sighting_of_ref": "indicator--ea9b771b-aa19-4192-b435-aedcf4e3abe6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d57c8c4a-8bfb-45bd-8ac2-7b6aa35b24d8", "sighting_of_ref": "indicator--4bfcba22-0402-4291-bba7-e958d22fffad", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--339e2550-dde0-45c1-8dfb-d3b63ca8c9a9", "sighting_of_ref": "indicator--03e84761-ad5a-40bc-9386-50e632ef71d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0ae9c7a-eded-4622-9ac1-d058c1407c5d", "sighting_of_ref": "indicator--26b96aff-f003-488e-8648-171dbe155052", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3769d563-20f4-465e-975e-843eadc2772b", "sighting_of_ref": "indicator--41dc1d8f-03a1-4bde-878f-564caf13c137", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b2e7076-1c9f-4403-8583-167ff36ae470", "sighting_of_ref": "indicator--0612fa9a-d299-454c-878b-407b2a858cd9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d852e260-a6f6-4730-b58c-c61470aa059f", "sighting_of_ref": "indicator--1b402d27-606f-407f-89df-bc8e7ad5b3b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d38482ae-49b4-4e9a-98a2-26115c88cc40", "sighting_of_ref": "indicator--36bf25b4-2331-4c58-95e6-c65482c98cd6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edc56c0f-526c-4f9f-9f34-66e418744315", "sighting_of_ref": "indicator--afef775f-81d9-4054-b847-68bc3b8de4b2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--260f084d-cd29-47e7-af7b-fc29bfb61de7", "sighting_of_ref": "indicator--0f0a72db-70f8-4034-8b21-b1b2b329f291", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--488b7498-9e01-4ae1-b08d-65bbc2a26e8e", "sighting_of_ref": "indicator--4fe1b370-4966-4824-866b-d09adcd2ef01", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b43b2563-3b00-4f14-abb7-60c66702ff12", "sighting_of_ref": "indicator--e58b712d-4657-4f59-8daa-49276526b771", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a1864b9-d1e7-4fee-b588-8756d8720789", "sighting_of_ref": "indicator--8eb7ddf2-6f64-4671-acd7-abc0da85040a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96154b09-1611-4919-a0da-aa55bb882507", "sighting_of_ref": "indicator--5fbde2c5-f3a4-4b40-a076-afdbeddc04e9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b080903-c36d-4388-819e-8d9ae5c5ecec", "sighting_of_ref": "indicator--8566e8ec-2c0b-4e09-8bb4-8b5e08cee5fa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa5ab18e-0cf1-4f36-ba11-06f8ea972597", "sighting_of_ref": "indicator--b210a566-4d8c-49f2-8f95-da21e7013735", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36ff7555-0098-4f70-a780-3d7e5a590aff", "sighting_of_ref": "indicator--6f6dec30-2bd0-4597-85a4-6285819723aa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7df06791-6dfc-42a3-9b11-c2ffc353b020", "sighting_of_ref": "indicator--eafe56bf-35c7-4af4-b382-57aec0b2a3e7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5c354fb-91ac-482d-802a-7dfd39778275", "sighting_of_ref": "indicator--0241c11e-56aa-44de-afd9-43ba7e215d56", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c98df40d-c4af-45d4-bdfd-aa693879ce94", "sighting_of_ref": "indicator--218dc3c5-e117-4885-a4dc-ffeb3ba9c883", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--995e3a6c-5ee4-443b-9b44-ec0f174224e5", "sighting_of_ref": "indicator--f8391de1-8a78-4ade-8f16-a8ad3d7fdeb3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82b637f9-2d05-4d90-b97e-d35d339c5c95", "sighting_of_ref": "indicator--d07fc57e-ebb3-4145-928e-0110121005e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d91fa26-3f2f-47fe-a3b0-3debf2b234b2", "sighting_of_ref": "indicator--25bdd7ca-de52-4854-84cc-a7d5924f1c16", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--967977a9-3e06-463d-a6a6-2ddeef8a9cb9", "sighting_of_ref": "indicator--680e1b31-d40f-45d3-b062-5b2c900b49d8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4818cf9b-a017-4e57-b17d-c4f5c667d7ed", "sighting_of_ref": "indicator--81097b8c-78ef-49cc-b2fa-eed376a0e303", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87d4542d-d9fb-4eb4-90cc-f5c25608b0bb", "sighting_of_ref": "indicator--81097b8c-78ef-49cc-b2fa-eed376a0e303", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73833308-9383-4a81-8b06-728ad9f43c95", "sighting_of_ref": "indicator--0a379bdf-1e20-482a-988d-7635673dc8e9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eec3c933-51dc-46d4-836c-e8af2339bd1b", "sighting_of_ref": "indicator--067ac478-758e-4e07-b618-7d15ff97b304", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--096d19e3-3e77-45f2-9247-f5c20fa6070d", "sighting_of_ref": "indicator--067ac478-758e-4e07-b618-7d15ff97b304", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4cd8601-24e5-4094-8277-af1b2debeeae", "sighting_of_ref": "indicator--90b0a6ec-c5ac-4da5-b6e5-75fe469e8b40", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64083c02-88a1-43b4-a12f-b987c519e6bd", "sighting_of_ref": "indicator--babf4194-ac30-4c8e-bb96-f4abdb40384c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0af061cc-e664-41ff-82eb-e31160f5257d", "sighting_of_ref": "indicator--babf4194-ac30-4c8e-bb96-f4abdb40384c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b27e332f-7536-4540-9c57-841270c3c287", "sighting_of_ref": "indicator--dc022d91-0433-4430-8acd-cbd2a1743849", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5615fb07-31dd-4cf9-94a6-d630f6cd2255", "sighting_of_ref": "indicator--dc022d91-0433-4430-8acd-cbd2a1743849", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6850afdc-9188-4d0d-a0f9-0262bec2e7de", "sighting_of_ref": "indicator--8c5f7d1d-99f1-4242-97ec-dc05678242e3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d124e707-ca8d-47b2-8465-d7acd41190a7", "sighting_of_ref": "indicator--8c5f7d1d-99f1-4242-97ec-dc05678242e3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eae2906-5c76-48c4-8ef9-5c711cc4e886", "sighting_of_ref": "indicator--1e88307f-4ab1-46e1-b9a6-98607e123a72", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec32fb2d-345a-4e05-88d8-007e41b05877", "sighting_of_ref": "indicator--1e88307f-4ab1-46e1-b9a6-98607e123a72", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdcda2b6-1eab-4dd3-ab50-5ba7b06ddd21", "sighting_of_ref": "indicator--5b5439bb-14c8-40a9-9a97-55bf93fbed0c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7324e806-f53f-4cc0-9f72-3948a24ac04f", "sighting_of_ref": "indicator--e8efdcd2-0faa-4b9e-83cc-b4b8454d1273", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6995224e-4b7d-4e9a-844f-a0aef1501a20", "sighting_of_ref": "indicator--f23ffd04-08a4-4c40-97cd-9ecff3a3d185", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75cd2b0e-9c67-4b7b-afad-cb42bca363b8", "sighting_of_ref": "indicator--f25c24d8-6c7d-44c3-9af1-0171a9d7e287", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da6cb7f4-26c3-435d-9710-dceff9330f2e", "sighting_of_ref": "indicator--add72a3b-2f62-4cb7-bec8-fc1affe342aa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42dc72e4-3635-467f-bb11-ea474d4075d1", "sighting_of_ref": "indicator--34600aeb-6fe0-406a-a9da-89aed582ae7f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d354b824-9cef-4fed-a4e3-0fd4e2de3017", "sighting_of_ref": "indicator--34600aeb-6fe0-406a-a9da-89aed582ae7f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf506bcc-604c-4d93-a3ca-c2b9fe366155", "sighting_of_ref": "indicator--f5c0e8d6-d161-4029-839c-4dd18259836f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32928d22-34a8-4367-8a73-5899e95866a2", "sighting_of_ref": "indicator--f73912e9-f097-4c89-9f86-dc8b9eb9fb25", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08abb5a1-a069-4674-9644-a3d469c4ab6f", "sighting_of_ref": "indicator--3ed63b28-c3ad-41bb-8ac0-3a7d586faf5e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1325576f-e86e-4fb0-b1b6-c11babc68df4", "sighting_of_ref": "indicator--c5111899-abc7-443d-9931-e258a6317262", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f382bf6-659e-406a-bcf4-7234fa9b6be7", "sighting_of_ref": "indicator--312b0599-bc7c-488a-95ed-f2cdbe68b342", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e24053c-1ab1-47fc-a44a-7ebfc2f984e6", "sighting_of_ref": "indicator--3dd5a1d1-65f8-490f-88f5-8b7a26fa1712", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88b93dea-9519-4596-be0a-324fe4b15436", "sighting_of_ref": "indicator--abc505bf-8bfc-484f-be28-200a73594ab6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77156f68-ca7c-445e-a5b7-2bde54831b59", "sighting_of_ref": "indicator--a283a527-ea45-423c-bcf8-568c688072e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad75f14b-6286-440e-96c8-56ffaad014c9", "sighting_of_ref": "indicator--89098e78-3083-4502-91e2-7bed90af53b2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e465c879-2988-44c8-ab18-9a8c03956c4c", "sighting_of_ref": "indicator--56ddd89b-ae7e-40e7-97ed-c1a98457fad4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e73c5c8-f252-4f6b-9415-41748d1dc585", "sighting_of_ref": "indicator--98106424-153a-4308-b609-3256810de576", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67c1c70a-803b-47c4-aa68-7fbb1b1f4002", "sighting_of_ref": "indicator--3902f0a4-ec53-40a1-a270-345084164969", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02c1d89c-c5b7-4a81-a9be-08fa64ce46ea", "sighting_of_ref": "indicator--a54b6ce7-91e8-48ca-8f97-376e12462a7d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ab48317-675e-40f6-be96-45658cc088f1", "sighting_of_ref": "indicator--88ec183f-5ecb-498a-8ed8-edf26cbe4f98", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb306a0c-365b-4f50-9861-beb02c3850de", "sighting_of_ref": "indicator--1c16272b-d913-4948-9a13-57e10ebf6fd4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36bfb39d-e119-4730-842b-4756327ebd1a", "sighting_of_ref": "indicator--b59dd82c-2a44-4eff-9c23-7ff0b2a29dcf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--517d2624-7ba5-47d8-848d-42a30e980aaf", "sighting_of_ref": "indicator--227d6bf4-0578-4735-aafa-c9cb576f65c6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17fb3a54-5936-4995-b917-ffad5d21fa61", "sighting_of_ref": "indicator--5ef3ddb9-c95e-4534-93b8-4baa391e037b", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d1d86d4-fc03-4d8a-8175-6c088d542191", "sighting_of_ref": "indicator--e7e4b823-18c4-48ad-a15e-93adb4799e26", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97fb9057-45e5-4ac3-aa98-8e887ff423e2", "sighting_of_ref": "indicator--59061cf5-4df3-494d-86c2-8c084326ee5d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2be9de54-2197-4d4b-84a0-e625adafbd1d", "sighting_of_ref": "indicator--2dd7e218-2ca4-43c2-8bc5-bf942d25fe60", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5433d727-8453-4a33-bfd0-06962618d905", "sighting_of_ref": "indicator--89a37167-c9c9-46c9-bc20-1be290632db8", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce1b6ad0-db6a-412d-a3a5-e813106e1f59", "sighting_of_ref": "indicator--b7a49258-b91c-402a-b451-f8adbc4c6937", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e0b0c8c-a151-4ea2-99b1-ba22510c076e", "sighting_of_ref": "indicator--76f7aa01-8e80-4b53-9cb0-2bdad591f99a", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--917d6867-ac69-4795-a0c9-ed837ef4e158", "sighting_of_ref": "indicator--7e88dccd-a7ff-4d9e-a050-0cd54abcb7ae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b22e208-221a-4b69-ba50-bf14e2eb909f", "sighting_of_ref": "indicator--09044c83-8f61-4c47-a49f-c0cf70a75a49", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--019f532d-e5e6-4000-88d2-60912b7c703d", "sighting_of_ref": "indicator--bb7b070c-cad2-4109-83a5-f28259fc8e33", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82ec01b2-6386-4a96-891e-bf3152386ec1", "sighting_of_ref": "indicator--1a663796-e4a3-44cb-948d-df2742cca2f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c21c7c9-94f8-4e23-b868-53aaa594d5e3", "sighting_of_ref": "indicator--1a663796-e4a3-44cb-948d-df2742cca2f0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ec95b0d-6f23-456e-aa7f-162413b88515", "sighting_of_ref": "indicator--5474d4b4-9164-4365-adb0-1dbfec3575d2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99a5f184-e8ca-40ff-96fe-daf0da475ba5", "sighting_of_ref": "indicator--5c11b9bc-be6b-44a9-9c33-4c2d85824113", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c073f22a-82bd-4924-87e5-b6763c47973c", "sighting_of_ref": "indicator--5c11b9bc-be6b-44a9-9c33-4c2d85824113", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--979e2484-03d4-4668-972b-2f201f4f5079", "sighting_of_ref": "indicator--2f78dcdc-ffe7-4001-a3e2-687f07e5e037", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3528ebd-b8ea-4e55-af7b-6a4ce342037a", "sighting_of_ref": "indicator--37188c30-7f9e-4f56-a709-0eb05155ead4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02281f23-63da-408b-903a-b87af846469c", "sighting_of_ref": "indicator--ad30fe32-a9bd-4b95-aaf1-8fe4eb569567", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77f4663b-9f08-4892-b0f0-0bb4a8e33063", "sighting_of_ref": "indicator--ad30fe32-a9bd-4b95-aaf1-8fe4eb569567", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6366dfc6-f4b4-4c4a-8191-c6d8bdbe6de7", "sighting_of_ref": "indicator--ce1bd91e-27b3-4a9f-a363-8d40325b49b9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e1fc997-bb53-4fb7-a89e-5638785a0c0f", "sighting_of_ref": "indicator--7faf6a43-9034-45c3-b243-40c666a6c2df", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92599651-3046-4c4a-aaa0-34fae1bcc405", "sighting_of_ref": "indicator--00a2f24f-aea8-4c6e-8ed1-c9295e2fb7dd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3d24cd8-7c59-43e5-b47e-357cf9c249aa", "sighting_of_ref": "indicator--ea4a24fa-a808-47c6-aac9-3e286133df3d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--755901dd-1971-457c-a25a-732deeb46090", "sighting_of_ref": "indicator--f11bf9e0-fc95-419c-a41e-6f8c5a7520a2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edeaddf3-2485-45a8-964b-281936bcec7c", "sighting_of_ref": "indicator--b67796f5-d8ff-4368-a15c-f6b494caa79e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ab5b462-5c70-4900-98e4-a92da0a44a6e", "sighting_of_ref": "indicator--2a99f4b0-263b-4b20-ac5d-db5d65c1a996", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16c345fa-3fc2-42ef-82e4-dc635e42df8b", "sighting_of_ref": "indicator--ac89e7e5-8ae6-4480-bac0-4dd38103301b", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f4ebc6c-768c-4b66-802a-1e50a1eeca03", "sighting_of_ref": "indicator--7acae5e1-b1c0-4330-9f70-e72e1c041466", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5628c00-e661-4c95-882c-ae044e8fc3b8", "sighting_of_ref": "indicator--50fab262-760c-4992-9e0d-eef2c1fdee0a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9cb58c2-9f88-4a27-ab6f-fde656b517f1", "sighting_of_ref": "indicator--2a092d0d-a478-4eb7-988e-85d1614e9917", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30981a24-074b-431c-b862-e16861f739cc", "sighting_of_ref": "indicator--a1d5841d-7828-4d39-9c38-d8ac6a8ebc6c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82caa482-c093-499a-8cf2-bc9da50c6867", "sighting_of_ref": "indicator--8809985d-98bc-44d2-881c-7b297c5f8967", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76a08937-a362-40d8-91e7-98d908fbcdb4", "sighting_of_ref": "indicator--a21a1d65-5fd5-40c9-bfee-c369d8482be9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c36638d9-7cb4-4524-9523-c6a56d696517", "sighting_of_ref": "indicator--ea0822b1-1209-4515-98e9-ae693c07680c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90a94b09-a229-4777-a063-298d619ac6ee", "sighting_of_ref": "indicator--73008ef5-806e-4686-87ee-51ae6fa04bad", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a18495db-9e7c-4eff-b298-b385ead741ce", "sighting_of_ref": "indicator--06aa017d-f05a-466c-b0a3-1c505ab1c849", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90d8934f-77de-46a0-a0c7-d7d283bc1b1d", "sighting_of_ref": "indicator--b36792fa-f14f-47d5-a742-66c511bbadd6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--158dee6d-1a4f-4f2d-b5cf-7e448e417b51", "sighting_of_ref": "indicator--b16e2cec-360c-4f66-a82a-1b79e6cadb6b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3822403-93b1-4483-9ec5-f22587a91cc3", "sighting_of_ref": "indicator--cf5b8775-d18a-43c5-b1e5-43b4b9f47a39", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f934d85-a8a6-4ddc-8f17-328630fe2cb7", "sighting_of_ref": "indicator--14420c23-c261-442a-b36c-ec7fe9d0b07e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd7506a0-72fc-4a6a-bd28-32cf2c3beb6d", "sighting_of_ref": "indicator--e01546ad-d168-422f-93cb-54242d774a72", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fda02461-39e0-4ea3-9765-f494e3e6b471", "sighting_of_ref": "indicator--fc26b307-2075-4907-aa6f-54f03caf4576", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2b704c8-b572-4205-a279-33ef731c9388", "sighting_of_ref": "indicator--a30458ce-6b25-4215-bd91-18cfb1ec0ab2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f43bde5e-92ba-4ed0-affd-e442703d9c26", "sighting_of_ref": "indicator--bfe09707-72d6-4ed5-b0fe-1f9d0a7e560e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01219461-6952-4c16-8344-933577b85aa7", "sighting_of_ref": "indicator--9d79c42b-494d-4047-9bfc-517016da1362", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2d99472-da29-40c6-809c-cb742eff67d5", "sighting_of_ref": "indicator--9d79c42b-494d-4047-9bfc-517016da1362", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e1358be-5003-4352-9961-f900e2af7fa3", "sighting_of_ref": "indicator--b4dab08c-73d3-4ae1-aa90-a489622b9760", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1024291a-0677-42b0-8c39-063447b54835", "sighting_of_ref": "indicator--d041fd7d-eaed-43ee-bbba-2ace9ae3ef01", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--151c5d8e-a12b-4106-9a4e-e4fbf96b4146", "sighting_of_ref": "indicator--b039d06a-15b3-46d6-bfb4-e9078f4af344", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8de44f68-19f9-4a92-9f5a-d1c537a0bd13", "sighting_of_ref": "indicator--bbf10ae0-8c58-4744-b6b7-f0744f853e27", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74cdd0c3-2e61-47c7-88c5-d41e94e612c4", "sighting_of_ref": "indicator--bbf10ae0-8c58-4744-b6b7-f0744f853e27", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfee0c42-388d-495a-8c04-3d56cf67b1cf", "sighting_of_ref": "indicator--5e6f2184-ba1b-4fa2-b93f-6f22728f6e1d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--521fb539-82e6-403c-9db1-79740f166687", "sighting_of_ref": "indicator--6cf684c2-dcb0-44d2-9c21-95021e194aa0", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9bf10fc-d06b-4a8b-bbbd-6c4bca6c2726", "sighting_of_ref": "indicator--e81f7ff1-1079-4bd5-a5b8-9568cf6917f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cddd9b8d-2906-49fb-b0c2-54940536f517", "sighting_of_ref": "indicator--73631c70-2744-4b76-a4ef-66529f4e4b4e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b7ba04b-f406-402a-b54c-f21e6a8dab36", "sighting_of_ref": "indicator--432a1c8f-1813-4bec-a681-67f53bc0fb3b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--714f036f-87e6-410a-a16f-7eeac7fa2d0b", "sighting_of_ref": "indicator--432a1c8f-1813-4bec-a681-67f53bc0fb3b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c07d3b4f-5d32-4249-9ee5-8a4b72416790", "sighting_of_ref": "indicator--193796d5-a851-4964-bea9-d7a6be354c35", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dec9b557-154b-4167-a408-f4611232aeca", "sighting_of_ref": "indicator--193796d5-a851-4964-bea9-d7a6be354c35", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0003d35e-9be0-4225-8fda-8db5d5360d59", "sighting_of_ref": "indicator--1d15a651-7bd0-466f-9bc1-bb235b6a77de", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2119f2db-1c1b-4551-8c51-c1d4e1b46b75", "sighting_of_ref": "indicator--dedfc82c-f47c-4371-8e0b-b951285dfbef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28880348-0a6c-481c-af19-a97f7fa47e05", "sighting_of_ref": "indicator--dedfc82c-f47c-4371-8e0b-b951285dfbef", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35d6dbaf-4e91-4e6c-ad05-724154574cdb", "sighting_of_ref": "indicator--efa15cdc-deb1-4823-be47-ac58a5da0bab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bca91383-7e68-467e-b887-2fd91672869f", "sighting_of_ref": "indicator--efa15cdc-deb1-4823-be47-ac58a5da0bab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d73a1ff-d171-464b-af2e-5fb105206216", "sighting_of_ref": "indicator--d5f0e385-b889-4b7e-90ab-32a0cae9f2fb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6393f9b9-59d6-47cb-909b-c7b5141f5d41", "sighting_of_ref": "indicator--d5f0e385-b889-4b7e-90ab-32a0cae9f2fb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8ef510e-f361-4003-9e47-9e3653954dcb", "sighting_of_ref": "indicator--d9665ca9-f935-40fb-80e4-47155437f8e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--187fa1e3-039c-4fb3-bf65-5cb76b0c4598", "sighting_of_ref": "indicator--d9665ca9-f935-40fb-80e4-47155437f8e4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f52f0028-7ef1-464c-a70c-d3d6c5accaa3", "sighting_of_ref": "indicator--0622fdd1-0b8c-48d9-883c-800e8550689d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--035b9516-4a38-45ba-a4c6-42a2d1f0fb73", "sighting_of_ref": "indicator--0622fdd1-0b8c-48d9-883c-800e8550689d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a16d75bb-64cc-478c-841e-594cb3ad3f32", "sighting_of_ref": "indicator--0f1c4d39-46e0-4111-ad8c-66a77377bc6f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52644d04-d877-4be4-a688-85ba32f54c6d", "sighting_of_ref": "indicator--8cb0420f-81ef-4387-b2e1-851d48a354e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69419cde-72cb-464a-81a4-8696f83dff3b", "sighting_of_ref": "indicator--8cb0420f-81ef-4387-b2e1-851d48a354e1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69bc7ea1-cd66-48b4-9cf3-7fd92a426007", "sighting_of_ref": "indicator--691881fa-07d5-499c-9377-fdf79781186f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cec7ca5c-feee-4088-a537-c442a35a8902", "sighting_of_ref": "indicator--691881fa-07d5-499c-9377-fdf79781186f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80c01983-3d95-4710-8a01-8e7878a264cb", "sighting_of_ref": "indicator--706ceca5-12fe-4371-aada-2cec947890b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bce96f32-5a3d-481d-9edd-78114c5fa171", "sighting_of_ref": "indicator--706ceca5-12fe-4371-aada-2cec947890b7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--affa4307-4355-4737-bb6a-f29383bf938d", "sighting_of_ref": "indicator--c5d6c2a8-e9fb-411b-9927-f2413ca03651", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--786cef2a-3b5d-4792-99c2-4e16e8620cd4", "sighting_of_ref": "indicator--c5d6c2a8-e9fb-411b-9927-f2413ca03651", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2215f28c-c2c9-4fea-a79b-baf35c368f26", "sighting_of_ref": "indicator--469b9271-7214-4644-85ea-caf6000f9e19", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b2e1244-4f5f-4215-a438-b0701c5f45f4", "sighting_of_ref": "indicator--469b9271-7214-4644-85ea-caf6000f9e19", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e32e4f5a-34ea-45ba-ad92-437dfa1bf7cd", "sighting_of_ref": "indicator--f4e9b605-3ce1-4f69-8d23-ddf785f95e27", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ea197ff-eae2-4a67-ae60-ab8cd7c29a0f", "sighting_of_ref": "indicator--f4e9b605-3ce1-4f69-8d23-ddf785f95e27", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6c37e0f-19dd-4315-8ac5-490ec86484c5", "sighting_of_ref": "indicator--bcc4633b-7e92-450a-abfb-decfbf9e2189", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e784a530-a16e-4e81-b13e-dd215057a0ee", "sighting_of_ref": "indicator--01fe407d-d1e0-4ed2-b3b6-d72b2a3d18a9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0d5943b-3059-401c-ba7c-ada7947f1725", "sighting_of_ref": "indicator--ef023acf-33c8-4158-b7fa-237c4ad649d9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a347cf68-4bd5-494e-ae82-7fc15b4155b1", "sighting_of_ref": "indicator--ef023acf-33c8-4158-b7fa-237c4ad649d9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f173f6c0-b3d4-4806-a0d4-ce5f7b481559", "sighting_of_ref": "indicator--bad1a440-07f6-49e4-af6c-c09a5b801e48", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11e824d6-56e0-4b50-9128-f678ca0624d3", "sighting_of_ref": "indicator--bad1a440-07f6-49e4-af6c-c09a5b801e48", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82974427-1639-4d76-8d7b-cda3fae3ae32", "sighting_of_ref": "indicator--4a679042-4862-4285-8d6b-f6bf87584bf0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d89e720-1147-4a34-badc-52afe5fa3bde", "sighting_of_ref": "indicator--4a679042-4862-4285-8d6b-f6bf87584bf0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02898bd1-120d-494d-849c-ee1c94b134c7", "sighting_of_ref": "indicator--cae7f40b-230f-446b-8c08-6779e54ffdbf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c98b6f27-45ac-4bdc-b67b-4fd81777b123", "sighting_of_ref": "indicator--cae7f40b-230f-446b-8c08-6779e54ffdbf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab2f8198-eec6-489e-83a1-7c0b678f6cc7", "sighting_of_ref": "indicator--ce73520d-75ce-4f84-83a1-b0ad5e317821", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45709f17-74bb-47ea-a722-27fa4af9d5a8", "sighting_of_ref": "indicator--ce73520d-75ce-4f84-83a1-b0ad5e317821", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--483445a0-b5ef-485b-a936-9d6c51db3e51", "sighting_of_ref": "indicator--0326e593-6693-4f1d-9945-881b75ae6d76", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fab0732-538e-45a9-849e-ff4010d1999c", "sighting_of_ref": "indicator--0326e593-6693-4f1d-9945-881b75ae6d76", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fd269a5-8679-4ae5-af07-a0871c882657", "sighting_of_ref": "indicator--374ea8e3-d4d2-4b06-b7ae-659fd1209460", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4852b78e-399e-4d7f-abf3-6b476a82836f", "sighting_of_ref": "indicator--374ea8e3-d4d2-4b06-b7ae-659fd1209460", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f0553d7-f993-4977-8712-2369c464921a", "sighting_of_ref": "indicator--29f8daa4-a9a7-413e-a1fc-15fd19230f49", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--496683fc-412b-43a4-98db-718d543db7e3", "sighting_of_ref": "indicator--29f8daa4-a9a7-413e-a1fc-15fd19230f49", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0cfea2d-e8aa-415c-bd94-9edd01f92d16", "sighting_of_ref": "indicator--656dcba1-92fe-40ab-af63-379be863259e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70709c41-3e0f-4ca0-b160-6699d3a8a84d", "sighting_of_ref": "indicator--656dcba1-92fe-40ab-af63-379be863259e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e281df40-790c-49fa-8f8f-41a0c7b5ea29", "sighting_of_ref": "indicator--51cb4608-15da-49fc-8049-1ad871e175f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--111b6350-a68c-43fc-9d4d-ce47e3d6f313", "sighting_of_ref": "indicator--51cb4608-15da-49fc-8049-1ad871e175f0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0094b499-625f-4b22-83d4-3b49adfc5404", "sighting_of_ref": "indicator--2afff8a7-fca8-4152-b653-459d96072368", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d929e12-6f61-4b69-9899-cecec6b8e06a", "sighting_of_ref": "indicator--2afff8a7-fca8-4152-b653-459d96072368", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d223d287-3578-4006-b5fa-ab09ae4b035d", "sighting_of_ref": "indicator--ab073cb0-ae76-4312-8047-d8524d7b24fa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0471c20e-504c-4699-b184-104b96011e8f", "sighting_of_ref": "indicator--ab073cb0-ae76-4312-8047-d8524d7b24fa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d04105fc-5893-40f0-840d-9efb10006ac9", "sighting_of_ref": "indicator--86cb319f-ccc8-4dfb-a425-dd29c8616f52", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a75035f8-4db4-4a3e-8be7-e1fc2bea4fa7", "sighting_of_ref": "indicator--86cb319f-ccc8-4dfb-a425-dd29c8616f52", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--704ebcdf-fb7e-48ae-a8b0-1df563c641fe", "sighting_of_ref": "indicator--78d14667-5ef0-4b0c-b32c-dd171f89b6ec", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9853c74c-1b9d-4b3b-8780-491859fc510e", "sighting_of_ref": "indicator--78d14667-5ef0-4b0c-b32c-dd171f89b6ec", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08fbddf6-0b1c-420f-a344-bc2cbc417e45", "sighting_of_ref": "indicator--51b0fcfc-90e2-4273-bb4a-167462b31e5a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e543f7a1-6fd3-4979-a94b-f4fd6c75c320", "sighting_of_ref": "indicator--51b0fcfc-90e2-4273-bb4a-167462b31e5a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4148824b-f174-46a9-ad20-366a3ed301b9", "sighting_of_ref": "indicator--c52fbd7f-4bb7-491a-9f20-4acdb12a1ba5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--692231e4-db48-41cf-bcb4-c49482962314", "sighting_of_ref": "indicator--c52fbd7f-4bb7-491a-9f20-4acdb12a1ba5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bb11339-f32e-4015-b8f6-875f13ccd69a", "sighting_of_ref": "indicator--3a33a7cc-5b41-4029-95f7-7f6fde0a8752", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93db2bf2-9b43-46d4-a6f3-57b67ba997f0", "sighting_of_ref": "indicator--3a33a7cc-5b41-4029-95f7-7f6fde0a8752", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c85e8078-c953-4d09-9f2f-0893b1ce479e", "sighting_of_ref": "indicator--122c9931-9778-42d8-80f5-070cb19340e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--068c63cd-88fd-4d86-ab57-b6c4a3b04eef", "sighting_of_ref": "indicator--122c9931-9778-42d8-80f5-070cb19340e2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5eca77d-b037-4e43-a6de-60e0fe6685fa", "sighting_of_ref": "indicator--5ea8c10f-48b5-43c4-bec8-a1769f2638f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--482d8a07-1837-489d-83c5-73a812bcf4be", "sighting_of_ref": "indicator--7564e3d4-b87e-4bab-9a3f-c599ff38c2cd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86daeb2d-179a-448d-ad67-58abfa6e452b", "sighting_of_ref": "indicator--bdf51c14-9033-4da6-8738-211ea628913f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e27d3e0a-501a-4947-958f-0a41ba6bb442", "sighting_of_ref": "indicator--a96a90c1-a4db-4b75-a039-25d0ffa7978c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b35a477d-f2b7-4247-9eb8-426b337f95bc", "sighting_of_ref": "indicator--7807c085-a8d4-4768-a726-c3b9fbbcd53f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7d0592c-49a2-41ed-91d9-351453ae28da", "sighting_of_ref": "indicator--1c48cff3-e53c-42fb-bd40-f83ca9c56b46", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f017e3e-b2ab-4000-aaa5-386470297d79", "sighting_of_ref": "indicator--e6a5ce3b-7215-49f6-9b8d-239466725d9d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07409c72-41ea-43bb-8a23-32935f93073e", "sighting_of_ref": "indicator--20657849-803b-49b6-bf70-61f91200237f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b233a2e2-51e3-44ec-bcd6-7578e9f2f5e0", "sighting_of_ref": "indicator--20657849-803b-49b6-bf70-61f91200237f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08674254-e328-4a33-9108-428bf56785c2", "sighting_of_ref": "indicator--1eb7cd88-7e5e-4dd4-b424-f1e56a12df0b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b345030a-03bd-4530-a752-910351a1e898", "sighting_of_ref": "indicator--1eb7cd88-7e5e-4dd4-b424-f1e56a12df0b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--865f2d67-7082-4912-bc95-ee8d539ae91a", "sighting_of_ref": "indicator--b9c6cc16-61a3-43d8-823f-55a8ee73e97d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6318f4b3-19f2-45eb-87e1-28414e3fadd5", "sighting_of_ref": "indicator--ef06b2b1-558e-41d6-af35-625234ca24c9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e81696da-41ed-4c68-8fc1-4d39b3683a6c", "sighting_of_ref": "indicator--ef06b2b1-558e-41d6-af35-625234ca24c9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42b0fd65-06b7-4fa5-9ed5-2a74045e7cd2", "sighting_of_ref": "indicator--9cd7fe02-8eed-47f4-9046-9952189ec2b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ea7cefc-e801-43d7-ab41-a5f43f84f73f", "sighting_of_ref": "indicator--9cd7fe02-8eed-47f4-9046-9952189ec2b1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a1bef6d-4a0c-4317-bbd3-b60f84129e09", "sighting_of_ref": "indicator--7e5a462a-2c57-4999-92b5-d8b5fb8b1f61", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61be2f87-377f-456c-b617-e7e090448054", "sighting_of_ref": "indicator--7e5a462a-2c57-4999-92b5-d8b5fb8b1f61", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dc27dad-9839-48c9-ad43-afbc4b5e8f48", "sighting_of_ref": "indicator--5e84be82-d788-4d27-a9b3-d1de65702a9c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5f06a6f-d8ba-4a4a-9efd-1c105c7faecf", "sighting_of_ref": "indicator--5e84be82-d788-4d27-a9b3-d1de65702a9c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2af66b78-e854-4e9b-8aa2-b720a99f3e3f", "sighting_of_ref": "indicator--b52a0a36-bb23-4006-9434-a05e1aa8d85a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fcd66d0-7b8b-4895-b36e-6e78c36f82fb", "sighting_of_ref": "indicator--b52a0a36-bb23-4006-9434-a05e1aa8d85a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad0eba2e-31d9-4637-8d76-2f330a94fbdb", "sighting_of_ref": "indicator--a9641479-624f-4102-95eb-3b2a6cf6ace4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b05f7b5-af3e-4287-9c4f-721b75af0251", "sighting_of_ref": "indicator--a9641479-624f-4102-95eb-3b2a6cf6ace4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c777df1-7f3d-460f-a01a-5cc69cf39944", "sighting_of_ref": "indicator--c6c3cc41-5488-4720-aece-8b932f018eba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dd19cde-0925-423e-8693-b7a71a85beab", "sighting_of_ref": "indicator--c6c3cc41-5488-4720-aece-8b932f018eba", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08c3da0c-2f69-407f-a00a-7519c3a311d8", "sighting_of_ref": "indicator--102d2993-caa6-4532-ab9e-b4eec36bb2eb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dab27fc-1cb5-44b0-9be6-fb5c5fe5864a", "sighting_of_ref": "indicator--102d2993-caa6-4532-ab9e-b4eec36bb2eb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3daf3f7-6501-4b4a-be67-922bac6aa91a", "sighting_of_ref": "indicator--b3029b8c-9670-461a-9ebf-3d7b5b5320e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a86e4a0-79e4-4cc2-9498-53a257f7ed67", "sighting_of_ref": "indicator--b3029b8c-9670-461a-9ebf-3d7b5b5320e2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d6543f5-0ff8-4931-b818-4d2433794845", "sighting_of_ref": "indicator--850f2eec-2fbe-43f5-afae-e9607eab7e29", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d500f4bd-44b6-48c8-ba20-77424e80bc45", "sighting_of_ref": "indicator--850f2eec-2fbe-43f5-afae-e9607eab7e29", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cefd432-f6a9-405a-a46d-2cdc7b7fd6b0", "sighting_of_ref": "indicator--b0434361-99ab-449f-9aa4-5f10d205ddd4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1029dc2-92b6-49ff-bc63-7dcf27b9946e", "sighting_of_ref": "indicator--b0434361-99ab-449f-9aa4-5f10d205ddd4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19d57fc3-176d-4cee-b3f6-e4be38672495", "sighting_of_ref": "indicator--20e49140-e374-4c8f-aa0e-2439704fcfa5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4545794-cff6-4390-9b43-a1c07df95faf", "sighting_of_ref": "indicator--20e49140-e374-4c8f-aa0e-2439704fcfa5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9e8daa1-f8fa-4c59-ace6-34f844367055", "sighting_of_ref": "indicator--5f4992ec-a809-4004-a1ed-f4dfe5881acc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a230922e-bc52-4625-8ca7-f4985634e2f7", "sighting_of_ref": "indicator--5f4992ec-a809-4004-a1ed-f4dfe5881acc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ded480a-ae3d-497a-8c8e-dc508e407d72", "sighting_of_ref": "indicator--c5139ab2-640f-40f4-bb84-330b6facddf9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8eba166-5f0a-4315-804d-508784cba36d", "sighting_of_ref": "indicator--c5139ab2-640f-40f4-bb84-330b6facddf9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e733f52b-c732-4737-8cc1-6487bc3687d4", "sighting_of_ref": "indicator--ae3a135b-b7f7-45a6-a1e3-35502513812c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23009ee8-2d88-4d97-9241-281016779d4f", "sighting_of_ref": "indicator--064df9d1-273e-41d9-826a-729bba25b09c", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3196dbe1-0f79-406c-9886-8971e262b38a", "sighting_of_ref": "indicator--c38b7329-7b55-4d8d-b9e3-aaf663d7e3a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4c7c05f-16df-40d6-9048-70b6b5f09e41", "sighting_of_ref": "indicator--34756fba-e08e-446f-ad5f-a31d8e19b7ea", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0b157b5-7dfe-4448-acf6-823744cde453", "sighting_of_ref": "indicator--34b73d94-85c1-43f5-b8c5-ac4a877a1da8", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c622c7d5-0001-4acc-835f-a019c9446919", "sighting_of_ref": "indicator--2751925d-c346-404b-a18e-368d09d1625e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ede1e5b2-1ecf-451a-a508-6f511e71aaa3", "sighting_of_ref": "indicator--2751925d-c346-404b-a18e-368d09d1625e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--116135d1-fbb7-48da-aaf1-0094920f4aff", "sighting_of_ref": "indicator--3a4d0e1c-af26-49ba-ba87-7bc64527e30e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--656712c1-fa73-49f8-b4d3-892a3f2af0a2", "sighting_of_ref": "indicator--3a4d0e1c-af26-49ba-ba87-7bc64527e30e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8751917d-9b52-48ea-b053-bda112aba86b", "sighting_of_ref": "indicator--1fc9757e-cdec-44c1-a366-b59b757433a1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c31487a-7235-40cb-a4f6-0aacddc2ab04", "sighting_of_ref": "indicator--1fc9757e-cdec-44c1-a366-b59b757433a1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b310b874-fb1b-4b42-a90a-60a98eaf98dc", "sighting_of_ref": "indicator--14167811-a7aa-486e-9f8e-efcacac09587", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f16dba48-d42a-4048-ac93-64bc946264c8", "sighting_of_ref": "indicator--14167811-a7aa-486e-9f8e-efcacac09587", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47106154-5b43-467e-be64-3cee053e5cb3", "sighting_of_ref": "indicator--bec1ae37-e858-4d84-8c31-b41ee5682571", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e30b5478-f294-4a99-b41e-f53e2acd24fd", "sighting_of_ref": "indicator--bec1ae37-e858-4d84-8c31-b41ee5682571", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6234e31-1d4f-4da6-b765-712a9d2b02db", "sighting_of_ref": "indicator--1c68afd0-df33-4322-b4c9-7227e6e6dea9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d66f0159-33ff-4105-a092-74dfb0f5b896", "sighting_of_ref": "indicator--3e6f6c1a-deb1-4366-b05f-a108edec3d2e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c63a337a-619a-46d5-83c1-2d6f805b1de7", "sighting_of_ref": "indicator--c96adad6-b80a-42a5-ad28-3d64f2ef3f0a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42080eb6-aaeb-4c8a-8729-b7ba66da9912", "sighting_of_ref": "indicator--c96adad6-b80a-42a5-ad28-3d64f2ef3f0a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7064525-5dd0-4431-aa57-0533e236d487", "sighting_of_ref": "indicator--b7d758e5-1741-4598-9eca-cb77d27f57c3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78429d9b-3739-493a-8655-8fc31ab87230", "sighting_of_ref": "indicator--b7d758e5-1741-4598-9eca-cb77d27f57c3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e25f5f05-ce75-4dda-9d81-efe919d09a8b", "sighting_of_ref": "indicator--83e81ea1-2b9b-4723-87bc-53df5738acf1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5c2e6bb-dc8e-4977-a375-3c4c1e27bcd5", "sighting_of_ref": "indicator--83e81ea1-2b9b-4723-87bc-53df5738acf1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1795b516-a780-436d-8cda-0218980468be", "sighting_of_ref": "indicator--d01d46d2-554b-4eb6-ba9a-57242e1f8536", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67d6a24e-639c-4422-b3a6-e35202cd4a2d", "sighting_of_ref": "indicator--d01d46d2-554b-4eb6-ba9a-57242e1f8536", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c1ce5ce-6b14-4ce6-8b15-85d18142b773", "sighting_of_ref": "indicator--0286fcae-374a-476f-b52d-0db318771dae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f08bafad-4aff-4a66-87d9-63d5aadc9a24", "sighting_of_ref": "indicator--0286fcae-374a-476f-b52d-0db318771dae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d209c8b8-5da9-4ca4-9328-becd0bf44fe8", "sighting_of_ref": "indicator--f83ed600-2f8a-4680-b4db-e63f04f05ae6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fde7a42b-fd82-4bd7-8113-66c5b24472cd", "sighting_of_ref": "indicator--44063a49-9444-4276-bac7-f24e11c24c55", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d5e855f-1929-4f55-9246-55ef171cad2f", "sighting_of_ref": "indicator--b03d852e-895f-40e4-b921-46e37cd295ef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccb8c3b8-b45a-466f-a3bd-e6be12093f4a", "sighting_of_ref": "indicator--b03d852e-895f-40e4-b921-46e37cd295ef", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ea993e7-f2b7-4488-b39f-aefe0ab21ba2", "sighting_of_ref": "indicator--1ddb4e56-e066-4bf7-8033-c6aebbf8bbfc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a82c149a-39a4-456c-b607-3b41d7054d12", "sighting_of_ref": "indicator--1ddb4e56-e066-4bf7-8033-c6aebbf8bbfc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f531439d-4e56-4d14-9e89-c25ca1fe1e56", "sighting_of_ref": "indicator--2993d64f-9496-4d8e-ac72-ab5caf1a0de3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08e691b1-c303-45f3-abd1-008573f9b1aa", "sighting_of_ref": "indicator--4218711e-8eaa-4c0b-9976-c47f589fb519", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21ad3940-5cdb-4f0f-824e-4f3e86743eb2", "sighting_of_ref": "indicator--8737bda9-7740-468b-b338-7079a124148e", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e17940e0-1c86-4a36-8b23-b72d3da74acc", "sighting_of_ref": "indicator--6349c3fb-edfe-40e3-b979-e668231d0e3e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66c0bf5c-5e64-4e58-a096-cf73a2f9dca7", "sighting_of_ref": "indicator--10cd5745-3863-4ce6-8945-e2c9b91115a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5973ebf-11c0-418a-979e-016ac6e14c61", "sighting_of_ref": "indicator--9b6aeda4-158a-4a35-ac8a-11bbc93d4eb8", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9034e9b-46da-42f1-87ac-fe2fed71f96a", "sighting_of_ref": "indicator--aa648157-10bf-46af-9d1e-043667179f6a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb5cb7eb-bfec-4068-bd20-42e725a25d75", "sighting_of_ref": "indicator--d15b436f-3533-47df-8cef-cf6569a41242", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e0c97fc-cfab-410d-a8b6-35446adfab2e", "sighting_of_ref": "indicator--761b157b-5f70-4924-85fb-90b1032744da", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea69db63-3978-405a-af63-6eabb2cc54cd", "sighting_of_ref": "indicator--d5904a0b-ab40-425b-9c30-40d34f7cd82f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a9146bd-d291-43ed-b3e3-666363ed16de", "sighting_of_ref": "indicator--af9e0e81-ba70-4020-83ab-a425e947a739", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b546a3b9-1d5e-46ce-9fe9-4b8255e9b64a", "sighting_of_ref": "indicator--344ffecf-282b-4af2-b97c-b58998f44f4d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7791a78-ef24-44e2-9bbd-5774e0ac21ba", "sighting_of_ref": "indicator--344ffecf-282b-4af2-b97c-b58998f44f4d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--134cb20c-568a-4bd1-ae5a-c641003e9b70", "sighting_of_ref": "indicator--13ce7383-b20d-4134-bf5e-15187e00c3c5", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--733700f6-6dae-4cbd-bc4d-8cd83875f091", "sighting_of_ref": "indicator--13ce7383-b20d-4134-bf5e-15187e00c3c5", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8ded298-e382-4acf-8404-4e2a9b680544", "sighting_of_ref": "indicator--49b44569-8673-4cc6-8855-8dfe95a97610", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--327ec166-76d8-402b-ad18-14b59b4d4258", "sighting_of_ref": "indicator--49b44569-8673-4cc6-8855-8dfe95a97610", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efd8762a-f624-46aa-8a8a-b68cf85d206e", "sighting_of_ref": "indicator--6ff912c5-45c0-4a29-99be-e614b1584001", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad4c5222-d747-41f6-9167-747a8b69d9e4", "sighting_of_ref": "indicator--7e72eedc-9206-4127-9c28-814355d18b2d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1fa4a73-a073-4f16-a5ee-56a815a21867", "sighting_of_ref": "indicator--3ea39083-3d46-484d-a588-86e15b8e1c62", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19dbc800-52d2-40cb-9b7d-1260b68687c5", "sighting_of_ref": "indicator--6d441741-cc2f-4ba9-b3ae-fa99ee961745", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0eeb99b-5044-451e-a556-e505a297ae4b", "sighting_of_ref": "indicator--1fe3e2c8-a797-4089-bf16-efe742682e92", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0e251bc-2d92-4251-81fa-9e675b574074", "sighting_of_ref": "indicator--0301f51d-ee26-4db0-919c-e36dcc56dbb6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1aa81ab7-829b-428a-8512-f6e341dc511a", "sighting_of_ref": "indicator--0301f51d-ee26-4db0-919c-e36dcc56dbb6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea6f6715-c937-450a-958b-7dd129963f01", "sighting_of_ref": "indicator--c33e607a-c232-4458-b214-35f9888ed788", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--020d56d1-3f34-4c48-aabd-22c22325d498", "sighting_of_ref": "indicator--2c6a3328-8a59-43c5-b5bf-7d7d662d30b2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--854bcf17-d4f3-400f-8393-b8d6fff6f676", "sighting_of_ref": "indicator--b880698e-4453-43c2-983d-b158d1343ae7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4515de02-6e79-4821-aac0-44c9696e3f73", "sighting_of_ref": "indicator--f3a3f02b-e719-499c-bb4a-c1d67a454603", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea0eb4fe-6e60-40e2-9e83-ceac23604c03", "sighting_of_ref": "indicator--3bd45bdc-b870-4887-a60d-909b2a5e4201", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b63e007c-d060-4d64-93a9-f17e89d43d83", "sighting_of_ref": "indicator--463e7b9f-73fb-496d-9c41-b73b336884cd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79e98850-a5d0-4906-89d4-a752ab451c8f", "sighting_of_ref": "indicator--04633542-6614-4684-ab0d-c1f94887bedc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--893226d3-261e-4e79-8846-cb248cf1311e", "sighting_of_ref": "indicator--04633542-6614-4684-ab0d-c1f94887bedc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5090159-b9cc-48ed-95dc-39ac137f7258", "sighting_of_ref": "indicator--d4af73ba-83c5-439e-9670-f09a44d46ae4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51535bb2-dc41-4a9f-a4c3-4c237f8ef268", "sighting_of_ref": "indicator--d5d1e954-29f6-4a33-8dfb-3c31af7bdbe0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--235baf08-e8b0-4ec9-af19-7481201e75d5", "sighting_of_ref": "indicator--d5d1e954-29f6-4a33-8dfb-3c31af7bdbe0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73f18b59-084b-467d-be4f-4fd44f410020", "sighting_of_ref": "indicator--f68f2c69-9b72-4bb4-86b6-dd01201fae16", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6958f79-a2ee-4f01-ba96-624cacebc839", "sighting_of_ref": "indicator--f68f2c69-9b72-4bb4-86b6-dd01201fae16", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--094c7585-1463-44e6-be67-7eb8ca984fee", "sighting_of_ref": "indicator--c0fb9dd0-534f-4279-945e-c4b93738406c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29b4b086-d76a-4aaa-bf61-ff99f17ee1e1", "sighting_of_ref": "indicator--c0fb9dd0-534f-4279-945e-c4b93738406c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64cee849-9b09-4342-ab5d-9e0bfadc3913", "sighting_of_ref": "indicator--29e19c4b-a87a-40e4-a060-f92e2f50d9f2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8345f9b-2bb2-452d-8f28-777da7d5e6f6", "sighting_of_ref": "indicator--5a8c96a4-61ad-4fd7-a7a5-cbc5a67918bf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c82b6ee-101a-40f7-bade-1dc9f83460a4", "sighting_of_ref": "indicator--5a8c96a4-61ad-4fd7-a7a5-cbc5a67918bf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--510110ea-720c-4af7-bc6b-0e12f68d90f4", "sighting_of_ref": "indicator--30322b43-43cd-42bd-a1d9-f83d2c124c9a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d14f0e4c-b453-40a1-bd2e-507f2e0a8eb6", "sighting_of_ref": "indicator--6dd4fdfa-0b79-4950-8dd7-2db05579108a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b553ba8-9cd2-466a-a105-06cbd51da150", "sighting_of_ref": "indicator--57fec7e9-030b-4ad9-bcc5-340f60d51d0b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9731d05-b7ae-42e4-b2fb-1d15efeb196a", "sighting_of_ref": "indicator--8cf33263-c62c-4620-9ca7-38e9d25b4f07", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a12da869-f8a3-4a77-b9fd-a7109aa7bf5f", "sighting_of_ref": "indicator--c4594651-5312-4293-8821-fc8eaa9e30d3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6ea1970-9e7f-40d0-8dcb-b31faf2672e5", "sighting_of_ref": "indicator--c4594651-5312-4293-8821-fc8eaa9e30d3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3372ae3-4e6c-4eae-a694-f733087ab9af", "sighting_of_ref": "indicator--f3fae7b2-d87e-493e-96fc-03a58c3cb79c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1fc5c43-cb3b-4716-ae42-869ad53d8441", "sighting_of_ref": "indicator--2587c699-a8da-4ae4-9a84-2e705f367c23", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bef934b3-da39-46cd-b1fb-ae9d78a813a7", "sighting_of_ref": "indicator--2587c699-a8da-4ae4-9a84-2e705f367c23", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69774b2f-aca8-4edb-bb1f-06e15f9af0b5", "sighting_of_ref": "indicator--4379a3ac-4ea5-4d6f-a03c-4df0cafb67d5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--518232c1-3908-44d9-8b7a-026f22d86b96", "sighting_of_ref": "indicator--4379a3ac-4ea5-4d6f-a03c-4df0cafb67d5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af34bd45-4fcf-4998-913b-1bd6c1cd7278", "sighting_of_ref": "indicator--802f0be6-b3a4-4bd6-ae5c-e78fbb0ac175", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0cffb04-45ab-4a52-b0a2-e0ca978ccf90", "sighting_of_ref": "indicator--a4c65250-788c-43d2-a8a7-3751d23fc7ee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69ec048f-9ccf-4427-96c9-b7e181205c13", "sighting_of_ref": "indicator--a4c65250-788c-43d2-a8a7-3751d23fc7ee", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62ad452d-8631-4d64-81e6-826500ff23bc", "sighting_of_ref": "indicator--c31a1bfb-46f3-40bb-aef3-040276e158a3", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3794456a-3066-4e64-b01a-3ce257b9429a", "sighting_of_ref": "indicator--c31a1bfb-46f3-40bb-aef3-040276e158a3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5effd207-ee2d-4a98-bf19-93c7a0b3585c", "sighting_of_ref": "indicator--c31a1bfb-46f3-40bb-aef3-040276e158a3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e287c10c-8e4e-403c-9876-02ca3e7b2bd2", "sighting_of_ref": "indicator--c31a1bfb-46f3-40bb-aef3-040276e158a3", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f2fefc1-6abe-4e0f-86b7-99eb603cde3e", "sighting_of_ref": "indicator--bfa4a47c-abd1-4850-a59b-5ecdb3b22a4a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e48646e2-74ae-4ff5-b93a-338764ba587d", "sighting_of_ref": "indicator--bfa4a47c-abd1-4850-a59b-5ecdb3b22a4a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cc649bf-9694-49cf-9069-1b9274b7429f", "sighting_of_ref": "indicator--46014158-7bf9-431d-88bd-f395ccdf578a", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5c7306b-da16-4eec-9193-6b97e7666505", "sighting_of_ref": "indicator--46014158-7bf9-431d-88bd-f395ccdf578a", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30cec121-d5da-4b3e-9df4-a8fe85ac7938", "sighting_of_ref": "indicator--46014158-7bf9-431d-88bd-f395ccdf578a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf32c998-3f31-477e-9ac0-0f23852c49fe", "sighting_of_ref": "indicator--46014158-7bf9-431d-88bd-f395ccdf578a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aa61608-e4cb-413a-baf0-c30c2e21c7d3", "sighting_of_ref": "indicator--46014158-7bf9-431d-88bd-f395ccdf578a", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8e1fe9e-798d-45d6-a499-5163d124fda7", "sighting_of_ref": "indicator--e35289a7-761b-49d5-91b6-0fcb7fa477fe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9aa6fd57-6cca-40c7-a607-10a2df477fd1", "sighting_of_ref": "indicator--e35289a7-761b-49d5-91b6-0fcb7fa477fe", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d17cd82-b1b7-4771-8b5c-a209ee9c231b", "sighting_of_ref": "indicator--9d48f1ae-f0ad-4c1f-822c-4e1abb9016be", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c540c258-50c6-4e1f-ae28-cd566e942810", "sighting_of_ref": "indicator--2c040dea-3eea-44ff-9c72-48ca018a9c80", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46f65dd1-1b5a-4747-9799-a1a30e48ebf2", "sighting_of_ref": "indicator--be338b61-abf1-4d90-ae8f-ef87cc3f18f4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d669c1cc-b8c6-4306-870b-e39d58ef3828", "sighting_of_ref": "indicator--28aeef33-b02f-4c9e-a5f8-8bd976b4d897", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85d234ef-7c5c-431c-8db0-44bc141c5de2", "sighting_of_ref": "indicator--fd1b8b0a-8a9e-46a9-a199-b5f5ecc9c238", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98836dab-f122-4cfa-8e3b-788f8e370492", "sighting_of_ref": "indicator--fd1b8b0a-8a9e-46a9-a199-b5f5ecc9c238", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4bea9df-6d36-4bb0-bcc8-4d20aef20a63", "sighting_of_ref": "indicator--2ebd95c7-bc34-4f49-a557-b2514ab7b3e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a58cb31-dc8f-49da-b129-f67947f2365a", "sighting_of_ref": "indicator--2ebd95c7-bc34-4f49-a557-b2514ab7b3e2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0de61e11-e1ff-4e43-b74f-a8faa9229929", "sighting_of_ref": "indicator--0bcc853f-cf56-452a-8b50-c835b074db59", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b709ab3-924c-4f96-afc6-bab6e5489953", "sighting_of_ref": "indicator--0bcc853f-cf56-452a-8b50-c835b074db59", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ff6f15f-2825-46d0-9436-de3b769069dc", "sighting_of_ref": "indicator--ad3e5f84-1c99-455b-adea-341c4c04969b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d7f9a5e-e420-40d3-8ec2-ab0cf3b9d05c", "sighting_of_ref": "indicator--ad3e5f84-1c99-455b-adea-341c4c04969b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99f96e62-2709-4f93-9f0b-a5c8cab44794", "sighting_of_ref": "indicator--dbba61fc-ff6f-41e3-8acd-4063ca9a9c87", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61675c16-5fc3-4853-afbe-e8849e2259b7", "sighting_of_ref": "indicator--c878458d-35d0-45a5-bade-c57c1a415e23", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fd3071f-2f47-4a7c-a4c4-8034f588efa0", "sighting_of_ref": "indicator--c878458d-35d0-45a5-bade-c57c1a415e23", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d28d2b05-91a0-464e-8da0-5afef966cfe6", "sighting_of_ref": "indicator--478165f9-5434-4ef6-9030-64f07a00026c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24649d52-73f6-485e-ae37-c43a421b6560", "sighting_of_ref": "indicator--6f3de3d9-e051-49b1-8934-564d68c2dee3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2d09874-bb99-4514-b909-547d444dc186", "sighting_of_ref": "indicator--6f3de3d9-e051-49b1-8934-564d68c2dee3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f098ef29-5409-418d-a566-6234d66bfb78", "sighting_of_ref": "indicator--fe00e4c2-0c3f-491c-9780-736d5452cda1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ced87f7e-4c81-4d4a-ae42-53c24c0291f2", "sighting_of_ref": "indicator--16572e8a-cd61-4410-893b-adb831cf8a05", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fe6360a-d160-47ab-aeed-a1b1c5b8f212", "sighting_of_ref": "indicator--1b530605-22f1-4c95-8599-38b45eae4381", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bac7891-14c7-43e1-931f-ce694129200d", "sighting_of_ref": "indicator--1b530605-22f1-4c95-8599-38b45eae4381", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f11b441b-a95e-467a-83e3-ed6557cc7038", "sighting_of_ref": "indicator--41118741-957a-4010-b3ca-b694e297266f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3465728-e280-4a22-8ca5-afdacd4ac50f", "sighting_of_ref": "indicator--41118741-957a-4010-b3ca-b694e297266f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cbb795e-db9d-43c2-a91f-5318c02810f1", "sighting_of_ref": "indicator--0d1c42c4-c865-41ed-8620-fc4194546753", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b63f9412-03a0-434b-8e50-92dc3fc60731", "sighting_of_ref": "indicator--0d1c42c4-c865-41ed-8620-fc4194546753", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--895cc967-4ff4-480c-ae77-86c4eadd5197", "sighting_of_ref": "indicator--1b9e9d35-cbaf-4343-9556-76e48c7dce3f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0252182-17e6-4791-beb9-0eb36facde82", "sighting_of_ref": "indicator--1b9e9d35-cbaf-4343-9556-76e48c7dce3f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91d723b7-a7c1-492c-9738-03e458bcf631", "sighting_of_ref": "indicator--2d679db0-89cb-4965-b949-bf04412cbbb0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9fb80ca-8b5b-43b4-96cd-44e9c91b44d6", "sighting_of_ref": "indicator--2d679db0-89cb-4965-b949-bf04412cbbb0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--464c65dd-a1de-43a1-8bb8-de5f7f10a243", "sighting_of_ref": "indicator--126732c0-4fe5-4049-895e-e6e3ea74d3cf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1cdcfbd-7a88-46a4-a20a-0fb22fe37647", "sighting_of_ref": "indicator--126732c0-4fe5-4049-895e-e6e3ea74d3cf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--066a429d-44e7-498d-a009-0b63adeb3f35", "sighting_of_ref": "indicator--4393939f-b7b3-4e07-afa0-0e27c972324d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63c36eca-5c2d-4bc9-b0f5-1abb2b0e43b7", "sighting_of_ref": "indicator--4393939f-b7b3-4e07-afa0-0e27c972324d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78ab012c-bbca-44cb-b0ea-210b0fbda37c", "sighting_of_ref": "indicator--cefdeaa6-147a-4310-9b97-86254edce077", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81017104-976c-4ce0-82e7-846e8860de12", "sighting_of_ref": "indicator--cefdeaa6-147a-4310-9b97-86254edce077", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b2ef2b5-c7c2-4fe0-8875-1fd7d15306c5", "sighting_of_ref": "indicator--b72831bd-9eac-46b5-89ed-c840a131fe00", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7791064-59ec-48ca-8477-1026d25f3e03", "sighting_of_ref": "indicator--b72831bd-9eac-46b5-89ed-c840a131fe00", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--188c70e7-13fa-4881-8514-4c868f0609ea", "sighting_of_ref": "indicator--b6b4e1e8-1fac-4daa-ad4c-dd7db73c7483", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b32be4e0-c3a2-4e71-b3c1-587ddfd771df", "sighting_of_ref": "indicator--ec7a196f-f06c-4c5f-811d-09db8a114b23", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e446dd66-3a23-4f36-94f4-fb7e7bf9f83b", "sighting_of_ref": "indicator--68bf945d-4c3a-46e2-8a0f-d42a20fcc0a2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--228b0ee2-4b5d-4018-a4be-f934c0943d1c", "sighting_of_ref": "indicator--68bf945d-4c3a-46e2-8a0f-d42a20fcc0a2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd3ef697-7225-431f-a800-37fd053baa93", "sighting_of_ref": "indicator--1e0db399-c2bf-43b7-b28b-e047d9e415c9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1deb8ff-5656-48e9-832f-8c1d1c5ada3d", "sighting_of_ref": "indicator--cad5af18-bf73-40d3-98bc-c06f0a824db9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06ad7b10-9d70-4724-ae2b-0e5d4f331bfe", "sighting_of_ref": "indicator--cad5af18-bf73-40d3-98bc-c06f0a824db9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a200b68-9b2f-41ba-97ba-8741321b2f67", "sighting_of_ref": "indicator--6ec31435-ac81-4539-afdc-c766370790c8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--451a26c4-1767-43e8-902c-1e36bdcb8090", "sighting_of_ref": "indicator--6ec31435-ac81-4539-afdc-c766370790c8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03682f05-3966-48c2-9b2c-d483878fb1ae", "sighting_of_ref": "indicator--20940f1a-da0b-4839-9489-1153473dab30", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee2bab20-f6da-41da-925e-70552f3fb67b", "sighting_of_ref": "indicator--9f3466cf-75fe-4c7e-b7f9-24d4a61d8fda", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdd9d2c1-c607-4d0f-b33c-db84b7494c63", "sighting_of_ref": "indicator--fd10bdf8-4a0b-4e15-9661-7c92122cd5fc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c78c19c-6b54-4fef-831e-9575aae77686", "sighting_of_ref": "indicator--b42f53fb-df78-4f4d-b1cc-f3d8b91aae29", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c9bcedc-0a52-4e28-8a96-6f967c4bd865", "sighting_of_ref": "indicator--c0025822-904e-4217-a03b-96d7721db26b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--188e9fce-92aa-4042-b32d-0ba60daf273e", "sighting_of_ref": "indicator--a33c63ed-6e95-4065-bf6c-108eabf676f1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--558f114f-e70d-4ab5-8789-d15faa81a3b4", "sighting_of_ref": "indicator--5eaffa56-60dc-48f7-949a-a7beb977e45c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3b922ce-58d8-4320-9052-346cc62f5e7b", "sighting_of_ref": "indicator--7256d878-20e2-438e-a5ce-ce88f18f57c6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8907d250-8504-4980-89fd-bf47314cd9d5", "sighting_of_ref": "indicator--bf76eeb5-1ae0-4b0f-b004-d3b62cc6e59e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a43ec3e-495d-4c3f-abc2-afdf2c07e106", "sighting_of_ref": "indicator--50d22a89-0552-468a-a0fd-69ecd86c6725", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9476d86-b4d8-4d7b-ada0-0797d5d5ec8f", "sighting_of_ref": "indicator--96ffceb1-8dea-45b9-a66c-dc4dd1d9048f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba26496f-36cc-4e25-b573-bf48555e1030", "sighting_of_ref": "indicator--e265f4ec-053e-47ad-a006-5ca8f11fe54e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bfe7bbc-fb42-4437-beec-afd3541040fe", "sighting_of_ref": "indicator--e265f4ec-053e-47ad-a006-5ca8f11fe54e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44c99c7f-1270-4657-804c-d901f0b46226", "sighting_of_ref": "indicator--a458f396-e5a4-4028-adbe-151a8056a72f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d24445a5-f7a7-47d9-aaa3-d85f0bc8728c", "sighting_of_ref": "indicator--ae0044b6-9223-47cd-a9a0-13e5f9ca61b1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feddd6f8-b27d-4af1-a632-5fda48db4ef3", "sighting_of_ref": "indicator--f929c72c-dbe9-48aa-b071-5d974432354d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca5a0b4a-cc77-4b8d-af22-9566fdf48686", "sighting_of_ref": "indicator--20b70c53-c233-4370-bf56-1090cc5d48d2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1d9b95c-ee02-4d35-a198-578fec58fb5e", "sighting_of_ref": "indicator--fc00c4b5-9b54-41f7-abd3-56e2f80807b2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dc8447a-052d-4726-b331-effaca083068", "sighting_of_ref": "indicator--3c3eaf34-adee-48e5-ba2d-8c6a2cdaea8c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--694d6497-d2f2-403e-8a52-0f55abce80f7", "sighting_of_ref": "indicator--ee8d0b73-3ac4-42ff-98c0-7ba37778835d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56861791-50a3-433b-887a-1d44f495f2cb", "sighting_of_ref": "indicator--a2d140b2-e0ee-4ded-a2da-c19fbb74ea9f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--138a6d2d-6c80-40f2-a2e9-5868a58d9af8", "sighting_of_ref": "indicator--82abf2af-7b11-478f-8579-b8724d7a95fd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5eb0334-b0e8-472a-b0c0-59f2a121f0ea", "sighting_of_ref": "indicator--2dad6664-87d1-4e96-a04e-b8eae943f6c1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a537ac9-8648-4c8b-83b5-705e3a4ecdac", "sighting_of_ref": "indicator--4495b1fe-8606-41cb-bbd1-5fc276936890", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5728e66-f4f7-466a-ae9c-9789f342cdfc", "sighting_of_ref": "indicator--6cacca3e-adcc-4c91-92ba-f4ef38e2b51b", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb2f3687-662b-400f-9ae3-798bbd853690", "sighting_of_ref": "indicator--f3a63003-037e-4411-927a-1943e9c0fff8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a32a00b-ef18-42c6-9858-5ff613b21c35", "sighting_of_ref": "indicator--513f8658-dd51-47c7-964a-7270519ae74c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9540e5a8-fec4-4672-9414-66ee3fe34f39", "sighting_of_ref": "indicator--41cc2bc8-8e77-4cc4-967b-82332bac5734", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32ad0027-fdd8-4381-80cd-529f17fad9ba", "sighting_of_ref": "indicator--4c28c3df-38a7-4d5c-baad-fa68d9a5a1c2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6d3ec08-09aa-439b-b5d7-4da09d4b8783", "sighting_of_ref": "indicator--836bc643-693c-4d10-9d27-c761695ec9b8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5bd8b40-ed57-4ce1-8a37-4de8b672a7b5", "sighting_of_ref": "indicator--d8af6c94-fef1-4b6b-93b2-c027c2418dc8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb60221e-071e-409e-a88c-dd5463c4c524", "sighting_of_ref": "indicator--6a15d94d-4fa2-4c05-9d36-b01ca55e4aa8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05c2b984-1aa2-4ef8-88ad-60dab051e809", "sighting_of_ref": "indicator--1073b95a-d281-4891-918c-54c375f78ac3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2a3f7fe-e492-4fc7-ab74-3f5830a5e778", "sighting_of_ref": "indicator--537a1d76-8c28-4889-af49-0b4978328788", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34648837-8324-40dd-8568-4e159f11ae12", "sighting_of_ref": "indicator--c5737401-6a14-41fe-aa94-0835447a1949", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3c86e05-8059-4003-a943-2f4b0a614f74", "sighting_of_ref": "indicator--b1a396a4-3efb-4edb-9927-0ce9163b451e", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fb1e8dd-f997-4cdf-9eec-b2564d925a06", "sighting_of_ref": "indicator--2d90decd-0131-4fe4-a596-750d79d37763", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33263e80-7b48-454e-8c31-d1dd4b6ba8ac", "sighting_of_ref": "indicator--9525f680-8cc6-4c83-b5cb-45c7cd26c017", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--073897ad-202a-4050-9b74-211aa578c839", "sighting_of_ref": "indicator--9525f680-8cc6-4c83-b5cb-45c7cd26c017", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91cd1c87-527e-4379-842d-631698861679", "sighting_of_ref": "indicator--a7bcdd17-cbb7-45fb-9717-9bab57b66af1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd022dbe-d1f8-47e4-9ee5-f16ac3a43ad9", "sighting_of_ref": "indicator--35cbd59e-2ffc-43b5-8fb5-d17038711258", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64148707-dcbf-4d15-9fd4-1239bd5a9184", "sighting_of_ref": "indicator--532f94fe-6692-4ad2-a965-2cf85a782e3a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a646e771-4465-434f-9eae-77caceafc29d", "sighting_of_ref": "indicator--fd24a7f8-e546-40af-81f1-2b33111201ed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dbf7b5e-9152-470e-87f6-36d1567a91ec", "sighting_of_ref": "indicator--2fe19b0a-fb3b-4215-8f02-575d74d60b96", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d0e10bd-6df2-414c-9ab5-85b494b0219d", "sighting_of_ref": "indicator--4f5ab791-bc49-4d40-9d81-b6d99a5d3b65", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14f7be2a-5f7a-44d8-8fb5-f4784ec909a0", "sighting_of_ref": "indicator--5e7d926e-e6ef-4238-a160-3ddba00d5664", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf641238-16bd-4086-a35e-07223fb0a35e", "sighting_of_ref": "indicator--5e7d926e-e6ef-4238-a160-3ddba00d5664", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e647e81-34b6-4752-80f7-25a39870636d", "sighting_of_ref": "indicator--5a1f0b28-5e8a-428e-ac8b-acaa2978479a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2e5edfb-aab7-42f9-b0c6-974b7236ef5c", "sighting_of_ref": "indicator--5a1f0b28-5e8a-428e-ac8b-acaa2978479a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1d1ee4a-3d79-426d-9504-399b8a6998f5", "sighting_of_ref": "indicator--2dce77f9-04d7-4d98-9fa6-5e6e9e416236", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82b4c81c-52c3-4dc6-b107-201af56e48e6", "sighting_of_ref": "indicator--2dce77f9-04d7-4d98-9fa6-5e6e9e416236", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50d31493-0895-408c-8a8e-6a9ac7ef6932", "sighting_of_ref": "indicator--1a4856c9-b59b-4656-b257-4b99fed66610", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3fe11eb-8959-4486-af13-4a7c755f184f", "sighting_of_ref": "indicator--c1cf8c01-9d9d-4f49-9191-4a296d595856", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0667e59f-f338-427b-89e4-8b1c0329214c", "sighting_of_ref": "indicator--056d6e90-d13e-4bb5-908c-0736f1955a03", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9179d73-40eb-4afa-b15b-de232470ae84", "sighting_of_ref": "indicator--c722ff61-5301-4a7a-bca6-f880419a710e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1c18a03-dfbe-4952-a797-976fdc9dcad5", "sighting_of_ref": "indicator--ecec7931-c6a7-4e02-9931-d261fea68ac0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d5cc643-65df-485f-9d76-b38381b3fc40", "sighting_of_ref": "indicator--ff4190d8-2ea1-4922-9b68-c202f736f6a1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae35d98c-f1f5-48d8-8b5c-1b50e4648130", "sighting_of_ref": "indicator--a9fe299e-53c3-45bd-8271-eb1c6a798631", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73afe389-eedb-436d-9fd2-4cc071e6aae2", "sighting_of_ref": "indicator--24fe1563-f5f2-466e-9222-3cf970b43dae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95add529-6549-41bd-9c8e-593e6049dce1", "sighting_of_ref": "indicator--32ee3d3d-2916-4596-8086-a7271c363f43", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--295974d0-691a-4f37-8e6e-e134bb5761d1", "sighting_of_ref": "indicator--12451352-de50-49f2-ae46-10e11186d134", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e825b276-608d-48af-b457-11d0bedf4ae3", "sighting_of_ref": "indicator--ea8cdf10-75aa-4db3-afb8-2c57bb8d4998", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78d2f4fa-30b3-4499-b3da-03ce1b53e325", "sighting_of_ref": "indicator--e2786cf0-e5c7-463a-8c0a-15de30d4b7fc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad08c830-f5f4-412c-9c0f-093557d02311", "sighting_of_ref": "indicator--af553af8-1c96-4b8f-bfc5-6fefc8632d21", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e9a9c0a-ff90-455d-b42e-910f1c7459a4", "sighting_of_ref": "indicator--b835f2bd-771f-4a4f-8202-a83fc3810638", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2bbc7da-98f7-4655-9269-fadfee88596c", "sighting_of_ref": "indicator--3da8d00a-73e5-4d2a-89fc-53d655f95ef3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d701684-c2f7-4da0-a8e7-a5cb1547f570", "sighting_of_ref": "indicator--ef3ef9e2-850b-46b8-82c9-818dd0a3cc31", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35f74499-a141-41a9-a7fc-9643d373162a", "sighting_of_ref": "indicator--a2fbaf7b-1095-4c94-9978-5680ba6708db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8d91622-8daf-474e-a60e-dc7e272fa09b", "sighting_of_ref": "indicator--3d6a8bb8-4872-4d3a-958f-ae6266b2cff1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29e0bf13-cfdd-4cd3-a091-1cec383b7763", "sighting_of_ref": "indicator--dc619553-72d1-4479-beb2-fd2864191b94", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfb4a852-66e0-4df1-a3ce-a39edb6e8740", "sighting_of_ref": "indicator--244fddf1-0f31-47e0-9084-a434b22859f7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09865baf-2904-4f44-96d5-647f9be5de71", "sighting_of_ref": "indicator--d597ac90-4467-4da1-9bcc-006d00e89de0", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f4c2dfa-4ded-46b7-b7f2-d3764bac233f", "sighting_of_ref": "indicator--0c56c4d8-3949-431d-ac5a-252729b85928", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--163be842-0ea2-4bc9-a8b1-9080c4e23bd0", "sighting_of_ref": "indicator--0c56c4d8-3949-431d-ac5a-252729b85928", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc50141b-43a7-4f7d-b1ac-ddc0573883bf", "sighting_of_ref": "indicator--8cb9cd3d-ba3e-4c9b-ad9d-6845f03a70ce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b27f938-cf3f-4014-9dc7-c55f3c4be87b", "sighting_of_ref": "indicator--a452eff7-8365-4209-849a-18ae087a2009", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebf46614-3683-4183-abcd-03e7ea1b1320", "sighting_of_ref": "indicator--f2dc75b6-4fcd-4b82-b5fc-779b1a8575f2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e24b082a-aad4-4c36-a2f4-8d45e29406da", "sighting_of_ref": "indicator--3c4ba8f2-af29-4963-a2f4-2e0313179b3f", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0f41e2c-5073-4487-8663-d3664fa51f82", "sighting_of_ref": "indicator--d86512da-af27-4e93-b989-19a3cb029398", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6325371-a24d-4551-bb01-5056bac7a8dc", "sighting_of_ref": "indicator--3ebad791-c3dd-4c6a-a844-9d9cfd062641", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--308e5280-05fa-4e82-a537-ff9887f0f015", "sighting_of_ref": "indicator--82153fd8-f0fd-488a-8557-76282050680b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b7d4232-7569-4086-8f61-f4125cd3765f", "sighting_of_ref": "indicator--f7012c17-8400-4d16-a53f-6e58f052e32b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e40610d-ea56-4773-809d-870d0fc2f12b", "sighting_of_ref": "indicator--f7012c17-8400-4d16-a53f-6e58f052e32b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ad56dfd-0a50-4c52-8d44-31bb6707a419", "sighting_of_ref": "indicator--9a454a61-94e4-40d0-b29d-b2544cfc70f1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d15874eb-1d6f-4d6d-a265-caf34a99d1aa", "sighting_of_ref": "indicator--9ec4434d-f9d6-446b-807e-cb8797267d9c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5d46931-c3e6-46c3-9afe-7e281738f472", "sighting_of_ref": "indicator--ac1a3c57-643f-42c2-be49-6a54a40201a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7837ef6-0ad5-4c7e-9ce5-f6529aea5fcb", "sighting_of_ref": "indicator--c789cd4a-7505-4ec8-9a94-9c59e0b5e844", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deaa0f1a-2ca1-4c3c-9054-c9cbb1536653", "sighting_of_ref": "indicator--c789cd4a-7505-4ec8-9a94-9c59e0b5e844", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff7d4f4d-056e-45c4-a9c9-67aa20c10e27", "sighting_of_ref": "indicator--e2fb249f-c8ad-4845-affe-e6a05b64ae06", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--797582f9-db8e-4a95-9345-1b05b53450e2", "sighting_of_ref": "indicator--da7c893e-bb31-4f40-9126-d3fdcaae2910", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d401336-9755-4f62-b3fd-1a66f31d7635", "sighting_of_ref": "indicator--da7c893e-bb31-4f40-9126-d3fdcaae2910", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f53efa4-f194-43a6-be34-a038fa3fc2b7", "sighting_of_ref": "indicator--fb3233e6-6ac9-4177-b766-bee2f2c5ebce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20de8782-4d6a-48a6-b5ee-ecdc56fdaa28", "sighting_of_ref": "indicator--e0e08a54-e39b-43d3-a614-9bdfeace5edb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3fc2ab7-7d32-4266-8cff-b6ce0f982e64", "sighting_of_ref": "indicator--e0e08a54-e39b-43d3-a614-9bdfeace5edb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b260b91-fc06-45f3-9e8e-91fc1f11a034", "sighting_of_ref": "indicator--2ba6d7e8-b17d-4cd1-a4ba-0de7fd358bb9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8c08388-31b4-491b-8c55-e5fbff3833e2", "sighting_of_ref": "indicator--2ba6d7e8-b17d-4cd1-a4ba-0de7fd358bb9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86faac1b-b281-4213-98b3-bc7a8653dc63", "sighting_of_ref": "indicator--2c53530e-188d-4e58-89a2-b13d39f41621", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaf8a8c4-698d-4084-af61-09babb00ea58", "sighting_of_ref": "indicator--2e76588e-ee88-4350-ba17-3a9fd18f68cd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21970465-4cb7-4707-bafe-fe3b5e7aee63", "sighting_of_ref": "indicator--583c48fc-88a5-4b31-a5f3-af86fc3d3b24", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed120b72-84a8-4b9c-bbf1-048409b0dfae", "sighting_of_ref": "indicator--d197de7e-ab67-4a3b-ac86-044a5f9e8a38", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4ed706f-9501-4e5b-af53-f0e38c6c4f11", "sighting_of_ref": "indicator--dfcc9549-acc2-4be1-9038-6fb5c13999f5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4de17f04-b28f-4b90-bd4c-b12fc50c8f1d", "sighting_of_ref": "indicator--d1a90008-0c74-4ef4-998c-f88d9ed13274", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ab081a4-40bf-498f-82fd-001ec0d5f438", "sighting_of_ref": "indicator--d1a90008-0c74-4ef4-998c-f88d9ed13274", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ed09756-374b-4a8e-9397-81d5dce96c64", "sighting_of_ref": "indicator--c0ce9a4d-f0ad-4ee5-9eab-77791f3b354d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ec431d4-b0b8-4db9-bb3c-770eceeb1654", "sighting_of_ref": "indicator--207b3f2a-3524-4032-8413-b85b17c8dff9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef8fc6af-c77d-48d3-bf39-535e45b0e805", "sighting_of_ref": "indicator--207b3f2a-3524-4032-8413-b85b17c8dff9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cf3332f-63f1-4dc6-92b7-72f743669ea0", "sighting_of_ref": "indicator--11e8f8aa-5048-45a6-976c-8a2a546303d4", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dd5d0db-050e-4bf8-a4f1-424d655601f8", "sighting_of_ref": "indicator--363d08e9-799b-4bc7-93b6-bc51273efafa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad80bdde-f3a7-44b2-8f78-4419ef5e9463", "sighting_of_ref": "indicator--b9aedafb-ae08-49a7-a074-687a818baa3d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c9a97f8-3d62-457d-8b18-53753baee88a", "sighting_of_ref": "indicator--e07f4d84-c1d0-4ea1-91b4-af9c1827f7fa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4c0fa76-e9e9-4f16-b1db-11436309018a", "sighting_of_ref": "indicator--e07f4d84-c1d0-4ea1-91b4-af9c1827f7fa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f62a1f0-0e9a-427c-8f3e-a8e51186a410", "sighting_of_ref": "indicator--cb220584-1df8-4646-b976-bc20e66503b2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98fb6fdb-c5d2-441f-9dd4-b13abc95159f", "sighting_of_ref": "indicator--cb220584-1df8-4646-b976-bc20e66503b2", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e432c1a-11bd-484e-8625-a00114df94cd", "sighting_of_ref": "indicator--04d21190-eecc-4710-b36f-90f485a65236", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d061c33-37b2-46ac-9d5d-b2e742f0ea6f", "sighting_of_ref": "indicator--842b6e0b-3007-429e-aea3-7f03b93c32f4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83e66916-2f10-48b5-a66a-340f3d8b4e9d", "sighting_of_ref": "indicator--04e2b61a-b035-4218-a94e-b3ded140396f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e79a9bd3-c6de-48ec-9fc4-284a65473ab6", "sighting_of_ref": "indicator--04e2b61a-b035-4218-a94e-b3ded140396f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dd6ab91-fc98-47ef-b060-e413565ff536", "sighting_of_ref": "indicator--9904dedf-ad7a-457a-b783-48d56fc3496a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11694888-a8d5-4130-a87a-35b993beb120", "sighting_of_ref": "indicator--ef24ca29-2aff-4807-b44b-4b6df366b9ce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4817cf6d-224d-47f0-a923-61c7e15d23a0", "sighting_of_ref": "indicator--b332682a-76a3-4d7f-93d0-1604587f9fb8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82353f62-e515-4e18-91cc-a0a1ff12ef7e", "sighting_of_ref": "indicator--b59c5796-2e5d-488e-bf4d-6df30301a64b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4971285b-9f38-4a70-80c2-f39763f3c9a8", "sighting_of_ref": "indicator--b59c5796-2e5d-488e-bf4d-6df30301a64b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ba4b2a4-695d-41fe-9a01-5922ecfbc5a6", "sighting_of_ref": "indicator--0e1f089d-02d4-46bc-87a3-fd2dffd677e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c690f5fb-50a4-48bc-b570-93e212336666", "sighting_of_ref": "indicator--3a8a1ecc-74c4-4fe7-bdd4-c2457653445d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b8fd85b-a84e-4af1-b8ff-28dbe58812e3", "sighting_of_ref": "indicator--35e02c21-529b-42ac-bbd3-97c7d6f20467", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--195f824e-0011-4208-92c8-66e98e9f4704", "sighting_of_ref": "indicator--32f8679a-e718-44a3-a4e7-7d7464545881", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48f8efb2-7072-43e8-a2f9-85150ceed2b8", "sighting_of_ref": "indicator--2d65076d-6593-4baa-95c2-c3705cc71993", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d14d8df6-286c-4ca2-a6a1-ca96f9c65819", "sighting_of_ref": "indicator--6fb36879-5d6c-44e5-a1c3-3af40981335f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4701dfa-2726-48b9-bd8b-b766e453de68", "sighting_of_ref": "indicator--562396e9-3b4b-42a3-a054-2952cad8306d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--720d30b3-4a08-4bc0-bdc4-2fa6799ae371", "sighting_of_ref": "indicator--22e8298b-907c-4df0-995a-253f3a805541", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92944147-39fc-4736-b4a2-acfbb0683eb7", "sighting_of_ref": "indicator--7dabeaa9-efb1-4a25-8267-c63c8c7cc6a9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47a02308-a26c-48d0-908e-c2bed31fe872", "sighting_of_ref": "indicator--c5a314a6-6d0c-433d-8221-30ad618914c4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26fe4f87-7ab5-4908-bf82-c38d90cd44da", "sighting_of_ref": "indicator--2193f25c-2ad1-47c7-925f-430c2d8099ba", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--483829a3-fcf5-4ac1-8f9e-16a74adb9733", "sighting_of_ref": "indicator--6e15e773-1723-4b51-a413-fe0f45a79621", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--088510c0-f3d9-49d7-82e5-d56a3645df30", "sighting_of_ref": "indicator--e4708a6d-7a14-44db-b914-dcd70b4dd89c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--127d077a-f366-46b9-8503-99c3ab71298f", "sighting_of_ref": "indicator--8cf0ed04-3d89-4d97-b949-099df243f918", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--113fcabb-6734-4cc9-9ee6-5e9709f4d2b9", "sighting_of_ref": "indicator--e18f297a-97b0-40f5-b45a-921d0ed84552", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5660a5b7-ded8-4e3d-b340-cb82a33c25b7", "sighting_of_ref": "indicator--7561a7da-b344-43fc-95a4-b873f2f672eb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4dcb836-8e10-435c-9134-da18fd7bf938", "sighting_of_ref": "indicator--2a8f4155-5853-4004-956c-5ca4dac43f5d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b8dff17-1f62-4722-946a-81254a078cfc", "sighting_of_ref": "indicator--e0a51869-5764-4eb2-84d5-ddd418d802ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--013a531c-8070-49bd-a984-a605e3bc1823", "sighting_of_ref": "indicator--bef2ecaf-2ccc-42e1-b7b2-43f4eacb67b1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8b51f06-dd76-40bc-8dd0-b0a07fd0f839", "sighting_of_ref": "indicator--1cd70794-a4c1-437c-8ea3-1a98688e2a82", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35f5672f-8ec0-47a9-ab31-94bf40f52140", "sighting_of_ref": "indicator--f150a5c9-df57-4776-bfeb-27af70188eac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a65113b2-e249-4edd-9284-a3d8679bc921", "sighting_of_ref": "indicator--b1bd900f-3349-45ce-9745-064d79abf710", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--311991f0-c6ff-4ca6-957b-67166199ef53", "sighting_of_ref": "indicator--8d4981a5-397a-46b9-9b96-50e5e02ebf72", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64607771-04cf-48db-94da-38f8296dde5e", "sighting_of_ref": "indicator--0c38beca-bfa6-426f-b84a-586bb250ad3d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--703b7f3d-ddc7-4a5d-97a8-a6c75279628d", "sighting_of_ref": "indicator--0ee232b9-074f-42fa-81a2-25ccec8c30a2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fbb18da-94c9-45d2-ad27-337821e996fa", "sighting_of_ref": "indicator--f88ec160-968c-4120-84cd-5f452ba3ac19", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d25f437-4064-4a23-a9a3-e311ff5ef515", "sighting_of_ref": "indicator--946f045d-6423-454a-8d73-e562f361bacb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f5cfdd8-58f7-4e1e-b182-33a37e91194e", "sighting_of_ref": "indicator--2a6f25b9-680e-4347-abff-1b58c7041e31", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66cd93e2-79f2-45ec-8adb-eac052848636", "sighting_of_ref": "indicator--ae349b59-bf81-4e9a-b080-da6aa7e5dfb8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--045ec338-4364-482e-a4cf-d0a0ba89c56d", "sighting_of_ref": "indicator--9617b054-2a2f-4e8d-8d23-fee6007d96b2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3520eeb2-713f-4459-a139-6fbc5f7a409f", "sighting_of_ref": "indicator--f93c95f9-60eb-42c7-b95a-24946dad83b2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e2ab1ff-9c46-4b29-a8e8-8d252f6fdb9a", "sighting_of_ref": "indicator--46d32ed6-0f5b-496e-95fd-a3534c97f2de", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--496ecbfe-5e54-4b91-907d-7ec6b3028850", "sighting_of_ref": "indicator--cb300715-56b5-4a79-92b5-1ebc3fd389b3", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--230232f5-524e-4a8e-863a-d370eb40e5ff", "sighting_of_ref": "indicator--cb300715-56b5-4a79-92b5-1ebc3fd389b3", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03806ca6-6eb9-400e-b62c-2ef14f636800", "sighting_of_ref": "indicator--2b19852d-cf06-4308-96a4-589f3dd13240", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b10e2b21-d224-4aaf-b3b2-1f912c53b21a", "sighting_of_ref": "indicator--ecdd5ec8-5198-4235-a1a2-ed8e92f8bca7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2ccd08e-f522-41ea-b1b1-0b7af748d7f7", "sighting_of_ref": "indicator--6873335e-2c4a-402f-bdf3-415260f31062", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae79e525-fdc4-44dc-831e-f3b0b73e881e", "sighting_of_ref": "indicator--e8aec5e3-619d-4c91-b234-e5066d414232", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2a55246-d9d4-41ff-8656-28447e0c210f", "sighting_of_ref": "indicator--f9c58744-0bf7-49e5-bf75-42dae18c5dad", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ef7936b-c3d1-466a-ae80-5f4809e74b7e", "sighting_of_ref": "indicator--e64a16ae-db93-4154-bda3-0003b6def93b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74740594-59dc-4b5e-8e5a-a058dc5eb503", "sighting_of_ref": "indicator--2a4b780b-8f0c-4df8-b4e6-1e477d58d5d4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db2fedc1-7dc1-47d9-a052-a4f2317cc485", "sighting_of_ref": "indicator--0dd942bd-54d8-4a02-bd22-ca60a3fdb39a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a9fc71c-ae14-402e-a7af-39c2c15b15ac", "sighting_of_ref": "indicator--4f1850c3-79e5-4ca6-b968-2ab83092eb89", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bb554ce-53ba-4cf1-bf57-b21d3c031422", "sighting_of_ref": "indicator--94a3c384-f2c0-4202-9bb2-6dd0c27f4d0f", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddc59160-81de-4246-899e-9b56c866be42", "sighting_of_ref": "indicator--94a3c384-f2c0-4202-9bb2-6dd0c27f4d0f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2733c2c-c682-459c-9364-f55cfc30cb5a", "sighting_of_ref": "indicator--24e94c68-fe75-4f12-9e98-6cab390f5fc6", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cedce62b-2a81-4906-8639-2aa74df13921", "sighting_of_ref": "indicator--b99d2275-abb8-4f6e-8f8d-142063870edb", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfb530d0-d14a-4655-937d-c42ad1371bc8", "sighting_of_ref": "indicator--24a8fa60-7a75-4149-8d14-83b647d781d7", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3f34211-d5e9-479d-8ff9-8244611ae024", "sighting_of_ref": "indicator--364f5eb9-8ca7-45cb-a8a4-2da752043651", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6a1d4e3-78ed-444a-9fac-2331e4f3beac", "sighting_of_ref": "indicator--4dedbfb7-512c-41ab-b4ee-bdba116acb91", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1685e99-72fe-4590-a780-6065106f8649", "sighting_of_ref": "indicator--a7a3ac7f-cdf6-480b-98f7-eb6b3f91a55f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cd54631-1181-40dd-9761-d2bfee572a88", "sighting_of_ref": "indicator--2c6dca25-7a40-41de-8399-19ad73e9fcd1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e4dd1f1-0c8f-4c00-860d-9b1291c36f89", "sighting_of_ref": "indicator--1021421d-4eaa-4de2-a477-47449bd660fa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5d66b1a-2e5b-4e26-910b-27df04fb1121", "sighting_of_ref": "indicator--a0e19781-dfd0-47c3-99f4-d7a2c82e5172", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44952923-42d9-4227-b939-06550fc27a57", "sighting_of_ref": "indicator--37536b14-e83c-44b9-993e-d0f22c9e11ec", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c71b008-68d3-4dbd-967f-451de49f9a8d", "sighting_of_ref": "indicator--c5334cbf-74d6-4fdf-9297-b43bf446f1b1", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20fe35d6-34ff-4688-bb92-320ff4082df2", "sighting_of_ref": "indicator--970351dd-b258-425b-9408-8cf4671fb2e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c54f53e-fbc5-4ae0-a07b-4c6688ee3d02", "sighting_of_ref": "indicator--bd994e59-81a8-4697-9269-8574f696aed3", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f9deec3-8610-4bff-94c7-6d55fc44529a", "sighting_of_ref": "indicator--5aa8d604-85d8-4dac-b23d-68ff615b670b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8107dec7-33c3-478a-bf2d-c400aeef751c", "sighting_of_ref": "indicator--d825d9e8-1187-4b4a-aa97-95288dfee48e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fced04c-da3b-401c-8b98-961d9856e8ac", "sighting_of_ref": "indicator--06609c8f-8974-410f-bf16-6e8dcd14f8e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0665be6-3de8-4c1f-8ad7-dd8a273a29cc", "sighting_of_ref": "indicator--a18e7b77-77d8-4400-a047-8f9736f81a53", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--988fe191-8610-4e06-adea-6b473eb5270f", "sighting_of_ref": "indicator--91803c06-ce81-4443-85c3-c4ab857e022a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1f8a44a-2cf0-43eb-8324-964fd6e9940b", "sighting_of_ref": "indicator--5270f40e-0ea6-4cf7-8754-35748cdf14bb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2e422ac-b018-4299-8354-cd2a0baa9adc", "sighting_of_ref": "indicator--0aa6e843-be0d-48a4-a0cb-e71124a37c41", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecc0d876-3915-4314-803e-3fd1ae605695", "sighting_of_ref": "indicator--a1561fc2-d9b4-4c8f-b3c1-11c6040b1cd1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0642aefc-6eee-431e-9924-a805d4cd5528", "sighting_of_ref": "indicator--ce8740ad-71dd-4e59-98f0-af08dc51f2ea", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bac28b9-2296-4ddb-9400-0b38e85287de", "sighting_of_ref": "indicator--6b35aea0-e9ec-490f-8422-7d600615cbff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--131f2032-b6a1-4e67-9559-4ca356c0fa93", "sighting_of_ref": "indicator--a3715dcb-86d6-476d-b8b5-3c63f5ae12d4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cfb2797-ba92-4b16-91dc-aa79c7a6233e", "sighting_of_ref": "indicator--6e258b18-193e-4c6f-8d55-d1dd40abc629", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d474bf0-8554-48dc-8a90-0ba4a319fd72", "sighting_of_ref": "indicator--abdcace5-85fd-49b6-bb44-7f1aafa1a97c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df7972ff-0d4e-4273-8af2-3341fae35ed6", "sighting_of_ref": "indicator--9c3280db-375d-4a8e-8db6-cb0d9d6288ae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c40cefe-d348-477b-81ff-2dc3fb00e5f7", "sighting_of_ref": "indicator--7773bddc-e800-4ea2-9059-f114f9ee052c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abd791e3-64ca-4946-8ccc-0276cfa2d98d", "sighting_of_ref": "indicator--029b9587-584a-46b1-9161-7c87cd6713dc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c7eef7b-2c38-496b-9a70-7cfaa1235423", "sighting_of_ref": "indicator--4e7d4516-d47e-4061-b6f8-008b87aaa60d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4407e650-3f4f-4a62-b582-f23f0d3e2724", "sighting_of_ref": "indicator--0990aef0-afc5-49a6-9a4f-ccb2047b449d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ae6ef9c-be79-426f-8431-f276b1dde74a", "sighting_of_ref": "indicator--a63fce44-a15a-4a6c-8cb9-07e874c902c4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23046101-46c3-440d-82cf-3bb76685840c", "sighting_of_ref": "indicator--6c4d0ee4-9ce0-4b1e-94be-e5edaee4121d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f577a34b-2013-415d-9bfa-2c5f6e3c0c76", "sighting_of_ref": "indicator--ba58910a-7346-4650-8bfa-e3107d63d3f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62d5ba6c-2fd1-43dd-a97b-8313871abfee", "sighting_of_ref": "indicator--9f47baa0-8c8f-43f1-a7b4-5ea25a087b9f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d84f3aa-1ad3-43fe-bdbc-6711e39bcf87", "sighting_of_ref": "indicator--bd00ba86-f309-4f1d-8959-4b9160649e9b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a65111f0-d6ed-40a0-82be-61566c967fcd", "sighting_of_ref": "indicator--504c733a-99b5-46ea-8b91-dd07a17038f9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--543fefe0-94c2-4a12-bc58-d02cc5823727", "sighting_of_ref": "indicator--4dc5d7e9-f239-44d7-aefb-bdf1a573e841", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--398a10ed-02fd-466f-8a00-95ea0dc9ef1c", "sighting_of_ref": "indicator--a2bb1646-3ed7-4b13-b532-8c5d014931ef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e316cc0-c785-41a4-95d2-32436cb51cec", "sighting_of_ref": "indicator--58bc587f-6b70-4024-b708-2b0a12fb6fc4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--720f1aee-9ba2-4145-8afa-ff79be857b7e", "sighting_of_ref": "indicator--1147f271-2ea4-4ae5-a2ec-f5b8abe4fd20", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8f00cfb-a7b6-4d93-a36c-75c250f80bc3", "sighting_of_ref": "indicator--eb0ec2ab-120d-47d3-9160-0bb127a11191", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc9fe4f8-0c5b-4677-ad05-56a401d028f8", "sighting_of_ref": "indicator--6c0b0810-8ba7-4749-86f4-7be4aadae462", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1f0348a-3229-484d-843b-11e0f3ee4c51", "sighting_of_ref": "indicator--5cf6489b-74c3-4638-b21e-71e357398e63", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3208d84-e0e7-476a-8dcc-40bb8b9378e6", "sighting_of_ref": "indicator--8057698f-8752-4b17-8243-7510f21dc739", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6344d9a-d667-481e-bcec-f1d1d4c3c3e1", "sighting_of_ref": "indicator--f224681a-5962-4d89-aaa6-9c24cc68f123", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24f01182-cdf7-4d84-9a40-97b1f2a8c357", "sighting_of_ref": "indicator--21a51669-eb94-41de-b2c2-143094b2d418", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dc394e4-15be-47b3-896a-34b0f6732dc2", "sighting_of_ref": "indicator--12693c0c-bc52-4ee8-b25b-e37af1bf1116", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c64eeeb5-4b94-4b6d-a689-65609bdad487", "sighting_of_ref": "indicator--12693c0c-bc52-4ee8-b25b-e37af1bf1116", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1149e97-8171-4471-805f-b2d1d0ed0590", "sighting_of_ref": "indicator--02db0e44-f60c-43a4-ab1d-d65b51721d3b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66b11dc8-8e5e-46d2-9628-4f29ece166c6", "sighting_of_ref": "indicator--c1e29e8c-9917-4195-b78d-151aa755438c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85a81b6b-153a-4327-a8ba-c5663b7e4dcd", "sighting_of_ref": "indicator--bb0d53b1-2648-4ae0-a7bb-2fd5e0066083", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9fddc32-444b-4c4c-be42-659507d6a8d3", "sighting_of_ref": "indicator--088f3ce3-8d37-4b9a-82bc-61efe450873e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d52ebd1-e6fb-4108-9e5a-b5af747d15c4", "sighting_of_ref": "indicator--52c885e1-2e0b-4e32-acb0-cef4ce51a8e0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e7a3e73-06bb-455d-b35f-37b80abcd96a", "sighting_of_ref": "indicator--5a466c63-0231-47d7-9190-cc92b243cbe3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27ee6d82-16f5-4afd-b462-f292cc118343", "sighting_of_ref": "indicator--132d4a3e-376d-418d-8f7f-b398a102c7b7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8238234f-0ba7-44b7-9135-7b12ae52e0cb", "sighting_of_ref": "indicator--2a146708-794c-42fb-bf98-d749b0367386", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--053e2ae2-5446-462d-9e1e-2d91109ec5ed", "sighting_of_ref": "indicator--2a5c45c9-362e-4493-9dab-e0b6e4792c40", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af6b9183-61c8-4c2a-82af-834d0d8e5aaa", "sighting_of_ref": "indicator--060adacc-79d0-4814-93e2-b2e201c27795", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3378cb8f-03ad-4a6c-8178-f463ff103bbb", "sighting_of_ref": "indicator--32144b3f-3ab3-4a78-a1cc-0a18c680daf4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e83fa72f-8920-4e7c-8d4e-bda073238137", "sighting_of_ref": "indicator--4fc8d9b6-119c-4a3e-9817-a854fab45d8b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c742b95-11c0-4de4-902a-10cb62cff5f0", "sighting_of_ref": "indicator--f7366bf3-fad3-4354-a262-91fc5556730e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e6b547e-cb5b-4fed-a3d8-e9a0cccddcc4", "sighting_of_ref": "indicator--20efd5ba-56b8-4cd0-987f-106d016802d9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87d909e4-ef61-44b4-a192-b5454a090ab1", "sighting_of_ref": "indicator--d3411247-dfa4-4338-b443-a2cb86473c19", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2958f45b-b880-4d53-aa84-294276b05b60", "sighting_of_ref": "indicator--10b14fe7-9fa7-4c13-b1ea-347e25178f54", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--163ac54a-5374-4559-8ae0-b26dda7bf236", "sighting_of_ref": "indicator--c748b3dc-b142-4344-9e41-59899c0e0b51", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6431b1d0-de17-4927-b8d5-d9ee1cb84385", "sighting_of_ref": "indicator--fd827b44-5635-4e16-a147-50372eff8d38", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c034ff65-f1dc-4930-ae8b-4109d6d6c2bd", "sighting_of_ref": "indicator--fc18724c-a632-4a34-9aa3-bb98c5ee6d29", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e83468ec-b622-4a0c-8011-912d8e40bcf3", "sighting_of_ref": "indicator--fc18724c-a632-4a34-9aa3-bb98c5ee6d29", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10d38ccd-cc33-41c4-8b23-dd13149d23ca", "sighting_of_ref": "indicator--0c1853fa-fee3-45a9-9dd8-7ddbe2cb29d8", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b861278d-8206-4c4b-a2a9-7d1f5035e3d2", "sighting_of_ref": "indicator--55221106-e7f3-4cfc-9840-808507c53e4f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97ef9855-3f7b-4afa-987e-9408bae110e8", "sighting_of_ref": "indicator--9d8528f2-847f-4e14-a50b-1e8a75743cb7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7018c97-28e1-4bf9-913d-473258ad775c", "sighting_of_ref": "indicator--97619ab6-f4d8-48d5-a635-887d2f53f391", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eda8b987-4b51-43d8-a820-462188bb7e88", "sighting_of_ref": "indicator--ca4188be-7cf2-42b7-804e-5985a4d8a601", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b24c21b6-7bc8-4dc7-8a7a-850e35a15e14", "sighting_of_ref": "indicator--689f86e9-22ca-42d8-b16c-9639645adc5d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b16cca5d-0b6b-49f9-800c-86bdea0c1605", "sighting_of_ref": "indicator--b6970798-1257-478c-8d17-ce94acf9bc04", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24cfe63a-4cdc-47a1-812e-028c9819971b", "sighting_of_ref": "indicator--c01d8eab-5ca0-4db1-ba87-c31e9a454730", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dca80cf0-65ef-463a-b9e3-a69b8fddb86e", "sighting_of_ref": "indicator--c01d8eab-5ca0-4db1-ba87-c31e9a454730", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08805ed1-98ed-4f16-95af-7170a5d23c2c", "sighting_of_ref": "indicator--b08d0866-e196-4d9e-ba04-e5831a878f2d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--270df2d6-4860-4d19-bb4f-379d888c1802", "sighting_of_ref": "indicator--c746ad44-f9c4-424a-89cc-29e547dc66cb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24ed3f10-8aa5-48fb-b73f-785f6e83ff86", "sighting_of_ref": "indicator--c746ad44-f9c4-424a-89cc-29e547dc66cb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe6282b5-9909-48b4-a3fd-2524d728817d", "sighting_of_ref": "indicator--465fb32c-7b06-4510-8224-c261b478596a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7b2eeca-25d0-45e5-8de4-29bdc1b6059d", "sighting_of_ref": "indicator--a0b7311d-80a9-4f44-b760-0893269d26cc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d51453e-5064-4a3f-acc6-e56ead88bcc6", "sighting_of_ref": "indicator--e91fcad1-bc0d-4ffe-8cce-01f4405378b2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f143edfc-11b9-4fc0-804c-a94f21d0b974", "sighting_of_ref": "indicator--5b58ee44-3659-4454-a591-bef4b56160d4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a962d5fc-6137-47a3-bd1c-973581c5c05d", "sighting_of_ref": "indicator--b130dc74-b0c3-42ea-b2cd-2094e008c721", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--355e0f8d-79ef-479e-87dc-4bd4d6223958", "sighting_of_ref": "indicator--43ee2dad-df39-4572-9e1f-e14a2c69884a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c72c5fb-4a24-416b-8231-290816b2bdde", "sighting_of_ref": "indicator--dc56cc98-e970-4c41-b1d8-7de87394a8ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b89aa2cf-e616-4335-ab50-a6b790209ecf", "sighting_of_ref": "indicator--9a302740-ec30-4239-af8a-cd32b4c9bef6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f12f162-c5ad-4779-bb09-5eebd24a1880", "sighting_of_ref": "indicator--9effa3cb-ba13-4125-b5d9-7ff9c016e52f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ad3df76-9986-4ba4-8987-751e9538c2e6", "sighting_of_ref": "indicator--24c55c35-ea7d-40ac-8fb9-6f8311a31d27", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--956397c4-9c51-4fa8-bf08-fd0ffaf1d91b", "sighting_of_ref": "indicator--2f792065-ba7f-4a6d-8152-9c856c195f0d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db156cec-e426-4af1-aae6-6cf64b1c6a77", "sighting_of_ref": "indicator--6044099e-a032-49b7-b670-5e0ab5009b5b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7183d5d2-e17f-4ffa-923f-a1198badcf1d", "sighting_of_ref": "indicator--e499bb68-d864-439e-9300-99cb8d6c1b87", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1219cb96-b53e-4d04-909f-0bc627ee6d5b", "sighting_of_ref": "indicator--7925be83-7f09-4033-8a95-5e2faf48701f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c11927e-f01d-49c3-863d-77fae1352bae", "sighting_of_ref": "indicator--dea1d578-6b64-4bbd-8ed0-ba1604d4b492", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faf8286d-76a5-428b-b0ee-2c81be8632e8", "sighting_of_ref": "indicator--5999c117-de5c-4ff5-9b29-667926343cc9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--011b0b2d-c83d-47d6-9a33-8282b5c3ec34", "sighting_of_ref": "indicator--1b6e913c-466d-4a64-abc4-26ba5ff0cb90", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8693b412-86f7-4651-8293-def5f68e26d8", "sighting_of_ref": "indicator--3fb8bfc7-b484-4929-ad6d-5559f6a01be1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60029075-d4d3-4a01-8e6b-e70b9cf5faf4", "sighting_of_ref": "indicator--b0ad1015-1ff0-4f03-b8cf-6b993a9a436c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c8a60a3-ed23-4580-885e-76c260c6e68b", "sighting_of_ref": "indicator--dc49d75d-1058-418c-9b56-f455865d0067", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dfb6183-301a-4f1e-9020-6c60c406fe82", "sighting_of_ref": "indicator--d038f7b2-eea7-4bf8-9c93-49d3a9489338", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2f975cc-b8db-4477-9f4b-3469da942011", "sighting_of_ref": "indicator--5275a4d5-cd35-4333-8e14-f6e777b92398", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd510a9e-b49c-461c-a29d-cb706cb7934a", "sighting_of_ref": "indicator--4e427cc9-ad51-463e-a136-01b394c0f986", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5481147f-e367-4009-bcba-c74a4d29e993", "sighting_of_ref": "indicator--7f5bfb43-cce7-4c2d-a288-e62f9d75168a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4f61ce5-6bec-4d04-9af9-5e439158d307", "sighting_of_ref": "indicator--d6f82380-d439-4b08-a063-bd1b50cbedd8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c55ce315-f982-4742-b9b3-4607357c35b6", "sighting_of_ref": "indicator--09fa2710-4bbe-43f0-8427-c578fe531272", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a38e8697-9ac7-402f-9226-0298146bd602", "sighting_of_ref": "indicator--83d11b43-ae9a-4b97-b47e-ed373df6639f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c039347-b27c-4a1b-a872-f2a8b6ae4717", "sighting_of_ref": "indicator--3b73b8cd-320f-4c6f-bcb3-d4fe0b66018f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e86cc80-6118-453b-b7fa-988936896afd", "sighting_of_ref": "indicator--55d6e323-a472-4a59-9808-0505d5c5954d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d754ccb2-18ba-4906-b6eb-67e064569003", "sighting_of_ref": "indicator--605b98b7-0fdc-4e1e-b5cd-088582319beb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--294236d8-ab75-4b1c-8e60-290bae88afa9", "sighting_of_ref": "indicator--605b98b7-0fdc-4e1e-b5cd-088582319beb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac1d1a88-60b2-4cbd-ac35-4b16bec4248a", "sighting_of_ref": "indicator--2aaed40b-7983-4f14-8404-e9f4559d3c2c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78fc411e-b4a9-4020-a510-8e438ecc2672", "sighting_of_ref": "indicator--bd93d17a-68f0-4043-9e92-b4fd2db6998c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1438d78e-669f-4f2a-b79a-7598fd8bdccd", "sighting_of_ref": "indicator--14e059ec-9daa-416e-b33a-d43fc10be7e9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae5ab65e-97c9-4db7-aaea-384cac24d023", "sighting_of_ref": "indicator--b4c0a69b-3c0f-4d01-9582-34223acc3bca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fc9701c-a310-4808-93c4-4513016804ed", "sighting_of_ref": "indicator--bed7a881-e8de-4d89-a855-3d5c1e9daeb8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aea10d98-008f-4c94-8800-f9f9193f1d10", "sighting_of_ref": "indicator--02f8b970-16a5-4003-ac4b-78bc5d91bf4c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b6af703-26c8-4ae0-99e6-34e21bd3984d", "sighting_of_ref": "indicator--02f8b970-16a5-4003-ac4b-78bc5d91bf4c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6c852fb-3102-4494-a1c2-9d8a27f48d87", "sighting_of_ref": "indicator--0878fdb1-f343-4a42-bd14-040a40b3d2fd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1769656f-065b-4305-9c53-75d490e6d6a8", "sighting_of_ref": "indicator--79ce01ea-1e70-406a-b95e-750b627055a9", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b90edb8-7a6a-4166-9652-7ad6866ff28e", "sighting_of_ref": "indicator--8f42b1e7-2deb-4b12-91ab-5f2d99d86675", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6ce1c53-d092-41d6-a85c-35c1607fb951", "sighting_of_ref": "indicator--51f86d1d-2f56-484e-9b09-929fa605797d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb8db69a-fee5-45e4-bf9b-f221e8c43025", "sighting_of_ref": "indicator--507e168a-f1d5-41d4-9d84-4ff6a2419be1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae223595-4707-4955-b3b3-911d13d063b7", "sighting_of_ref": "indicator--507e168a-f1d5-41d4-9d84-4ff6a2419be1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9f8b014-d086-4f61-97b8-71bf93e7a3d2", "sighting_of_ref": "indicator--37ddbd6e-f4bc-4a52-ab40-cfd2166624dd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc8f1bca-f418-4192-932f-458e7a821e65", "sighting_of_ref": "indicator--07329355-b86a-454b-b382-8dd541077561", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44a1e2fd-6e8f-4794-a1a3-bda2e65dcf27", "sighting_of_ref": "indicator--aab0da12-d7ab-4d5a-bc5e-0c738488ce39", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--976d01ae-e364-4ea8-8a8c-8aca2afef96d", "sighting_of_ref": "indicator--aab0da12-d7ab-4d5a-bc5e-0c738488ce39", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f53f6fba-233b-4e44-8b96-e47ccb402aa0", "sighting_of_ref": "indicator--5bea2448-3869-4e6c-b355-709c86fdacc8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c17a492-1c0e-452e-b31d-3b7372fc9a6a", "sighting_of_ref": "indicator--5bea2448-3869-4e6c-b355-709c86fdacc8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fdcb297-ee11-4085-9d17-82d7a98d8180", "sighting_of_ref": "indicator--694169ca-6240-4594-9078-80a5ba4cd9e3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1ef2385-b296-4fa1-ade9-5cce0dc2d5a8", "sighting_of_ref": "indicator--f939af27-fb2d-4d57-bd9c-bfb35ee376c7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a53f8ea5-049d-4b5b-bf76-8ffa3c78d70d", "sighting_of_ref": "indicator--f939af27-fb2d-4d57-bd9c-bfb35ee376c7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--838b1c35-4a55-4f3c-85e2-5c0e08cfb689", "sighting_of_ref": "indicator--f4c082fd-7e8d-402d-8968-f7d282aa1a5f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2e4d92c-157e-4da2-9117-b51b88d4dd4e", "sighting_of_ref": "indicator--51d09303-de66-427c-a6c4-79d5b08478aa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8658156-3b2f-46bc-98c2-c3c944368036", "sighting_of_ref": "indicator--51d09303-de66-427c-a6c4-79d5b08478aa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e312fcd9-1684-4374-91d2-90d5d22b91ef", "sighting_of_ref": "indicator--0ea3146e-3c7d-4a33-8540-ee3ec994b6f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96650c17-e3fe-4005-95e8-8ee351d00612", "sighting_of_ref": "indicator--0ea3146e-3c7d-4a33-8540-ee3ec994b6f2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab24181e-dfe5-4974-9fc9-09f9c99e1131", "sighting_of_ref": "indicator--f7c1c964-9840-4b07-8c10-114a5073a5e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56466453-0c30-40d3-a75d-daec94c568a6", "sighting_of_ref": "indicator--28f560de-3bf0-497d-b88f-680a328b55a7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67c4d8d3-a493-4a78-bf49-e89f3ea3490a", "sighting_of_ref": "indicator--28f560de-3bf0-497d-b88f-680a328b55a7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--837c2402-e73a-4a9b-9c6b-47f0a0b88e08", "sighting_of_ref": "indicator--3d8e0d80-e5d3-441e-b897-baf65e083da3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--905420f4-2528-4e27-8154-0ccb762c84b7", "sighting_of_ref": "indicator--1c71ae07-fc00-44f0-92b2-5ad4f30f2b27", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--543b8d59-9547-4915-9f8d-938c2bd19b7d", "sighting_of_ref": "indicator--a965c41d-d6db-4f85-9a03-9cb323cfaa94", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88f308ee-968e-4d46-9553-cf01ff88d1c0", "sighting_of_ref": "indicator--9049b6c5-fcc5-49eb-b7a2-6f1e1be38f0e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba654010-f56d-483e-8e8f-8c82a178b689", "sighting_of_ref": "indicator--9049b6c5-fcc5-49eb-b7a2-6f1e1be38f0e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a774bde-4840-40c9-9b06-b6f1682918d9", "sighting_of_ref": "indicator--063e83a6-3b67-49fa-a270-3c39fab5974d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cf19df0-eb79-45a2-ad78-e13ccdbe0ea3", "sighting_of_ref": "indicator--fb9bcfd1-3706-4272-8bb1-2785958adfdd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb4fd266-438a-47dc-ba5d-26b0baab3876", "sighting_of_ref": "indicator--fb9bcfd1-3706-4272-8bb1-2785958adfdd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e80e6b7-59ee-46ea-a3e6-c205628ba715", "sighting_of_ref": "indicator--eacf68eb-5b90-4a34-a1a3-3cd42ba9901a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8589510d-b77e-497b-b2df-6ae4ee9a6616", "sighting_of_ref": "indicator--b5857a7a-0a13-4f18-b816-b487c6dccc6c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd884a82-5ad3-4129-9062-f2ca928fb093", "sighting_of_ref": "indicator--81899754-a012-4a4f-b189-c04bd29110d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37ca06fa-a5b5-4bee-acaa-7524b0841ec5", "sighting_of_ref": "indicator--81899754-a012-4a4f-b189-c04bd29110d0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba0af704-c882-43b2-b002-63bf33ca7ae3", "sighting_of_ref": "indicator--824d9499-034d-454f-93fc-270387fc7821", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d83012e-3df3-4324-a7e9-9923e0d4ee70", "sighting_of_ref": "indicator--752230ad-d3ea-4439-8ebf-4b2eff548f03", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a3c9f38-cb23-437d-a291-49427e6caf4a", "sighting_of_ref": "indicator--897c8cb3-10dd-4710-b99e-79b6b238e5d6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee045044-4eba-4134-89b9-6da14e87291d", "sighting_of_ref": "indicator--d991bb0a-6100-45b5-9d92-12fc63bc87e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c53b98b8-23c5-4ab5-9862-ec98a71a783a", "sighting_of_ref": "indicator--6a314b10-6b37-4492-8759-a8888a31ea5d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54418cc0-1667-47a9-b305-079733fbecce", "sighting_of_ref": "indicator--6a314b10-6b37-4492-8759-a8888a31ea5d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71ab91d4-b3d2-462f-a89a-df146f28d1fe", "sighting_of_ref": "indicator--60004bfa-664e-44f7-99af-854a0e6317b2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39075d00-b362-448f-9caf-eb1304eb55d1", "sighting_of_ref": "indicator--8f4c3196-7f6d-4433-9923-fc3e96787fb2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--396794cb-9f95-4f55-bcb1-83582933194c", "sighting_of_ref": "indicator--5a89ba00-7782-4c7a-9ea5-56e2ff7ed5b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d23ac412-cbde-4764-a6be-50578ea36767", "sighting_of_ref": "indicator--9e523c24-61ee-4af9-805f-21d3a11bbf76", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d61603d-795c-4062-beb7-f5edd9ad4c69", "sighting_of_ref": "indicator--f994dcad-9043-4b19-8803-0fa85e56024c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--534888d1-4e57-454c-b691-4b5f5b371dc5", "sighting_of_ref": "indicator--60331e7d-fede-4a9b-9125-68f5ef5ba1b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dd9b629-d1eb-4598-a6f2-93223e5682ee", "sighting_of_ref": "indicator--60331e7d-fede-4a9b-9125-68f5ef5ba1b6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be828e6a-321e-4fbe-aa09-e092701cb45f", "sighting_of_ref": "indicator--bf953ee9-8f91-47fd-a2e5-599444c9b4cb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d24bf79-6a44-4266-9d5e-6222fba17a87", "sighting_of_ref": "indicator--d2da69c4-b8dd-4907-a113-070a0e97fd73", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a35909a7-0e3b-4581-8009-c613460f524e", "sighting_of_ref": "indicator--5841aa38-d720-4faf-a0b2-9b8815896930", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32efed83-0b49-406b-b907-1def72a1593f", "sighting_of_ref": "indicator--9c63b829-312d-4d13-a43c-ef2a1d858c4c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0577b709-354b-406a-8b55-702dde64c193", "sighting_of_ref": "indicator--5ec2bc82-52d1-4ac8-acac-d9f3cb46affd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8144c41e-be3e-4822-ac82-864fa3d317a4", "sighting_of_ref": "indicator--5ec2bc82-52d1-4ac8-acac-d9f3cb46affd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9084b810-ec28-4a53-927a-e788980ed3ca", "sighting_of_ref": "indicator--02d3480f-27eb-418e-a06b-0c0081d191ee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1622659-3c5e-40f2-9f94-42d7a261bcc7", "sighting_of_ref": "indicator--02d3480f-27eb-418e-a06b-0c0081d191ee", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b99be5a-2872-498d-8a37-1f1293838872", "sighting_of_ref": "indicator--844cd62e-5306-4d3f-85b5-0ab05715b4b8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74c73ad8-25b5-4e54-8a96-c9bfdadf1be6", "sighting_of_ref": "indicator--5c62a30f-9dc9-4fc5-9638-0ebb312778ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--178248d2-4ad8-471e-ac3b-6f4d98acdf90", "sighting_of_ref": "indicator--5c62a30f-9dc9-4fc5-9638-0ebb312778ca", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e27e7fce-9a8a-485e-a9db-1b49b2a5bddb", "sighting_of_ref": "indicator--b7aea4fc-e758-436b-9e03-61683b63a1a8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--639f9987-5a63-4da7-ab6d-bbff9fda0297", "sighting_of_ref": "indicator--b7aea4fc-e758-436b-9e03-61683b63a1a8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07f00aa8-38ff-4733-aa78-3197b67bfed7", "sighting_of_ref": "indicator--2a61f72b-db46-4a08-908e-a7dfc2dc71c8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--666e85d6-63b9-4037-bd48-c89d6618a10c", "sighting_of_ref": "indicator--f2be1e11-eae2-4b0d-b0b4-6c9b554daa91", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6dbab06-77a3-477f-9265-d28109c41fb8", "sighting_of_ref": "indicator--ba36369c-9740-4c9a-8f33-64956920b90a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40511f4c-c742-4646-90f0-eddf228f945d", "sighting_of_ref": "indicator--e77a1e47-30cf-4995-b3f3-8d8a9523d7cb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29eeca2b-21f5-49a4-a1e4-01ad51b2b787", "sighting_of_ref": "indicator--e87ee7d0-85b8-4262-b674-178b5ada11cc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14e91e99-1ffe-4a38-813d-f0b487c976f4", "sighting_of_ref": "indicator--5e726fa4-2064-4d7d-ac55-a937d89f06da", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50425bb9-770b-43ae-ad64-ee32ea835d15", "sighting_of_ref": "indicator--5423a473-a36d-4ef1-9701-34bcf92049dd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68f73cea-c5f8-4b18-96a0-9a5f07c885b7", "sighting_of_ref": "indicator--52f1bc35-dcd2-4333-a06b-16b89162f5c4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f7178c4-fcc1-47fa-8ac4-71d979a5d56c", "sighting_of_ref": "indicator--2c59f73e-2fff-4107-bc0a-87730f372544", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17c5c128-892d-468a-acee-b3fe058c165a", "sighting_of_ref": "indicator--2c59f73e-2fff-4107-bc0a-87730f372544", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0da4c63f-3fc9-42bf-a58f-bb484cf14f67", "sighting_of_ref": "indicator--7050d3bf-10b6-4077-b3a1-8c307e883ccc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c82e2680-d6f4-4ef6-9ffc-333f6e962176", "sighting_of_ref": "indicator--51542068-76aa-44bf-ae2c-fbcc0abdc8f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a24e82c-9fab-4b36-b4a5-8c7304b7a794", "sighting_of_ref": "indicator--72201570-1139-4fa9-bf97-8a8e07e1c487", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1708ee62-e148-4117-b4fd-8dc1e14b92a3", "sighting_of_ref": "indicator--08a2d198-e00a-46cc-8a6a-b2361544f915", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba690b5a-1397-42f7-84cb-d98b74abd023", "sighting_of_ref": "indicator--28bc3364-c938-4528-8d3c-ebeed2691174", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34eeb5ca-8c27-44f3-856e-dbc8fb9d059e", "sighting_of_ref": "indicator--f08a08a6-a40a-4ae0-8ccd-3645f6998106", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfefb655-4aa2-41f0-be5d-250eef57286d", "sighting_of_ref": "indicator--abef74c2-b223-4421-b476-f25642c633d6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3bdb3c6-129f-4a37-8d5d-0fd02f2ee513", "sighting_of_ref": "indicator--abef74c2-b223-4421-b476-f25642c633d6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60bbc3aa-3878-4536-a16e-fd9c7169f375", "sighting_of_ref": "indicator--2a14e5af-97b5-45f7-abe9-d4cdd146b9db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc3f6592-e8bb-44f0-9812-042ec628b193", "sighting_of_ref": "indicator--2a14e5af-97b5-45f7-abe9-d4cdd146b9db", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1abaa64c-16d9-44c5-9cfe-51584fa91a4a", "sighting_of_ref": "indicator--f83265fc-3623-48be-b318-33485637a9b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ccdbc0c-3ead-4681-9116-373d057e573f", "sighting_of_ref": "indicator--f83265fc-3623-48be-b318-33485637a9b4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ac82c17-8ffb-4fb4-8475-24a6148b417f", "sighting_of_ref": "indicator--088dedbc-b33a-4457-9d14-7c3dba215b3e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f2593f3-1d7c-4ea7-867b-34256d6dc7d0", "sighting_of_ref": "indicator--c68f84f1-e0bf-438d-83c0-8688ca2e411a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cca18bda-2e88-4328-b20c-691b24e0496c", "sighting_of_ref": "indicator--c68f84f1-e0bf-438d-83c0-8688ca2e411a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38276294-3786-4491-a338-74ee2740e5be", "sighting_of_ref": "indicator--73d568e9-90a6-474a-9d05-93b138eb0e8c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01f3a972-c561-424f-bd69-887ef7b3b591", "sighting_of_ref": "indicator--73d568e9-90a6-474a-9d05-93b138eb0e8c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--381e64f6-1627-4ce4-a4e0-0c26761b6081", "sighting_of_ref": "indicator--be2856b6-68ec-43ca-aae6-fd2ce5c44249", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f27ab3fa-1607-4ea1-bf50-d038b3bfd3db", "sighting_of_ref": "indicator--be2856b6-68ec-43ca-aae6-fd2ce5c44249", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f85a8d9-4c5b-4eb4-9117-c5860f16f13a", "sighting_of_ref": "indicator--d6d0c08f-04a3-4de8-9f80-3aa30f507cb5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f52323c-4b6c-4ee5-b0b2-84627890074f", "sighting_of_ref": "indicator--d6d0c08f-04a3-4de8-9f80-3aa30f507cb5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9034d588-df43-44eb-af2e-cd445ec74242", "sighting_of_ref": "indicator--a66b0853-4c21-4809-9453-6a2b5e45d34a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10108d0d-9d9d-4d1e-81f2-56b24914e251", "sighting_of_ref": "indicator--a66b0853-4c21-4809-9453-6a2b5e45d34a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef6ba5b9-486f-4218-8104-1d3ebf60d7ee", "sighting_of_ref": "indicator--0799ad45-b72b-493f-950c-2b76fbf69fcb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d90b2ffb-11f0-4a45-b542-5e81a667608a", "sighting_of_ref": "indicator--e299001e-9728-483a-abd3-e21d4dc0b898", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d91af32-5005-4b2f-a97e-7bd5a7e65fd4", "sighting_of_ref": "indicator--7b5c00eb-1fff-4d6e-b570-4b317a7bb2f9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5d2a0fa-31db-48c8-8a9d-9ad4fa31af89", "sighting_of_ref": "indicator--d3ab4804-b640-4d16-b0c4-22f3ed71ffbd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24ab4b20-c0a4-4c80-937c-2c76bc0a4d52", "sighting_of_ref": "indicator--e00a592b-73af-46aa-8eb7-d547168edbb5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78a4f00c-093c-4a91-a6fb-34d4ef6eea85", "sighting_of_ref": "indicator--e00a592b-73af-46aa-8eb7-d547168edbb5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9c78a4f-7a3a-4a89-b844-809d662458f1", "sighting_of_ref": "indicator--c2a6397d-aa4a-4b81-842f-8ed85cf00ed3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb739126-8002-4132-a053-104adba28cf2", "sighting_of_ref": "indicator--f3d7847c-8ce5-4645-b1a2-4b1433062a2c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34b78ee2-9d84-4e1e-8c02-5aebf78d84dc", "sighting_of_ref": "indicator--fdf07297-4508-4475-b686-bd49c6b810d0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--372f15ac-7948-4c8a-a010-2bec81920c34", "sighting_of_ref": "indicator--a061a910-20ac-4955-a402-e27815eede49", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df4e0908-74f8-4229-bef3-e4602d1b7a7f", "sighting_of_ref": "indicator--a061a910-20ac-4955-a402-e27815eede49", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--782f6e77-1150-47a4-830e-7b8240286e8c", "sighting_of_ref": "indicator--0d041a6c-cc2e-4f25-a757-071b9ecfea3b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1bca4b2-09a1-4614-9488-30ff78370af0", "sighting_of_ref": "indicator--0d041a6c-cc2e-4f25-a757-071b9ecfea3b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbea35d6-afc0-474f-a2c7-b061d2fa07e4", "sighting_of_ref": "indicator--8f890cf0-8795-44f1-8759-ddd09af7afac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5ceb73d-d183-4940-926d-d0e6e78d4ac4", "sighting_of_ref": "indicator--8f890cf0-8795-44f1-8759-ddd09af7afac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9aa2fdb6-41a6-42ea-a6f9-1e52d5a2dfe5", "sighting_of_ref": "indicator--f79bbbb8-10b5-40b9-8f3a-fddd3b6af06c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9640706-188a-478a-8df9-2e220927d8a0", "sighting_of_ref": "indicator--e159dceb-ab77-4aa9-a624-8a0df4db5730", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38b839df-01e6-4c3d-9503-64a8e258069e", "sighting_of_ref": "indicator--5153528c-4be4-4204-b7b9-0248ffbab5a2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--187f838f-6d32-4cf0-9e5c-5e523fc90a9d", "sighting_of_ref": "indicator--00910b26-be13-4259-bb55-d870e8492c8a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b43c0ca8-1c81-4c43-9ca7-0870dba94d28", "sighting_of_ref": "indicator--26fc9cca-4b48-46dc-854d-378098ecabf6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8b5303b-0496-4456-9441-1084bb5c39ae", "sighting_of_ref": "indicator--26fc9cca-4b48-46dc-854d-378098ecabf6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--833a98d9-3e4c-4d5c-81a9-8ea41cd84bd7", "sighting_of_ref": "indicator--cfc82302-e96d-478e-b7a6-bbaf08ccd251", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b7c9842-9415-4008-8ca7-6b2c60335062", "sighting_of_ref": "indicator--28326572-662f-4d81-8b10-e3a723f7117a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d337ab4-3cd6-4a92-9060-572921941803", "sighting_of_ref": "indicator--28326572-662f-4d81-8b10-e3a723f7117a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76a08af3-b021-4749-bba4-48c5c70b5322", "sighting_of_ref": "indicator--3c5e9882-6abf-4733-8add-20fe415ada38", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cef7e634-9767-464a-9024-2279977299f3", "sighting_of_ref": "indicator--669080cd-0657-4c9a-acb9-169eb13c962c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12b19970-aa7d-41b5-8bc9-c17ad4521136", "sighting_of_ref": "indicator--3fd5d631-2546-43d6-828d-215fe20e7659", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11983e5a-7a7f-480a-93ad-1f05a42d4139", "sighting_of_ref": "indicator--3fd5d631-2546-43d6-828d-215fe20e7659", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e8e1673-6a5d-4232-b774-944b32bf13b7", "sighting_of_ref": "indicator--66456448-c444-4dce-bda9-6b3b1d07407f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d06a8b7-7ff8-4c65-a92c-6ad41266da8c", "sighting_of_ref": "indicator--66456448-c444-4dce-bda9-6b3b1d07407f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50f0d9de-b1bd-456f-a376-7547b8e9ac38", "sighting_of_ref": "indicator--b59b2458-0319-465b-b7a0-9519f83b61a9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebdcc239-1c03-4bc7-b2b3-964006935f12", "sighting_of_ref": "indicator--ccad2d5c-eaf0-4836-9c59-69931163834c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebadebaa-2859-4f36-8f33-71c3348a9ba2", "sighting_of_ref": "indicator--d9f9a05f-fbee-4433-9316-fb76f47c3c6e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92a282a0-7f8d-405c-980e-89e41819c6b7", "sighting_of_ref": "indicator--22ce4145-124b-4060-900f-6681a4c35c00", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47fbfdb3-96e8-4681-9049-4392868619df", "sighting_of_ref": "indicator--6385ad92-f42d-41f0-a057-ce6dc964a509", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8db9fa62-23d0-4d74-a0d4-91be6ca3e2fb", "sighting_of_ref": "indicator--0bb3ae2c-cf70-48fb-8e3d-53705664b56b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d9d9641-aecb-4e8e-a0b6-8c5fa4b32aeb", "sighting_of_ref": "indicator--4196cd6d-55e8-4fc4-bddd-50a227d3ce8f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f48492a9-2b68-40d6-8ee1-eb5c6153ed97", "sighting_of_ref": "indicator--4196cd6d-55e8-4fc4-bddd-50a227d3ce8f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd20e22a-cf39-40a5-9234-eea735c66b07", "sighting_of_ref": "indicator--76158737-37ba-49e8-bb90-da703925c05d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b18d4215-eba3-4fa9-976b-dcf2462f2909", "sighting_of_ref": "indicator--cda0783a-30a8-41bf-ac14-772fb4d12f5b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bea884c9-1b11-4bd8-96b4-86f839f9851c", "sighting_of_ref": "indicator--14b40cf8-de7a-4e9e-b5fb-06ef5c67c71e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d4c1713-25e1-4353-852f-d5accc6d8d0d", "sighting_of_ref": "indicator--ced2b704-b18c-4a02-85c0-f814a947f51f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e367a42-58b4-4c34-ae60-673b28256654", "sighting_of_ref": "indicator--9af10397-f282-41e0-8d83-a0fa415a7308", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45acbfc4-b70f-449a-bc52-31279405e6ee", "sighting_of_ref": "indicator--9af10397-f282-41e0-8d83-a0fa415a7308", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1800f7a4-f0b9-4b1b-ba27-a38824cef3f6", "sighting_of_ref": "indicator--c6d09478-42a6-40c5-a3d3-285e4c6ac292", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ccb4c21-2c2b-446b-9318-127b6412e6b3", "sighting_of_ref": "indicator--757c26f1-6d16-45a0-9c6f-badc32819eac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75c2dd1b-a818-44f1-958f-2b94a5abb6f0", "sighting_of_ref": "indicator--c486f671-fc6b-42ea-a3f1-76dc3c4a695e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a53455a-b985-4551-a081-4b380184dc57", "sighting_of_ref": "indicator--077b23ea-3f50-4905-8572-afae485f4ab9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a2bec99-8a0e-43a6-b88f-8a1c98aaa490", "sighting_of_ref": "indicator--b124d958-e832-48fc-927c-2ae06bf94e3a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be3458a3-4d53-4019-8ecf-1d3630559b64", "sighting_of_ref": "indicator--35104e99-d7ba-447d-935a-adc9bf5dde1a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02208c27-20b9-40ca-b375-cbd230b893b0", "sighting_of_ref": "indicator--35104e99-d7ba-447d-935a-adc9bf5dde1a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1baa1c9a-6a62-408b-9c05-1590ab985aae", "sighting_of_ref": "indicator--349af2a4-d15b-4503-ae1b-257459a507b5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33affb6a-84fa-4049-b08e-afac15f5e73b", "sighting_of_ref": "indicator--1f66daa9-e140-4bf4-9758-33fecead9fc2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76e36be2-7701-4d08-93f8-72b04ec2ef97", "sighting_of_ref": "indicator--17a0e975-595e-4fd2-8fbd-5244ddeae04e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d11c446-f7d4-43b7-9445-b1c895de8a7c", "sighting_of_ref": "indicator--a33e42b6-db61-4df3-9459-3b07ff918ba1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c8c5638-389d-47ab-9596-e459fa1db744", "sighting_of_ref": "indicator--e9f15ba4-3fcd-4a9c-b0bb-15c4212bd65f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69c514a4-9841-4854-8b6a-957acb0ae605", "sighting_of_ref": "indicator--8d70976b-0c29-473e-ac9c-340f10344ae0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a19c845-0b34-4a0d-9491-7caac6703456", "sighting_of_ref": "indicator--b5b1e05e-bcce-4b0d-aafb-123ef8d4aaa7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41387452-c0de-476d-8314-55e0f2ccdaf6", "sighting_of_ref": "indicator--5b230c3a-f3f3-4985-a8f5-69a494f3cfeb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe60c800-a07f-4c12-8f72-080aa706c4c0", "sighting_of_ref": "indicator--10a0ad34-4622-44af-9b52-7536acf2c3b5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9d97bc0-ca38-4295-9109-5a56830887a5", "sighting_of_ref": "indicator--9327712c-7b4f-43be-b891-02af41b458e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99cc7ee4-e0b7-439c-bcfe-e454319d03e3", "sighting_of_ref": "indicator--b8c0ad86-5bec-4881-9c82-5b82917ffc89", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c79ce62-deb7-4e84-97cf-ae2758bf55d3", "sighting_of_ref": "indicator--83cc1865-fbc3-4f60-8eff-c4b29543e540", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbf2fd3b-6d21-4577-8e83-58a27a7e5d30", "sighting_of_ref": "indicator--2f2069ba-37a2-46fa-8b33-2bf9cb8566dc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cca25ea-4d48-46ee-a2e7-2432122bc908", "sighting_of_ref": "indicator--2293a6d5-6dfb-4295-817a-aea1570242ee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62760c24-6be3-4249-a7f4-54ea815379fe", "sighting_of_ref": "indicator--ef108874-08b2-4920-b11a-27e7c5c3f52b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f18b454-3c6b-4e19-9864-429fac856904", "sighting_of_ref": "indicator--e4438609-6ffa-4728-bec1-a7782e0ec8ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d12d2724-ebfc-419b-9054-fef42bdb91bb", "sighting_of_ref": "indicator--e4438609-6ffa-4728-bec1-a7782e0ec8ca", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae85bad4-ccb2-484d-a063-c2af36286731", "sighting_of_ref": "indicator--253cee49-cf15-4779-a0f7-5a4567dbe0f5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd1e57e6-c19a-4ede-ab2e-061033c7ac8b", "sighting_of_ref": "indicator--f32dca4d-777a-4848-a406-2f0c9cbbfb5c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f56998dc-4988-4902-a755-59b06ddcc326", "sighting_of_ref": "indicator--1d0f5234-6861-4151-a734-c5169ddcd6ff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b65829da-4447-46fb-95bf-50bb84bf5406", "sighting_of_ref": "indicator--38cde52e-c028-4311-be77-f06b8392aae7", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--188512b1-9576-42f4-8dd4-35018a9cf2b1", "sighting_of_ref": "indicator--d1ca032d-bd1e-4589-a26f-a2cf34b79763", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fd60c4a-71d3-4699-a44a-86507e256dc2", "sighting_of_ref": "indicator--eb9d7313-bf6a-4b77-b3e2-fb47663613c7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--403a5449-20bc-47c2-af4f-4814ad80a41a", "sighting_of_ref": "indicator--77f5f407-edb8-461a-bf62-a8e37d02d279", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1642cf35-26b3-4bf2-948a-11785720f94e", "sighting_of_ref": "indicator--eedd1a0e-48ee-44c0-85f8-63994da2ba42", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6888fd23-5841-4313-96a8-264b75dea34f", "sighting_of_ref": "indicator--ad8c0002-b9b9-4196-b4a1-f2deee811cff", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--861d7729-5c7b-4c85-a8e0-a8a275846f7c", "sighting_of_ref": "indicator--fdbcc752-a4e5-42d6-8b3c-a77e4dc93ec8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50cd9df5-c35a-4fb8-8be7-b7044d84c8e3", "sighting_of_ref": "indicator--e610c6e4-afd5-4e43-b6ed-779650056495", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--312b55ba-0aa2-4da5-a028-9fc324c7bed7", "sighting_of_ref": "indicator--7440a34a-0ef6-4746-9f8b-53cb82405e9f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--124404bf-6ada-40d5-ae9c-687082ce1c1e", "sighting_of_ref": "indicator--134289fb-1ab1-4e05-88b2-ed5dac0fce7b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2300e06-7361-4047-b0a9-b02af02068df", "sighting_of_ref": "indicator--e13cfc73-459b-4708-97e5-1bd9f2e55316", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc04d307-6efc-4824-9bcc-9b28439883cb", "sighting_of_ref": "indicator--ba8cdc69-264d-4976-b7f4-17f55039856a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36b8bae5-0062-4e07-9116-434808d61afd", "sighting_of_ref": "indicator--a0c08a50-ed04-4408-8fc4-54fd9de8486c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c77540ae-2e6b-4846-b713-5ab4051a7f00", "sighting_of_ref": "indicator--22c5baf6-91c4-4c3e-bbf9-c880ee5f32b7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e23eef7-b7c9-4cad-a4bd-e240d9b6faf3", "sighting_of_ref": "indicator--fbf275fb-de3b-4c4c-8225-cca3e60cfad6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3ce7357-19a1-4db4-ac8e-24e37df06a3b", "sighting_of_ref": "indicator--12fb8a06-413f-4103-8a31-02ef2e6f86ba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01e75193-795a-486e-ac05-bad6fe02a892", "sighting_of_ref": "indicator--3cb32bcd-0368-4c45-a81f-8deb1427cd6d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beeac215-28a6-43dd-a610-84e05387ea38", "sighting_of_ref": "indicator--70c81116-a6e8-42b4-983d-96dcfcf446b4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7af55ee-0441-4f92-8070-d96f5b470b3f", "sighting_of_ref": "indicator--4d3b4d43-5a90-46b7-8bec-d84bad7e8405", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93222be6-4f14-4541-bc67-d484739074aa", "sighting_of_ref": "indicator--94af2563-d591-4d9a-bce0-25f7bfe97ae6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6cb83d4-c3f0-454d-bafe-253864626d59", "sighting_of_ref": "indicator--fce9bc69-7d68-4839-b796-8dc82d31bbe8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1a1677a-17da-4bcf-9303-ff9b6518fee5", "sighting_of_ref": "indicator--3e156511-cbf0-44ea-9c76-05771afcd71b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89879be2-a77e-4b47-be1d-edd628912050", "sighting_of_ref": "indicator--cac3bc9a-bb50-449e-9892-f17477766c1e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7baadf9d-14e3-41b9-87b7-30ad31e81191", "sighting_of_ref": "indicator--e52e9ea6-588a-4246-89c2-c2da1ea9e0af", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--760aba16-86ba-4b16-9001-319135582599", "sighting_of_ref": "indicator--99b56961-c3d7-4548-92ae-d0744d64152a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dedea45c-0f8f-40ec-a6dc-554dacaf683f", "sighting_of_ref": "indicator--4d1abf1f-64c7-4e25-9e2b-6890a60204bb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--540af50e-21dc-4bcf-88ca-adaecf4b79b4", "sighting_of_ref": "indicator--d6ed060e-69c0-41a5-bf0c-5d3db3e36d6f", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8078b02-58a3-49dd-a5aa-53b81c2a76b3", "sighting_of_ref": "indicator--e6dd7af9-73ee-41f4-9112-18bcce7bed90", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46780db7-013f-4806-b9a7-1a1892462be2", "sighting_of_ref": "indicator--3ed211f6-f88f-4933-afe6-3860747a4ccf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e59320ee-e025-434e-907a-16a8b2c2b3f3", "sighting_of_ref": "indicator--46729a6a-53d3-481d-a2e7-96aa0ac2362f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b7c002a-7a94-4335-85ca-7eb97864328e", "sighting_of_ref": "indicator--84f55a85-2b4a-41e0-b8d8-4727c4a0b3e1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--909b23b3-39a9-46dd-9a61-63b534e4ed32", "sighting_of_ref": "indicator--26496a72-5157-4498-bc5a-3422c9eb84e0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50428090-6746-4c42-9fd3-f221c6e39560", "sighting_of_ref": "indicator--aa450e8d-a73e-4b65-adbd-de61e50ce55a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6da2380-144c-4d48-8233-dc74bcbf7de0", "sighting_of_ref": "indicator--97a8d753-99e0-46d1-bede-85a6fe0f8a95", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daab2be7-c98c-4243-af04-a97c6e9962f3", "sighting_of_ref": "indicator--b7fc6701-6d69-4dc6-b022-7ab5351b1e51", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13eead7f-cdee-4217-8f8b-c9cd989db76b", "sighting_of_ref": "indicator--7c079ff3-ee10-4f48-8a5d-1d59f3537ac6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5ea2311-ecd3-4aa2-8d79-4c2a8b365229", "sighting_of_ref": "indicator--923b5394-bedb-4004-b922-e559b58b817e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcfa3afb-0d25-464d-beb6-7b7ddcb37549", "sighting_of_ref": "indicator--576949cb-8bab-4615-9ba6-15795cac054b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7412e80-f0ff-40ae-bfaa-75950eff1eef", "sighting_of_ref": "indicator--67b4792a-e9ad-4fcb-a076-e10e5a346a55", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa51f3f0-fbb9-4c58-ae5b-126cc158cd9e", "sighting_of_ref": "indicator--e06f5e9f-116f-4670-87a2-0bda4238b691", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3db62022-c70b-45b4-9e3a-3aac61d5f556", "sighting_of_ref": "indicator--7b8e64e8-ec31-44ea-8440-0e9849c9f039", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97060f1a-c43e-4799-849d-d30bf8b2ba42", "sighting_of_ref": "indicator--b3f5adcc-daf6-4479-a915-9173b8fdac1e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d8484ae-1eb6-45ac-b333-9e409c39f0b4", "sighting_of_ref": "indicator--93f824fc-233e-4c09-9234-20e9fa7db799", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21b25866-d14f-4063-908a-ab095e799eba", "sighting_of_ref": "indicator--5c45b7ab-a8bd-42cc-b2aa-8a05e7011ab1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b9cda0b-c8ff-40b5-97fd-42743658ba64", "sighting_of_ref": "indicator--260a4008-5ff9-43d2-9b77-f79340840c1a", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88364af6-cee2-43b4-ae14-b0e2262f6591", "sighting_of_ref": "indicator--c1cecc31-2f85-4df4-9385-540b8b51af3c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1559bd05-d8c4-4a59-8c16-18328922fe78", "sighting_of_ref": "indicator--55cc9ad6-f978-426b-bc2b-c77f435146a9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35f2b85a-ffca-44d1-ab27-40d79ce5bdb7", "sighting_of_ref": "indicator--839bdf0c-4f9e-423e-a497-951afcc37b86", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d2e2cd2-afef-4026-9a11-65fa8ce153a4", "sighting_of_ref": "indicator--839bdf0c-4f9e-423e-a497-951afcc37b86", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a731b6ad-1586-41cd-a68e-12000199877d", "sighting_of_ref": "indicator--a4cb16b3-4c4a-4f8e-ba80-9ee0227c4005", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4731288f-ccf6-441e-a782-b16472f82dd8", "sighting_of_ref": "indicator--4a5e6e65-73c6-46e5-b862-5227a40ff1e8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a06cf0f-cd75-44aa-b985-44f33c9604b4", "sighting_of_ref": "indicator--0c9d4600-81a8-4a96-8a48-f9afaefabb01", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aeca070d-7a35-4885-bbd6-4de4f58907a6", "sighting_of_ref": "indicator--76578a98-47bf-4c7f-8319-c0697d00a7a2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4ae3aaa-8542-4a27-a136-1d60521201b1", "sighting_of_ref": "indicator--e542f216-8965-4042-8c1a-bda3b64e3e06", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--067f33e1-70bf-47c8-b5c7-1d76e97500bb", "sighting_of_ref": "indicator--0d89c2ae-5a79-4c9b-b45c-22b1ab83bebf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f6b0137-c325-4c93-8e1e-9ebd0dc89e95", "sighting_of_ref": "indicator--79b51dbd-f6ce-41e2-8863-8e68e2331fa6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--082378da-a1ed-4037-bfd3-0c1a0e7d496e", "sighting_of_ref": "indicator--e429c127-e77e-4653-b6a5-127ecedba295", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8541173-2cf6-487c-af1a-ecf9c3d014c3", "sighting_of_ref": "indicator--337ce118-74b7-482d-9825-2a523f483a44", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad80cf9e-b3b6-4326-a974-f5ddfa16f34c", "sighting_of_ref": "indicator--51d54057-786a-481c-aa49-bd955b156bb9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1f25965-b834-4210-908b-cdf80b1aae18", "sighting_of_ref": "indicator--ae69624f-8c1b-4ffa-8839-cbf42ccfab7d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25c3b335-d5a9-4b77-b7ae-5c640ad5c3a4", "sighting_of_ref": "indicator--5a63e145-06b8-4e62-bc9f-bf91c9f727fc", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27405aad-815c-45fc-9e23-e30495e6b7f5", "sighting_of_ref": "indicator--116ebb77-8001-4c2a-8536-b26568953ec9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ba675b3-ae58-4c32-9719-f26b2739f94c", "sighting_of_ref": "indicator--8da965a1-0c88-401a-91b7-f374fdd0a756", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25732f62-efb3-4f26-abec-f8a350cbfa2e", "sighting_of_ref": "indicator--cd46e67a-6c87-4aa9-ba33-422c3608b73b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05c7d918-15cf-43f8-aca3-ce6ec83aee63", "sighting_of_ref": "indicator--91b35c30-02bf-4d3e-844b-e803a879ad13", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--811a122f-f467-49d9-816c-e67224d33a68", "sighting_of_ref": "indicator--84cc49ce-1761-443b-8a54-2f0f9620ece7", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e2f4993-b7cd-43a5-8afd-d99d0a9c7897", "sighting_of_ref": "indicator--8b35e1a3-b721-452f-9507-5a51e202894d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4023277-a492-4996-b2cc-c0f9cf117139", "sighting_of_ref": "indicator--dddff3d3-95cc-4b0f-a6d6-2d7bcd7d9672", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd388b33-ccaf-491c-abce-a9667bb92c3c", "sighting_of_ref": "indicator--ed59fac6-bd41-47af-b1e9-123afb7e3128", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da5c2ce9-3154-42e4-87f3-4d0ff364d01f", "sighting_of_ref": "indicator--d78f4784-eae0-4d93-b2bb-cb1f3fcdaa4f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09189d75-15cf-4907-b042-5f585bb1fbef", "sighting_of_ref": "indicator--37539fde-24b9-4564-bbe2-53915b4c9d4b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ff1d8f2-d867-459b-aac2-ddf64138686d", "sighting_of_ref": "indicator--99e74e3d-cc4a-4ff4-b7cc-5035ce2ed830", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adc48a28-58d8-497a-88cc-0b92131c99e6", "sighting_of_ref": "indicator--9c605f5d-bc98-4ca6-9735-ae75fc304e34", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41b78ea8-b39b-45a1-af7d-1d499acad56c", "sighting_of_ref": "indicator--7b373d6f-7678-4f10-bf59-dd56bce93a73", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8818b553-46ff-4317-b309-7310aca634dc", "sighting_of_ref": "indicator--7b373d6f-7678-4f10-bf59-dd56bce93a73", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8112bb96-5e1e-480d-b93d-45e33164e2ae", "sighting_of_ref": "indicator--43e6166c-de9a-49f3-8b78-9b6faa87eb45", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91d6b1b5-adb4-4b5f-9b13-5efa64f50eea", "sighting_of_ref": "indicator--51dc7e5e-bb3d-4da8-b287-b89abddb56b5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01c0c1f2-78cc-44e7-829b-737802a73cbb", "sighting_of_ref": "indicator--1d0e351f-1ece-44f9-87ef-9ced05349008", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23ad8324-695a-48d4-91bd-46aaed9d10ef", "sighting_of_ref": "indicator--8bc024d9-4561-4cba-9be0-42063fbf913a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e882e10-e4de-4bb8-8375-53cc01d2b137", "sighting_of_ref": "indicator--8bc024d9-4561-4cba-9be0-42063fbf913a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25d58c94-e161-477c-a153-40e28ddbd8ca", "sighting_of_ref": "indicator--603497a6-ced9-4c59-a1a0-53e14437c313", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ed9dbcf-7ecb-4120-b55a-3fc4eb845378", "sighting_of_ref": "indicator--603497a6-ced9-4c59-a1a0-53e14437c313", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08a0d1e6-be56-4053-8920-a67da0968b83", "sighting_of_ref": "indicator--229888c7-4f0d-4e6f-944f-e888cddf2d29", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9243c4fd-4a19-4821-94f2-0e9a2f428e74", "sighting_of_ref": "indicator--b50bec31-1139-4037-9541-2bbb46020f6b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43b88166-d8c6-400b-8eea-95c29e3ddb3a", "sighting_of_ref": "indicator--b50bec31-1139-4037-9541-2bbb46020f6b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d384d99c-26d5-4d7e-9fb1-e8da9cada19f", "sighting_of_ref": "indicator--5f2a08a0-208d-4cf2-b049-08e227596d59", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ce278b6-34bb-4ca9-aa84-52cd990e698c", "sighting_of_ref": "indicator--5f2a08a0-208d-4cf2-b049-08e227596d59", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab0d547d-1c40-4973-95c1-6756159fb733", "sighting_of_ref": "indicator--b877bbc2-5256-42d6-a5fc-fd0f85a898b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a867f68-86ca-4564-8a7d-67c8ce4c6919", "sighting_of_ref": "indicator--b877bbc2-5256-42d6-a5fc-fd0f85a898b6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a4429ba-786d-466f-b535-370ba7a30785", "sighting_of_ref": "indicator--f36af7a1-c716-45f1-ae16-153799e4931a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ccc2103-0b84-4622-95ad-30cd1e34584a", "sighting_of_ref": "indicator--c46316c2-7187-4a85-8518-ae1a6de47718", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a8f734d-6ce2-42ee-a4f1-0f1bd39c2c5f", "sighting_of_ref": "indicator--b32afb6a-e460-4d8e-9fd1-066cecb0c28e", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f3df11f-fec0-4ffb-829b-8d17185e5b7a", "sighting_of_ref": "indicator--3bf33942-695d-4ff4-8f86-d5fffd4e9b5b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e0066ea-b4ea-4a3e-b007-50eec5f26f1d", "sighting_of_ref": "indicator--8f63f87b-5453-403c-8973-412e265add3d", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86133ce4-e9d8-4915-a530-44be5d6f8757", "sighting_of_ref": "indicator--10cd8d5d-863e-4309-b27e-da18b361bd4e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79b28ccb-546b-4750-a23e-df07940a421b", "sighting_of_ref": "indicator--359b3d3f-1139-4349-8583-72d992eb14c9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f38d95c7-bc05-4264-8ffc-55cf575d1471", "sighting_of_ref": "indicator--2d7e38f2-4637-44d5-bc69-6597367942a6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--176f3199-7626-40fe-98f9-84f2c5a85af2", "sighting_of_ref": "indicator--1d0d8081-1655-4496-b7d9-5e7ee106f6a0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01ad5b07-2162-4313-b83b-7b021a687993", "sighting_of_ref": "indicator--ce9bad3d-cf1a-463a-8e36-17fef16dbcc9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17ce2bf5-fe99-4d62-895d-e7696d885dbf", "sighting_of_ref": "indicator--d5d396d5-a412-47e0-bc7c-ffce63e7c6ed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4338b661-22a4-4423-8631-52790227da46", "sighting_of_ref": "indicator--5836adc7-3686-402c-ba7c-7fd59041bc1d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df5ff0c5-7bb7-46b1-8739-c2bac4ee3ca5", "sighting_of_ref": "indicator--f40fbb0b-5fad-458a-b9f7-ff412212d8cd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40f03003-52c0-4871-80f8-f9f8738b6fb3", "sighting_of_ref": "indicator--bb8aa7a3-883a-4fd8-b925-e7344984a28a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e182533-5360-4aaf-bc34-f57e454b0d6d", "sighting_of_ref": "indicator--bb8aa7a3-883a-4fd8-b925-e7344984a28a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cc88208-f146-4248-b56d-0b5b89145790", "sighting_of_ref": "indicator--6bbb0565-8bcf-4940-a536-bc700de7dca4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--498cef09-f759-4b7e-917e-58647147bf4e", "sighting_of_ref": "indicator--86de81ea-0a6e-4ee4-be4d-0562fb515806", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b9737b2-10ff-4a69-87d4-731014136bd9", "sighting_of_ref": "indicator--607c4f64-3cdb-4986-a0be-39db73e52de5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba43e525-8bf1-4859-bfe4-cc8a11b6d518", "sighting_of_ref": "indicator--ddc8bf09-2cb3-45a3-982d-15cd8561eaf0", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bca2007-7d84-4422-a565-2691ec676a52", "sighting_of_ref": "indicator--cd659b66-5d54-4b01-a89b-a0306c08687d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18116a07-f1de-42f4-a55c-4b6da3467381", "sighting_of_ref": "indicator--67d7a1de-b516-4e97-b679-a77faa8d4d0b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b323bbd1-9fe4-4666-bea5-25a847c2ff92", "sighting_of_ref": "indicator--c1fa3c80-5eb6-49da-89ec-f1ad382fcd92", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ecabfcc-9234-4511-817a-f525a114467c", "sighting_of_ref": "indicator--6ade513d-23f3-4421-9b70-878a7eb7fafb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bf805e8-bdf6-47d5-99d1-ea86e2abfba0", "sighting_of_ref": "indicator--7554a875-dd85-429e-bcfe-2e2382c4b138", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b76aa6b8-ab44-4334-9af0-1a09a174c81a", "sighting_of_ref": "indicator--a33b5fe4-235e-4762-8cf4-020e8fc6c7d6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dce03e6-f860-47b9-8745-a0e026dc54fb", "sighting_of_ref": "indicator--f79f012b-3c4d-45bf-b88c-73b4cbd5585d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03dd52ad-dfff-4151-8687-fbdad30386b8", "sighting_of_ref": "indicator--15db7939-b130-4fe3-92d9-d94c64c57e23", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c9fc5c3-01df-4399-847e-4864c1f8ff2f", "sighting_of_ref": "indicator--30ed4999-d84e-4b81-9f3a-a9432f116dcb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--521d3a2e-5309-40d2-9cd8-0f2d519644ec", "sighting_of_ref": "indicator--479f7bcd-0763-4825-9d39-7a218cdab240", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb3d433a-52e5-4d1a-8efc-7a49b7e6c541", "sighting_of_ref": "indicator--4eb67c75-d19d-476f-8bd9-08b396e08461", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d70a8617-0b44-465a-a5a5-8519ec3f4ccc", "sighting_of_ref": "indicator--8d31d65c-afb1-441d-a593-840fbb85ce7e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11f9d329-4a97-4f03-8f99-06ebecc6e5b5", "sighting_of_ref": "indicator--53ddc1ed-8a88-46e0-a635-767bae9eaa6f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6e3121c-f9a7-43ad-850f-d698472f702f", "sighting_of_ref": "indicator--c7f66deb-b9c1-43cb-aec1-60df37268cdb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18660339-351d-4b83-99c4-8b61f47cc21c", "sighting_of_ref": "indicator--520c1c16-b8bb-489e-8310-b9fa90073c61", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61a213d4-ba0a-42cd-894f-116485cc1e2f", "sighting_of_ref": "indicator--84609682-4f90-4540-9a2d-81c9c01d684f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16148da0-18d9-4a59-88ea-55c10569df83", "sighting_of_ref": "indicator--a29f9e97-408c-4af6-8e69-c112a8b3255e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f911d458-4f9a-4c9e-8851-43c2cbbf4bc4", "sighting_of_ref": "indicator--5a97d531-c076-457f-bc28-59444ab9b13c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70a299ae-6abd-428d-88ab-0047d2da274f", "sighting_of_ref": "indicator--6303d687-43b6-497e-94cd-ae339d46c436", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40ee48a0-a9a1-4fd9-af3c-9b80f6b5516b", "sighting_of_ref": "indicator--e2529980-6a2e-406e-85ac-7f4a636fe117", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e83a2c15-2e6f-4c9b-9724-34b2dcbad2ab", "sighting_of_ref": "indicator--3c2073c2-1abd-487b-b13e-e5f3aea2bee4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11a84ff4-2931-4e37-ae20-ac15ca1ea179", "sighting_of_ref": "indicator--17ef03d6-799a-481c-af74-6da93439b845", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc4ee38f-1e27-4f50-8097-aa798839b9e2", "sighting_of_ref": "indicator--7a2bf439-8cfb-468e-89d3-9e22f417b8da", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3c7fb61-53f2-47a8-90fb-fa9dcabe5d99", "sighting_of_ref": "indicator--ca6199a5-349c-4fd9-a082-c79f50880e60", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4411af85-d00e-4152-8644-5121db3c620d", "sighting_of_ref": "indicator--cfd33d00-4b60-4b47-ad4f-05cc8b600307", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e75b0fa-77f9-4eb9-8ef7-e430956402ca", "sighting_of_ref": "indicator--d986e9c1-6abc-4a60-8624-d2d53524ee35", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7b3abcb-48cf-4122-8a65-f4feeff4e9bc", "sighting_of_ref": "indicator--bed2d4bb-5b21-41c5-be0c-645c5e840a38", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7998630e-62bc-40eb-b860-a60309633093", "sighting_of_ref": "indicator--72992ae4-0997-4e62-b786-7c938d9634f7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f7d96c5-4c2b-4fa7-9b8d-acff1886bfec", "sighting_of_ref": "indicator--697f0574-4d6b-46c0-8666-430bc0800a27", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77a17f50-5c41-4c59-a809-809446ae8908", "sighting_of_ref": "indicator--ee56ba63-e6d6-4b3e-b0cd-bc0e80007c30", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eff4c471-cb60-483d-bfe9-ca009de7dd92", "sighting_of_ref": "indicator--759fea2d-5422-4bc3-9ecb-92793a9975ac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a94015b1-04c2-4158-8c68-6539eebf6ee2", "sighting_of_ref": "indicator--26cb2881-bf21-40ab-906a-2bb38db14903", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--063f6334-b4b4-46f9-b791-2abb82e9f33e", "sighting_of_ref": "indicator--6b352388-971c-4676-ae2e-8f0ff7a72d61", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baaac92b-ae30-4987-b313-9cbe273752b5", "sighting_of_ref": "indicator--78e6eb89-c6cb-4f84-b112-d3421df13732", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23c59f78-314a-4c40-a8a7-2474221eb1a4", "sighting_of_ref": "indicator--c96867a7-8379-47bb-b2cd-9dd989fd3972", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e1d0e31-cca6-475a-9e9b-8832472efe3a", "sighting_of_ref": "indicator--106cf214-35d2-429e-9eea-b5f967365d40", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a213ced1-1a25-4239-8176-284cb987432c", "sighting_of_ref": "indicator--e69e4d60-728a-4316-b0d5-a1e8ccdbc509", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4556cda-2c5d-4a74-a0c9-e3faeda0da56", "sighting_of_ref": "indicator--c99b471f-fc96-404b-a404-b641ae403e0a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa89ba20-1cf3-4cc4-a1e6-5b900fe05856", "sighting_of_ref": "indicator--3a467582-c916-4ce1-99f9-eda19f6fda64", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2b0f620-21cf-4940-99df-e0fea71ed86d", "sighting_of_ref": "indicator--1835b1fe-0cb7-4f2a-b88b-4412b96fc32f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea751296-35cf-469b-8399-b512d2e2b09b", "sighting_of_ref": "indicator--4b747251-cba8-40aa-9eac-7fa57fba96ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07d790b1-3090-4c8e-8b17-e393babee062", "sighting_of_ref": "indicator--7d185c30-e160-47e6-b1bc-149773561c6f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9bd44d3-b803-4e10-b41c-e5fe2f1873a4", "sighting_of_ref": "indicator--b05b5b62-bf6a-4e78-89e7-b8c8c32c65fc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b40bde5-3074-4a97-bcf2-1cffda4dbb7f", "sighting_of_ref": "indicator--5ae38b47-c2e7-49d9-bcd0-eaa57e3d7730", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db140558-7a9b-4307-ba30-31dd33f2b4a0", "sighting_of_ref": "indicator--b4029a02-2fa4-4521-b063-a7a3ecdd5607", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3528393-4107-4f35-91fa-40430b843860", "sighting_of_ref": "indicator--73133ee8-a9fb-4872-b73d-5c064314237f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca49f716-cd52-443d-994b-fe3eb8d40962", "sighting_of_ref": "indicator--01b6b93e-c502-49ab-806e-c92284410787", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11f7b7df-67e0-47e6-ba0d-9f152fd5f360", "sighting_of_ref": "indicator--ef5a805c-7a2f-4396-8cea-05ed70392bbe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--902de66e-3a51-4e3d-bfad-8bc41db81c5b", "sighting_of_ref": "indicator--fb67ef57-4a17-4229-9e70-10816ed7a111", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1874d003-386d-4fce-9cd8-eef6cbf1dc6e", "sighting_of_ref": "indicator--d3ca0ab9-dc54-4eae-9e9c-6a99006bcc52", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f2c586d-67d4-4ea7-949e-0e3e30acbf7f", "sighting_of_ref": "indicator--ca1c760d-fd22-490e-9d79-c5140c35e2e3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd140095-a126-451c-afbc-1b00c81fb8f7", "sighting_of_ref": "indicator--755c28f3-fa1d-4a89-bfca-9c6f767329b3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1a29e57-df14-4a80-bdc2-2d242fed19d5", "sighting_of_ref": "indicator--5d986053-50d2-4243-a37c-64668e9fd772", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--267750dc-866d-4d30-b056-4b593461bd05", "sighting_of_ref": "indicator--4ed18d8d-5238-4a33-a505-0acc9ec375cf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecac0ee0-4031-4f66-a563-6fe46f6eb7fb", "sighting_of_ref": "indicator--e8a9c10c-54ed-4d29-ac4c-5c39351f69fa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05753d91-4192-44ad-90b0-5e728bb2722a", "sighting_of_ref": "indicator--d441dcda-69a3-47ec-a43e-2cccbd4326d7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6e1eb73-ce22-4671-8a2d-9b233d8f10e0", "sighting_of_ref": "indicator--dc7dbcdb-0822-463a-b000-cf2854deb241", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2588d31-d8dc-4c8f-bea4-2518c2893b52", "sighting_of_ref": "indicator--96c03478-0056-48f6-b191-0e1b60ae2e94", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd869cab-d84e-40a5-8a23-28d7537372e2", "sighting_of_ref": "indicator--a44392f3-2c6c-49b5-98df-66b29f537696", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f4ade22-bc28-4281-9b22-51bc253d763f", "sighting_of_ref": "indicator--f02d5510-e84e-4a3b-8c74-43b1c70b5bba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9ddc66c-a8c7-4246-971e-9e5ef961d31e", "sighting_of_ref": "indicator--2be22977-91ef-4086-a7cb-586d37c77a7e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab72e4d7-a74b-4ec6-a729-4e6b8c832a88", "sighting_of_ref": "indicator--754f786b-246b-4145-b68a-269a31cb318f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a30e0acc-eb2e-4779-a69f-7f1395a0fe71", "sighting_of_ref": "indicator--f15e0deb-3e32-4c87-b125-be56ac02d549", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08d0715c-eb0c-44de-8270-a3838d74a83b", "sighting_of_ref": "indicator--aa9ea293-663b-470c-b27a-50373a80fd63", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f236087-94f9-45d9-b5b8-d104a535cd6e", "sighting_of_ref": "indicator--228e02ae-5b2b-41f9-b012-6fbc121c84ec", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14b6b90c-988c-484e-b7c9-8251bad1d464", "sighting_of_ref": "indicator--3f09cd1c-78eb-44b9-b677-1827a2eb7f3d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec55dba3-f3d0-4920-a3ce-2011be669f1d", "sighting_of_ref": "indicator--e5e1f05d-8a6d-470e-a1cc-90831c5bd2ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--842aad04-69c8-4c50-8026-c8a3324f329c", "sighting_of_ref": "indicator--729da5f8-739b-4434-be5b-fd7c3febe0f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bf5d1e6-f6ba-40f1-8adc-39fcb343db11", "sighting_of_ref": "indicator--e0abc134-a608-40cc-9cd0-e8c55066e546", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9aa764a6-1069-411e-9f8c-34e817153d79", "sighting_of_ref": "indicator--9a13d35b-3bed-4808-8ab9-7a4ea476b728", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2f43856-5365-4e1b-a0db-c1371d42c029", "sighting_of_ref": "indicator--67660f12-d22e-4eb7-af4f-91d20e0094c6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9111a0a-b952-4bbe-a2da-1042585c711a", "sighting_of_ref": "indicator--4c286ac3-a8ce-4b11-a1ef-b5c5af48d397", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51681679-c6db-43e7-9792-08a14bbfb5ba", "sighting_of_ref": "indicator--628276b1-90f1-4326-9f4d-19a0c4946e5b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a13b3506-5bfa-4c17-81ff-00be88737d9f", "sighting_of_ref": "indicator--501bbebf-ceec-4f99-a7db-64be736398d1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95d240d7-9c75-4d91-83d8-7601acf20cc6", "sighting_of_ref": "indicator--c63ff8df-5c94-4b0c-8644-4b30fd1560ef", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af070793-9b4e-4e8a-8c4c-10ffe473a1a4", "sighting_of_ref": "indicator--1431d034-e35a-4679-bef5-f20d92a0f189", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52472160-d58c-4fc3-b8fd-360ad67abf6b", "sighting_of_ref": "indicator--639eed6a-a5c7-4ba3-ae1c-a9f772f74c7e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5750424-024a-41e3-80d4-7b485f0903fc", "sighting_of_ref": "indicator--c827a9df-b704-4a75-9c14-a6c017a09780", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d5653c4-e29d-4de0-9505-b80c4d036dbc", "sighting_of_ref": "indicator--f2a61a30-05c3-4e24-9d15-df5f45cd41ea", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a5ce1e6-b05a-426b-beff-848fea631cfa", "sighting_of_ref": "indicator--5558ad9e-d4f5-44f2-a066-93988fbab277", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a1cad04-d735-4872-be44-3d86fc31c89f", "sighting_of_ref": "indicator--ed2bd0e0-3a78-4435-90fa-95c488396556", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86949a7d-c692-4081-92d7-dffb30bc35d6", "sighting_of_ref": "indicator--2d2b8eb6-dce6-47cf-a84a-c956288f5db7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fd8b7a9-d01f-47ea-ba4e-1ebff6700baf", "sighting_of_ref": "indicator--74b471cd-8aff-4856-903e-40f6a70400ff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6e4fd97-e28e-4568-829d-f588e9fb5fb6", "sighting_of_ref": "indicator--0285248d-2baf-4407-831c-31e45660922d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a553c92e-6dde-4db0-ad1a-9340ab949afc", "sighting_of_ref": "indicator--88e5b587-bedd-459a-a1ab-252879baddab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6be2e4b2-90b6-46e5-b244-161bd136450c", "sighting_of_ref": "indicator--05bd07f5-2357-485d-854c-e6b118891e46", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8301025e-c4a5-4834-990e-dc8d5e84dcb3", "sighting_of_ref": "indicator--076e0c33-eb0f-4376-9fe0-490ab56a89d2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b84b517-2238-4e1b-9e55-d0b97b684d46", "sighting_of_ref": "indicator--076e0c33-eb0f-4376-9fe0-490ab56a89d2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b59120fb-9550-4572-99ed-47febbed5d87", "sighting_of_ref": "indicator--f5412379-33b7-4f1c-8220-a934665b5ad9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6fc3ac7-303c-4b57-875d-28221a2f9ed1", "sighting_of_ref": "indicator--5e6dc128-5139-4c34-a2fc-102458bccaef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--450c38e8-8fa4-412d-984b-206aed772dae", "sighting_of_ref": "indicator--1cc82549-bc9c-4a8f-8cae-85b817392447", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f84a2d6-fe0e-49f8-a1c5-85904de070a6", "sighting_of_ref": "indicator--aec8d9b4-de68-486b-b6e9-e7fc43dd3755", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41864bf1-1100-4f5a-bb82-ca4194fd134b", "sighting_of_ref": "indicator--60feff58-d5da-469b-a875-8b8d399ea72c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--215f6b07-0b3e-455e-86a1-5a97f3b53158", "sighting_of_ref": "indicator--d64a9aa3-7a90-4e44-bfc9-0618d8ba6350", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b5fe192-ca9d-4afa-8631-976afa1c03b0", "sighting_of_ref": "indicator--38417088-00a8-4a58-bc91-fbae7fda91f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86e48971-6b96-4147-842a-4cfd0cee01ec", "sighting_of_ref": "indicator--1620440e-5cfd-4124-9c07-5ee58d2ca2d2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54f7cd0d-559c-415c-b2f9-557366f58f7f", "sighting_of_ref": "indicator--a52587d9-505a-47dc-b629-b3b63394830c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e6b2ced-084e-4de1-8cab-d15a26d88aa1", "sighting_of_ref": "indicator--875776a8-8cc0-4b65-8eb5-22c239a3cd44", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--666a885e-defc-4940-a7a1-b509138e2844", "sighting_of_ref": "indicator--875776a8-8cc0-4b65-8eb5-22c239a3cd44", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6397697-a6bd-4f9c-ab42-faa9700b2057", "sighting_of_ref": "indicator--3a0ba363-3079-4ec0-a053-df79bca945d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--119ef0f3-8f4c-4598-8e4e-0b89a85a244e", "sighting_of_ref": "indicator--3a0ba363-3079-4ec0-a053-df79bca945d0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97e7e1f3-8d33-4503-8350-9d4ab2f0f03e", "sighting_of_ref": "indicator--69fc6bd3-bcdb-4f86-9b53-444f132dc95c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1acf6ae2-5d09-4b23-a40c-c2e20e3d0dbb", "sighting_of_ref": "indicator--6ab2c340-708d-4c92-9aa0-f81b27aff1a5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0a9b8a8-e966-44d4-b481-9ab2a8e7bfeb", "sighting_of_ref": "indicator--64c66f94-8957-4204-b681-045c09ba341f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78a252e5-9a86-4b17-acf5-0f3806700d94", "sighting_of_ref": "indicator--64c66f94-8957-4204-b681-045c09ba341f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eaa7215-7d05-4ddb-ac35-b7db63015c99", "sighting_of_ref": "indicator--bfb05fe6-0fd7-433c-89d3-dcc36028d15d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56ba9073-d1eb-4f8e-8f06-d2518c60fee2", "sighting_of_ref": "indicator--78a1a7d2-ac9b-4750-9562-fa538c8ee676", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a7dd029-7aca-412a-86fc-e250c857f428", "sighting_of_ref": "indicator--78a1a7d2-ac9b-4750-9562-fa538c8ee676", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e36ffb3c-3b8b-44ef-a833-72eb4efa4846", "sighting_of_ref": "indicator--a0ef96a0-d70f-40e6-980d-0423fa9c7257", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8aaa7fb-b053-43ba-8a02-f9dfc0056e49", "sighting_of_ref": "indicator--1384648b-7193-402d-a12e-9fc93402f0f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20dd3d42-ffe7-414d-8e7c-2be8fecafe9e", "sighting_of_ref": "indicator--53755052-8734-4de5-a822-e2881627b843", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed3368af-99df-4430-90a9-c09b1d8c4b38", "sighting_of_ref": "indicator--53755052-8734-4de5-a822-e2881627b843", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a2229a0-126d-4ffc-a6d1-b601824d34eb", "sighting_of_ref": "indicator--2d7d2cd3-c395-47a6-b1aa-61431f216a09", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f1bb02c-5d11-4650-8138-548c205851b8", "sighting_of_ref": "indicator--776ac31d-117c-46c2-b08d-911f0911d245", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--979821f5-7283-40a6-9eb3-f85b4f0cbc35", "sighting_of_ref": "indicator--776ac31d-117c-46c2-b08d-911f0911d245", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71ca4ed0-686f-4bdd-8b60-ca2bfe111e5d", "sighting_of_ref": "indicator--6f14e75c-292c-4acd-b14b-4fd7ca0a0a75", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1deb4e0c-973f-487c-b3d5-da5826b1bc8d", "sighting_of_ref": "indicator--a4c2467b-3141-4fc1-9ea3-d952a8e56a2d", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7e01a41-4332-4d09-9ce3-8ee0db7a7c6c", "sighting_of_ref": "indicator--7c5630c7-4b4b-4ffc-bb9b-1cee85bf0d6a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dfb9531-5da5-4ebb-aae5-cbf6792d7a74", "sighting_of_ref": "indicator--17a489ca-cfc5-4308-afd3-85996c018c03", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5198f50-f2a4-4d61-8016-dbaea7a9febd", "sighting_of_ref": "indicator--f8693631-b45f-4d42-b609-104d9f614ab5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59dcffee-609f-4948-ab62-fc817cdeed01", "sighting_of_ref": "indicator--4c4d8130-6a13-48c9-8c80-9ce29f59a551", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2be6e1d1-e05b-45be-82f8-548b981c5827", "sighting_of_ref": "indicator--0b665a62-132a-48e6-a431-060cc4f0d157", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cae114d5-d06e-4c42-a558-6c003b0eef16", "sighting_of_ref": "indicator--0b665a62-132a-48e6-a431-060cc4f0d157", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d7ed13c-9333-47cb-916b-1752dffbdfa8", "sighting_of_ref": "indicator--b501c468-5967-475f-88ee-0317480dfbc9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32c98ae5-badb-48e7-8fdd-d3696017b63e", "sighting_of_ref": "indicator--b501c468-5967-475f-88ee-0317480dfbc9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--242212ae-4ffe-414a-9c27-5ff536646561", "sighting_of_ref": "indicator--e06e5b4e-ce06-43d5-8ea7-1b5deb76a3c9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04757b55-4eb9-4ee9-8e7b-565f388e4732", "sighting_of_ref": "indicator--e06e5b4e-ce06-43d5-8ea7-1b5deb76a3c9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95683420-4736-4c15-a0ae-b787365103f0", "sighting_of_ref": "indicator--bd439b0c-1f17-4866-b214-771e97d6f836", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d71fe46-c3b5-4751-86d6-a7e8f06cc150", "sighting_of_ref": "indicator--bd439b0c-1f17-4866-b214-771e97d6f836", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d81dce1e-3429-420c-b05c-42b73f70ff1a", "sighting_of_ref": "indicator--a03dc0e8-a7ef-4e70-80aa-ee03f43b4e83", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de161a88-7ce6-4366-92ff-605f5c52422d", "sighting_of_ref": "indicator--a03dc0e8-a7ef-4e70-80aa-ee03f43b4e83", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0857d4b-3025-47ae-90fa-f98e7e3e447c", "sighting_of_ref": "indicator--75f16067-69eb-4f9b-a82b-66410c091b77", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a79483cc-dd30-4c76-bf7f-95d54ee732ce", "sighting_of_ref": "indicator--75f16067-69eb-4f9b-a82b-66410c091b77", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de11c417-bd06-4276-83c3-2a50ff9d33bb", "sighting_of_ref": "indicator--833ec465-d30f-4a21-aeef-5675fd1ee464", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69e27b4e-d200-46fe-8f44-8db6af452bdf", "sighting_of_ref": "indicator--833ec465-d30f-4a21-aeef-5675fd1ee464", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa0086e5-ab5d-4abc-b872-5fba92297326", "sighting_of_ref": "indicator--3c60fc70-0dd9-4192-98cb-5e41b999a046", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72950c7e-2876-4abb-b13b-1f79e36a9982", "sighting_of_ref": "indicator--3c60fc70-0dd9-4192-98cb-5e41b999a046", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f181963b-b8e8-4616-a9f0-9c7962cb83cd", "sighting_of_ref": "indicator--375e8a05-1c95-4a9a-aa81-a6233587a023", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--172c2e5d-2416-42dc-b6e0-eae02430a5f4", "sighting_of_ref": "indicator--375e8a05-1c95-4a9a-aa81-a6233587a023", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9d10542-8e9b-4e17-8907-22dbbd0b4743", "sighting_of_ref": "indicator--96c49cf2-13b8-44e6-83dc-34c91eed18ba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fb21fd6-af79-4b83-9969-cb73ef1c209f", "sighting_of_ref": "indicator--96c49cf2-13b8-44e6-83dc-34c91eed18ba", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--438fdb82-42d4-4ccb-8aab-bfb4e9fdf6d3", "sighting_of_ref": "indicator--b618a63c-1779-47b9-81d2-8ba04ddefdea", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f61cc208-599a-4488-9ae0-9e62aa114185", "sighting_of_ref": "indicator--ee3b194e-d400-4761-84ca-efd681c7f375", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1cf05d4-815b-499a-a155-a55d037557bb", "sighting_of_ref": "indicator--ee3b194e-d400-4761-84ca-efd681c7f375", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcc44e35-323f-4ba1-ab4a-2c7f7ae96542", "sighting_of_ref": "indicator--3f1b7bfa-b357-4abb-8a61-3780f08b94d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6a6190a-f502-42c8-972f-91140d632394", "sighting_of_ref": "indicator--3f1b7bfa-b357-4abb-8a61-3780f08b94d8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c1acc52-50e6-4bb2-8e79-a2e627d6857c", "sighting_of_ref": "indicator--394fcf39-bc39-4a08-ad7d-01df54650f42", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33b6ecc6-1f56-43fd-b040-fd2e17a4d1c4", "sighting_of_ref": "indicator--394fcf39-bc39-4a08-ad7d-01df54650f42", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--171d6b70-0c1c-4e10-a1e8-c8c4ff4e99c3", "sighting_of_ref": "indicator--60118925-dbe0-4962-b264-02afb4f267ea", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39977412-7aab-44fe-9561-98bf11ee35e0", "sighting_of_ref": "indicator--60118925-dbe0-4962-b264-02afb4f267ea", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a6f4c66-f3f1-4c0e-9c39-83cf7df2c8ee", "sighting_of_ref": "indicator--c676a4cb-5332-4df1-b1fd-d7168c2b7dd0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe8ef819-20fd-4c3a-a00b-b7ef5c349d69", "sighting_of_ref": "indicator--c676a4cb-5332-4df1-b1fd-d7168c2b7dd0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc7e20d1-a253-47da-8629-110ba6be5f85", "sighting_of_ref": "indicator--43e66414-2615-4663-99b5-67695f3564f1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99190ec8-a538-4848-931d-69c1e97a0f46", "sighting_of_ref": "indicator--43e66414-2615-4663-99b5-67695f3564f1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30ba4f65-48fa-498c-84a0-8472b95980e1", "sighting_of_ref": "indicator--a85044ff-6e96-446d-a070-adf6486a242d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e66f09fd-375c-43fa-9ecc-d79d13882196", "sighting_of_ref": "indicator--a85044ff-6e96-446d-a070-adf6486a242d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f44fae8d-8abf-412c-b554-779dc94fb9bd", "sighting_of_ref": "indicator--3896ab2e-78b0-443a-b00f-29d863a2d3da", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6c44e58-0d71-41a6-a3b6-3e72d5ad8603", "sighting_of_ref": "indicator--3896ab2e-78b0-443a-b00f-29d863a2d3da", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--497269ce-4e63-4925-a012-88a291ac71e4", "sighting_of_ref": "indicator--40acd1bb-ba58-408b-9c6e-83823812465d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9e633a8-25c8-4387-851b-6f0974406725", "sighting_of_ref": "indicator--9c2577f6-cda5-49fc-9370-393d3610c476", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cacfe5f7-a632-422f-8f90-21d82c9750eb", "sighting_of_ref": "indicator--98e6d303-e914-4e11-a05c-d80b97402612", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c427f742-9814-46d9-8a65-9969317fac41", "sighting_of_ref": "indicator--98e6d303-e914-4e11-a05c-d80b97402612", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4be918a8-935c-4450-9c2e-c13b55205529", "sighting_of_ref": "indicator--c405a0fb-cb89-4c9f-8be0-8a9a93327203", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8128e60d-13b3-4660-982b-9dea6cd97fdd", "sighting_of_ref": "indicator--c405a0fb-cb89-4c9f-8be0-8a9a93327203", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94ab4afc-eeb2-4bfb-98e3-a2924fd74f5f", "sighting_of_ref": "indicator--947a8204-1d8e-4383-a0c3-8548a5f628d5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a4b9115-0abf-4a62-a1d0-e07e7a4f7e94", "sighting_of_ref": "indicator--947a8204-1d8e-4383-a0c3-8548a5f628d5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--345cb3bb-1a78-46dd-a18f-17ec87922cf4", "sighting_of_ref": "indicator--e8fa8133-d000-4850-9b26-a5abe718f2dc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--948f82dc-959f-4819-9b81-0bd7e8839aef", "sighting_of_ref": "indicator--e8fa8133-d000-4850-9b26-a5abe718f2dc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54d2366d-1fc5-4591-9209-f610266de1f5", "sighting_of_ref": "indicator--94507918-092c-42cc-afa3-faba54b30e4c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--877032d0-f69c-4903-81a0-f5ae1e6a1beb", "sighting_of_ref": "indicator--94507918-092c-42cc-afa3-faba54b30e4c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--900847aa-a6f1-4f10-8c60-1060a831a01e", "sighting_of_ref": "indicator--e01c46c0-fbac-45d7-807c-5dfdeb952b3c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1df02d3b-7414-454e-b904-c658123ba7a3", "sighting_of_ref": "indicator--e01c46c0-fbac-45d7-807c-5dfdeb952b3c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a24e8c26-872e-4226-852c-eb61901bc2cf", "sighting_of_ref": "indicator--eb4a95a1-dc9d-4ebe-ae73-bcb52177ee96", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--184aad10-aece-4efc-8a2c-f374d8eaa65a", "sighting_of_ref": "indicator--21d88989-caf1-46ab-a2c6-a39887950ea1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71bd8356-c4bf-42ca-bfa5-aab1644e1b6e", "sighting_of_ref": "indicator--21d88989-caf1-46ab-a2c6-a39887950ea1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d131103-ac01-49b0-b8ac-2e4f509ce20c", "sighting_of_ref": "indicator--9fac2cc3-2bb3-4d16-8ecb-5f5f3d751ffe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afed4b07-2c1e-4c5d-bf1e-681ed31020ce", "sighting_of_ref": "indicator--9fac2cc3-2bb3-4d16-8ecb-5f5f3d751ffe", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1843bf9-4d08-4fc9-869e-3c0351b7404d", "sighting_of_ref": "indicator--15f78039-3e5f-4fb7-8f7d-86effa8e508e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e45de312-f952-4a58-8c84-d19e2a249704", "sighting_of_ref": "indicator--15f78039-3e5f-4fb7-8f7d-86effa8e508e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d598849-0530-4a9a-b4ba-fe53aff23ec9", "sighting_of_ref": "indicator--b42e689d-b0ae-4d6c-bb82-e18216550cb3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7db6183-b63a-4c1b-85ac-616d04160dcd", "sighting_of_ref": "indicator--b42e689d-b0ae-4d6c-bb82-e18216550cb3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22d1671d-17b1-4e14-8223-00d17a740def", "sighting_of_ref": "indicator--44548630-2580-44fc-8521-62a53969a999", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--235cfeb1-fa85-4686-a494-b9bbca2a7e5d", "sighting_of_ref": "indicator--44548630-2580-44fc-8521-62a53969a999", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddfae1ba-6232-40b9-82e0-23ad50cce748", "sighting_of_ref": "indicator--1ebe5670-c78b-4b16-b2ae-be5ba6ce83a4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a041e120-6488-4c7c-a048-4884bbc944dd", "sighting_of_ref": "indicator--1ebe5670-c78b-4b16-b2ae-be5ba6ce83a4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ad2444e-0814-4cee-8ccc-f0d6df122499", "sighting_of_ref": "indicator--6cf1a616-bb40-48a4-b8af-fc6f1b975c45", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bea94230-1956-4462-831c-a9205cf83f93", "sighting_of_ref": "indicator--d2a9c4c8-43cf-4881-9436-dc7c8049efca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b101b496-9c24-4db9-a27d-c34c5e553507", "sighting_of_ref": "indicator--d2a9c4c8-43cf-4881-9436-dc7c8049efca", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0007b90f-0c71-454e-a9fa-5cad203ed445", "sighting_of_ref": "indicator--55a6bf4b-5c61-4bd6-b29b-95d3f9eb6493", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03e93fab-4738-4c53-b8bb-089682d611ac", "sighting_of_ref": "indicator--b3b98fa8-2afd-4504-aa23-02d67ea59a38", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4839fd7-acc6-4694-957a-f0ff54aa2b41", "sighting_of_ref": "indicator--7626ff81-8263-441f-9cff-1ea13579a99b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7b5c7d3-5f19-4266-8a4f-f9c0da0b58dd", "sighting_of_ref": "indicator--ba5fb3e8-9b40-402e-9a0c-784f11aabeeb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0523d4dd-4d79-40c7-a2b1-0521ad0af76e", "sighting_of_ref": "indicator--ba5fb3e8-9b40-402e-9a0c-784f11aabeeb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfe261be-f6a9-4c34-95d1-3d699235b64b", "sighting_of_ref": "indicator--67521f35-c57b-4ff1-999c-b750e60f5ed6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd62197b-16c6-40df-93fb-ad0549fd4c8b", "sighting_of_ref": "indicator--e7e3647f-5d0e-4aad-8d0c-3359be88fea3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e667fa46-0b07-4494-a7db-8498ed974e17", "sighting_of_ref": "indicator--e7e3647f-5d0e-4aad-8d0c-3359be88fea3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e302756-7433-4bb3-b783-0848ceb51ed6", "sighting_of_ref": "indicator--82a8cf36-8b99-43ec-8354-1dcc36700b03", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4391a6bd-2219-4499-9416-c8524e327fd8", "sighting_of_ref": "indicator--60e170b4-3c47-4a64-8fad-ca8278959f8f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bca1be8-ac4a-4483-8742-8dce99c4c8f8", "sighting_of_ref": "indicator--de7fc1fa-5cde-4618-b927-a662c816e204", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5296e728-bb04-4b7d-ad74-5de50f6d64b3", "sighting_of_ref": "indicator--de7fc1fa-5cde-4618-b927-a662c816e204", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--662d51c3-cfa3-4423-825f-57311d0ff8db", "sighting_of_ref": "indicator--0ae8fec0-c51e-4bd4-a332-d95c3e2ab750", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--614b3082-de40-4c41-91cc-02098dabcd34", "sighting_of_ref": "indicator--b22826ed-6e81-4170-b834-82c5a96b7482", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8989afc-89aa-4bd9-a650-a727e56b3e00", "sighting_of_ref": "indicator--b22826ed-6e81-4170-b834-82c5a96b7482", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b2e2e8d-20c7-4b61-a815-d4426c7564a7", "sighting_of_ref": "indicator--27167e63-35f1-43fc-8985-37cc9410082b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce229eda-491f-4d06-8f05-93d4975d0ce8", "sighting_of_ref": "indicator--244c6f76-1386-4946-a0cc-572ab1753db6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81577b6c-2afc-4e00-a2e6-7fc6999fecee", "sighting_of_ref": "indicator--244c6f76-1386-4946-a0cc-572ab1753db6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3178a222-602f-429e-bedb-73d3b76d9bd1", "sighting_of_ref": "indicator--ca360c87-3a58-4b5f-9c04-2fceeaaa2d31", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9630400a-a1c9-4e53-b373-88c0c3bfa3b9", "sighting_of_ref": "indicator--31bf2f0c-69fb-4847-ab2d-11b5d44395f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79b7c4bd-e5f1-467e-8dc3-e0db91cac1c5", "sighting_of_ref": "indicator--31bf2f0c-69fb-4847-ab2d-11b5d44395f8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--304daf7c-631b-42cb-9dd9-d14c36fa0034", "sighting_of_ref": "indicator--a17fd839-d84b-4911-9f53-023af53f9142", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebbdb1f6-cee6-40e7-8382-37d3cd65d833", "sighting_of_ref": "indicator--a17fd839-d84b-4911-9f53-023af53f9142", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af4d0cc8-6789-495c-93a8-58aa4dd6f4d0", "sighting_of_ref": "indicator--0e2be9c9-dc92-4b4a-bdb8-381b5921a613", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d1dc70a-3db6-40e0-8987-404c0beb6892", "sighting_of_ref": "indicator--e111de0f-97b2-44bc-9af4-abaf80b88caf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae8e1b59-3f77-4d96-bfb9-32e351595bbe", "sighting_of_ref": "indicator--6c1e08ce-f96f-4443-9b56-9fc75956b58a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbf72e90-caf6-45f3-a7db-741dc941fcd4", "sighting_of_ref": "indicator--3e8f9f76-3345-41ca-ad54-af5a3d220b9e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b87d415-57e9-4d6d-a362-1a1f967544ce", "sighting_of_ref": "indicator--3e8f9f76-3345-41ca-ad54-af5a3d220b9e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d777b851-6535-422a-9abf-62c3be426d76", "sighting_of_ref": "indicator--5899e9ac-50a6-44b7-bc29-419f959ef23f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ed1e9da-9256-46a5-b5ee-7382fc93e225", "sighting_of_ref": "indicator--5899e9ac-50a6-44b7-bc29-419f959ef23f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec8e6b5e-8b15-4643-8fdb-3ae24db2555f", "sighting_of_ref": "indicator--18c6a50d-bb56-404b-97a5-59a56c68cf56", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e5e9498-228e-419d-8d40-187b727dde88", "sighting_of_ref": "indicator--49e9d286-ee85-4910-9086-7b1fa8084489", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a98a7a10-f32a-4821-949e-02d9a424c1b9", "sighting_of_ref": "indicator--49e9d286-ee85-4910-9086-7b1fa8084489", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11270728-3412-4131-a19d-528836f4d89b", "sighting_of_ref": "indicator--22b86372-1450-4f64-9061-2dd1ef30e26b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10704631-4cdc-420b-8a5e-f625f3f33433", "sighting_of_ref": "indicator--e0b466e6-7e33-4367-b9f8-ac35a638197c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--072a833e-7058-4023-a8ae-7c3924165afb", "sighting_of_ref": "indicator--12aec00a-d85e-44ad-93d4-2f4f65f3ec9e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c71b940-e76f-49b9-b32c-cfdb8b660d1e", "sighting_of_ref": "indicator--12aec00a-d85e-44ad-93d4-2f4f65f3ec9e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ead930f-e027-4d07-b0e5-c5189739f275", "sighting_of_ref": "indicator--5999e8ea-067d-4556-90ba-16ac0729c6e8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b77a90-0a44-45a0-bf18-a72a87b36ccf", "sighting_of_ref": "indicator--b643a5d2-d7c2-4737-a6a7-3264a922e4e8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b50e290-6efd-4c9a-ba05-ff8dd6a893e3", "sighting_of_ref": "indicator--b5d2eea7-cffa-486b-8a18-ead33d3ea5f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ded72e8f-4ee4-4517-b1b4-dc6b5bfe9bdd", "sighting_of_ref": "indicator--a7cdd55c-2d53-4d01-9de8-35439859571d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3f4a7a8-e6df-484b-b7b1-39550b7016cd", "sighting_of_ref": "indicator--a7cdd55c-2d53-4d01-9de8-35439859571d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73e459ff-ee08-4fc8-b1b4-1f4f6ea0b1d8", "sighting_of_ref": "indicator--8c40cb7b-b33a-4e7b-ade4-d7c4b255b5c1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bff4ae9-4f27-45b0-87a8-58ab13133e57", "sighting_of_ref": "indicator--b559eafc-d0bf-4fa5-bf3a-50b6b5a9fefe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f446abe0-8c29-4f6d-a871-505f305e20be", "sighting_of_ref": "indicator--cc243d58-c35e-407b-9d47-a8ed8de28f6c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3800f145-85df-4956-b8eb-775c0be620d7", "sighting_of_ref": "indicator--b21d4652-65a4-41d9-b61b-285f606f7178", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbbbb7bd-53b0-4183-b863-a09519628c1c", "sighting_of_ref": "indicator--08657b2d-d3c9-43a5-aeb7-d68edf7e7f3f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--987e0a00-83b7-4787-be4a-880a228c41c5", "sighting_of_ref": "indicator--08657b2d-d3c9-43a5-aeb7-d68edf7e7f3f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9cb5778-cdff-4e13-8de6-272437b7c05a", "sighting_of_ref": "indicator--204eba40-a99d-4160-a56d-01baedd7ddf1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2998a528-7c23-43a6-95fa-9bf0c7bd30ce", "sighting_of_ref": "indicator--0a24a4be-802f-4f23-9c8b-712478d91b2d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--592cc6a9-5e3a-4112-8b81-021ecfcd9493", "sighting_of_ref": "indicator--0a24a4be-802f-4f23-9c8b-712478d91b2d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1f75915-9cc4-46dc-9de0-20ffa05a61da", "sighting_of_ref": "indicator--c765dae1-8104-4859-a185-a91266974261", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ed8a9b1-773c-4c9d-8fa4-ec56d2c0707e", "sighting_of_ref": "indicator--cc8de11c-80ae-468d-953c-e6e29d1a45d7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b98b1b1-4c0a-4221-b890-3414e112c414", "sighting_of_ref": "indicator--7511c473-7e17-4d6c-a42e-ee4b091eac10", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93b7b86d-303c-408e-959b-eaaf5920ecb6", "sighting_of_ref": "indicator--893bdba4-ae8f-43c3-9041-4050fe6a8bcc", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e869d05-8852-4d3f-837e-f327703655ae", "sighting_of_ref": "indicator--0e86725b-b41e-4f4e-b728-aa46426f4edd", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e142bdc-e543-4021-840e-86ca0f197a45", "sighting_of_ref": "indicator--32cdecb9-de03-41d5-8238-79ba9f25b0d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--302aa8b9-9b73-40cc-9a94-3fe56db25b3e", "sighting_of_ref": "indicator--614b2c68-0db8-41f3-91c2-dc47bb209a61", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa1e748e-6d49-41b0-9431-a4598aa8f0d8", "sighting_of_ref": "indicator--98ed78b2-fc98-48a9-aafa-23bc0e5cd9b7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d9ad7c2-92cb-4569-9892-c8a1c361bc7d", "sighting_of_ref": "indicator--6138a1cc-e495-4231-93c3-e769692b54a0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f861a9ff-9756-40d1-89a1-ecdee06fdd2e", "sighting_of_ref": "indicator--5ea7a628-8476-437b-89b4-17c82e052322", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8625288-2185-4b58-88fa-9bc2796d37e1", "sighting_of_ref": "indicator--fdb412ba-6295-4252-9fe8-b63adbdbbc1d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7644c1dc-74e5-414f-8d30-134596b35ed7", "sighting_of_ref": "indicator--08f86439-990c-4093-bd8e-69e640fef5d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bfbf141-5450-401e-8815-e69895a52df8", "sighting_of_ref": "indicator--98247e87-8d09-4d02-9504-b7c9bdc58527", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2aa9414-d90a-40e3-94c6-641a58b9f395", "sighting_of_ref": "indicator--9c7afa52-ba3a-494b-b285-b9995ea32054", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c10dd988-a7a0-4f68-8303-e3e012271d21", "sighting_of_ref": "indicator--9c7afa52-ba3a-494b-b285-b9995ea32054", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e98bbc6-59dc-4a8c-90b0-2ae8deeab324", "sighting_of_ref": "indicator--b3f2ee34-e64f-4cda-9945-699a82b147e3", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4117707-1c5c-4cce-9cde-08bd02954502", "sighting_of_ref": "indicator--96988f86-adfc-4731-b789-9283536d1f45", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1eea3335-2b3a-4938-aef6-09add5d7225e", "sighting_of_ref": "indicator--96988f86-adfc-4731-b789-9283536d1f45", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6a5ff0d-e94e-415f-81f8-8ad98700a3c5", "sighting_of_ref": "indicator--ebf14cc1-d7ca-486a-82c7-13022613ee38", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b758c48-8e67-4f70-aad6-4860dec99b66", "sighting_of_ref": "indicator--62a8d3cc-6390-4d83-ae22-8db2e5158eb1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98a37b29-450e-4f6f-99cc-1601fe970a13", "sighting_of_ref": "indicator--62a8d3cc-6390-4d83-ae22-8db2e5158eb1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45628d5a-c99e-46da-97aa-a0930dad9ce2", "sighting_of_ref": "indicator--88599c8b-0e9d-4aa6-9e5e-9d8e2c62c356", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e7a31c8-a3e5-49f4-9f0d-6b88d5bd5da6", "sighting_of_ref": "indicator--88599c8b-0e9d-4aa6-9e5e-9d8e2c62c356", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--050ddf71-c070-4ea3-abe6-f0e78c67d5c0", "sighting_of_ref": "indicator--bf571455-df30-4cec-af6d-a41b23fb8012", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--783395e4-0483-4df5-8b94-2441196274d3", "sighting_of_ref": "indicator--bf571455-df30-4cec-af6d-a41b23fb8012", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d84f099-3348-4df4-8daf-d66f5776c69d", "sighting_of_ref": "indicator--70b93b98-40f5-4460-a7af-45189138aa57", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ac18d92-edd8-4041-bd23-a9f98f8dae5a", "sighting_of_ref": "indicator--3a1ba994-9cf5-4ccd-97e3-c60aec298bab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--306f3eec-f164-45e8-8990-31d4954e8ecf", "sighting_of_ref": "indicator--3a1ba994-9cf5-4ccd-97e3-c60aec298bab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a440dae5-b586-4bee-927a-35402bb47080", "sighting_of_ref": "indicator--5bac4dd6-24f2-4435-a310-45bdde216075", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c18ea2eb-dc8c-4bb1-8031-9607b8ed489c", "sighting_of_ref": "indicator--6c430bc5-bece-4ff5-8e42-21c0bfc09890", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a96eb3a4-91f6-41ee-ad23-9d9f3397424c", "sighting_of_ref": "indicator--6c430bc5-bece-4ff5-8e42-21c0bfc09890", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77382717-38a4-44bf-ab44-3809a80eeae0", "sighting_of_ref": "indicator--ca8aad60-f812-47e3-a5ee-c084d7cb9f80", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdcd55cc-d311-4f73-b792-56fff7b0d6f7", "sighting_of_ref": "indicator--ca8aad60-f812-47e3-a5ee-c084d7cb9f80", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef391b2c-8b63-4228-b279-b07ea1c13e8b", "sighting_of_ref": "indicator--da7261ec-c1dc-4486-a4c0-3bb50900c123", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e377b325-b9aa-4d6a-b0f2-2cc62b397817", "sighting_of_ref": "indicator--da7261ec-c1dc-4486-a4c0-3bb50900c123", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71c2a54f-c1b8-4ac6-a364-0396f80e7374", "sighting_of_ref": "indicator--8313e404-f283-4612-937b-516f89944867", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ca660ce-3455-478b-be88-0e37d038baaf", "sighting_of_ref": "indicator--8313e404-f283-4612-937b-516f89944867", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33038230-18d6-4d2b-9284-c9b2b79f11de", "sighting_of_ref": "indicator--857f6947-7fc8-45be-942b-46dd6fe1f9a3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15922c07-8082-48ea-824d-6264a7bc0407", "sighting_of_ref": "indicator--a9d4a6ce-bba7-4bb7-b5bc-80c895a6d4ab", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0e00868-a74c-41ca-bf36-20eeee4a55df", "sighting_of_ref": "indicator--031cd23e-5649-45a6-8ef3-2f28c4fa8861", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46285e24-38f2-4d44-8cd9-5dee75490cf1", "sighting_of_ref": "indicator--036eb2ef-0643-4b3e-a01b-8d220c987e7f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5539507f-ff4a-4518-a338-abbf36d2aee0", "sighting_of_ref": "indicator--dcca092e-b89b-4d19-8a37-d9a8c2bdb30f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba3a9f38-d52f-4579-b97b-ba10fe4c95b1", "sighting_of_ref": "indicator--ccf58f31-6825-4991-8d6d-78dc3c2148a2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff610bb0-64c0-49ff-a993-551512e800bf", "sighting_of_ref": "indicator--9b8deeca-5adf-4060-9c43-f3314397f299", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1ed41da-3c48-468f-86ff-9be9d0df2ca1", "sighting_of_ref": "indicator--92c25e9a-f573-47fe-91aa-629f0d7d47f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--232d7a98-cc3d-437b-a90a-e159d6aec0bf", "sighting_of_ref": "indicator--612f4d75-d3df-4fb6-a319-f9c7149a07b8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40a5855a-d9ae-49bd-b2b7-48b8f78711ce", "sighting_of_ref": "indicator--3f466796-ac88-40a5-9dc6-093c9064e351", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78245ff3-bf04-43e8-bf8b-40e8e073a02f", "sighting_of_ref": "indicator--35a4c114-ec16-4073-90bf-31a86e6a0df0", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a45b419-4045-4de0-9858-846fa547eeb5", "sighting_of_ref": "indicator--35a4c114-ec16-4073-90bf-31a86e6a0df0", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0052066a-22f2-450a-9ff8-836d208c341d", "sighting_of_ref": "indicator--35a4c114-ec16-4073-90bf-31a86e6a0df0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ba9d7ce-a456-4b2d-8791-8d7b939cb811", "sighting_of_ref": "indicator--35a4c114-ec16-4073-90bf-31a86e6a0df0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26830cbf-11ea-4267-89b6-6b1daa3d2088", "sighting_of_ref": "indicator--35a4c114-ec16-4073-90bf-31a86e6a0df0", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4cc57d7-737b-4075-a58e-a5d0dedd526e", "sighting_of_ref": "indicator--b9bffc7b-5f4e-42ba-9e6e-09453b279907", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ca297e2-1e7d-4bb9-8a90-f6e8744bba34", "sighting_of_ref": "indicator--6590f8ee-7b35-4b73-bf3c-9d5d4477b4f7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2e4760d-286f-46c6-a469-d4c7e6472a75", "sighting_of_ref": "indicator--e165493d-b782-4ec9-b945-527222c0c731", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--543d655e-cdad-4e85-97bb-77f2284a6033", "sighting_of_ref": "indicator--e165493d-b782-4ec9-b945-527222c0c731", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e42d394-cad8-469a-a1ae-6a44f6588771", "sighting_of_ref": "indicator--2771b4bf-5542-463d-871e-98b25e58fc30", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c90ea4bb-58af-4fde-884b-6e1b42698f5c", "sighting_of_ref": "indicator--2771b4bf-5542-463d-871e-98b25e58fc30", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aa5e8d8-03af-4eb7-83d1-940375593f4f", "sighting_of_ref": "indicator--6791f448-7902-4623-a789-2bff717a473c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5da540db-63f8-40d5-88b3-8e27923bec91", "sighting_of_ref": "indicator--e2048178-eb01-418b-b99c-9fef63890aea", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c7cedd6-cbd6-4853-8d5b-7eac52acdbb7", "sighting_of_ref": "indicator--bddbd196-dbe6-4146-8969-0debd76914da", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37bc78b8-aa40-45ed-b627-fce59414c041", "sighting_of_ref": "indicator--0ef782b5-818e-47ef-9965-6efcd58a3081", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cba8a24e-05bb-408c-9823-8a1c12ef194a", "sighting_of_ref": "indicator--1ddedab8-fc4a-4701-82a6-6908ec2617eb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4f7ab57-926b-4ee3-aec4-b2c646a0ec05", "sighting_of_ref": "indicator--a3e47093-16ee-4bc3-8bb7-931d15c61f8f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d944994-e913-48f6-810e-d0cb6ebc45e0", "sighting_of_ref": "indicator--ba07df96-4d75-4677-800c-5c25b8de82ab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64e55470-c15a-4389-9b66-86b37eda42a5", "sighting_of_ref": "indicator--1ff4345e-5520-46c5-beb8-76a7a4372bb2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24fa8b07-4d7a-4ebe-9d81-4ff2384f8d8b", "sighting_of_ref": "indicator--7781509a-356c-4dd0-bfe6-b7c59c09900b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5740ac2f-4731-4e01-997b-4de70a548cfc", "sighting_of_ref": "indicator--a1fc90f3-da7c-4942-afe8-2fc1d08d9d58", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9343a337-f742-4837-8231-eb9ca0749814", "sighting_of_ref": "indicator--eebb677d-4f5e-43c4-86a9-59cece8377e5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d8d295f-6fe7-4079-8a29-1fe6dc11d19f", "sighting_of_ref": "indicator--07bfe5bf-9a30-4636-b875-66b441125ff2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4980d210-5173-4797-87a3-35aced087a2a", "sighting_of_ref": "indicator--7292ea72-87c6-4cee-8e51-217703701572", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b673313-ac1c-47de-9c1b-a792cdeed73e", "sighting_of_ref": "indicator--44c1651b-825c-4c87-a13f-69bd4c8592ad", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc5d2f1c-1d35-45f5-a81f-9bd7a832f164", "sighting_of_ref": "indicator--ca4651c1-1155-48e4-afb1-981a8fa5e4ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f66afee-0674-4e6a-a442-c6375da6b734", "sighting_of_ref": "indicator--8e742fc9-0efb-4bea-8a62-fa732d44866d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c420767-bcfa-4e9a-8133-3c0ff67204db", "sighting_of_ref": "indicator--10d0e3ef-75f7-45ec-b77b-b83ed954a3d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--971c612d-6b84-42c1-8a58-3dfb03e00662", "sighting_of_ref": "indicator--20f11a72-ae8d-436a-95bd-d04297ce08a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e642b82d-82b6-4847-98a1-af4377c82d7c", "sighting_of_ref": "indicator--f66844a3-9be1-4b58-bdf4-8a5e387cf8c8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f12527e-e050-4209-9819-7779ae11a717", "sighting_of_ref": "indicator--4153c2d1-dcaa-4783-b0a2-7efec7ebd64f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baf8e7ea-9141-43cb-958e-821e8b210255", "sighting_of_ref": "indicator--76285d3b-74f5-48e5-97a2-1b9ed985cf76", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--580caf80-0074-4a4f-a494-a7285a035e5e", "sighting_of_ref": "indicator--76285d3b-74f5-48e5-97a2-1b9ed985cf76", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41770a07-d486-4580-bd75-cc1e3669d55f", "sighting_of_ref": "indicator--ae6fd854-8ab0-454a-baaf-92e1bf7da633", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bdafeb8-4f01-4c6e-945b-d45bdd169598", "sighting_of_ref": "indicator--c5c4f277-114d-42a8-980e-b68115aed60f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab3253da-7188-49bc-8dfd-5f07d0ba1e23", "sighting_of_ref": "indicator--c5c4f277-114d-42a8-980e-b68115aed60f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4e513f5-03ef-4cd6-a746-70b9dad30e53", "sighting_of_ref": "indicator--60e958d3-7b73-4a26-ae53-dc2c5f624164", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b5be085-d1ab-41bf-a896-31a2ff51c7bf", "sighting_of_ref": "indicator--fa7a6429-cd56-480d-b61f-bbc8130259c9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ed19249-98ed-416b-b109-bc34b10d492c", "sighting_of_ref": "indicator--fa7a6429-cd56-480d-b61f-bbc8130259c9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e5f853d-df1f-4268-8839-7133988098c3", "sighting_of_ref": "indicator--eb87bb85-6a99-4160-92fe-8d13bcd63cc3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5cca3ee-d7ff-4b3c-af74-29d45c5fe4c4", "sighting_of_ref": "indicator--eb87bb85-6a99-4160-92fe-8d13bcd63cc3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fa68751-d43a-4ab4-94f1-46cfcf757d99", "sighting_of_ref": "indicator--1f01b62c-dc2e-40b0-b511-9e0d9dcf5532", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acf41927-017e-4a41-a27c-953b39d491ef", "sighting_of_ref": "indicator--e31c9812-4677-48c1-9ec0-e3e53ced4182", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edc6ce84-6160-4c23-a3e2-469f4aab34c1", "sighting_of_ref": "indicator--e31c9812-4677-48c1-9ec0-e3e53ced4182", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfb2fadc-3983-4e13-9296-543549919e05", "sighting_of_ref": "indicator--c6ab8141-1e04-4810-b198-5ac152b4fb69", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--175275e1-1b2e-4b93-a5bb-7f16d68f9b48", "sighting_of_ref": "indicator--c6ab8141-1e04-4810-b198-5ac152b4fb69", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b93db27-8959-4520-a5d8-57c0b45b351b", "sighting_of_ref": "indicator--fc0757c6-4c94-4c1b-aac5-77cbf0dfcf23", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9eac416-8149-47f3-8c9d-4a6d93409202", "sighting_of_ref": "indicator--d2963999-520d-4699-b9fe-8bfbf781ac10", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de7f0dff-6e84-405f-800f-0c15a7692582", "sighting_of_ref": "indicator--80fb46d4-d4c1-4916-a67a-6fcc071a9d9b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4304b5e0-dd28-4687-a4c7-7bd69544eca4", "sighting_of_ref": "indicator--80fb46d4-d4c1-4916-a67a-6fcc071a9d9b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27a002f3-621d-4c26-8f0a-7b19c9f8f8bb", "sighting_of_ref": "indicator--a30187a1-6c9b-434f-aafc-380df6c21e9e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b73769f-7648-4d8f-baed-86d65d99682e", "sighting_of_ref": "indicator--2c4fef2f-dd74-4e40-8589-2481b55ffa98", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6806eb90-2010-40af-b36b-8d061ad982b5", "sighting_of_ref": "indicator--0589381b-4109-4d3a-8655-b1884790d12a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b6f1d34-1450-42fd-889b-4c655572986d", "sighting_of_ref": "indicator--4cbc0ea9-f536-4c64-b5b6-ec3a208dd891", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93936e6f-21a2-4e5f-9183-32f746354dc7", "sighting_of_ref": "indicator--2f346f35-fc56-4d0f-ae57-efe54867d1c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31e7299e-12e5-4f38-9a50-41688de07024", "sighting_of_ref": "indicator--c8f47c55-8289-4f89-b25a-b463ee86fb1a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f528537-3b53-43cb-81dd-d652feed2dba", "sighting_of_ref": "indicator--8da59d0e-2af5-451c-aadc-0b5c6b47e9c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c23a77c-770a-4195-83f7-b85aadd5177a", "sighting_of_ref": "indicator--75a86e26-4109-491e-a65a-edea8bda0521", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58bbfd3a-64cb-4735-82d5-d63a16e279b7", "sighting_of_ref": "indicator--dff896e8-d20b-4b71-9dd4-b16d2efecc86", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3be2124f-d150-416a-9325-74deecd2e6b2", "sighting_of_ref": "indicator--cb681bf2-7c5a-4799-b6a2-42f0d9e4b1a7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73cffe50-1f1e-4335-bc40-9156963a1fa4", "sighting_of_ref": "indicator--a8e8b9ca-6e6f-4829-a598-e4f6decc6b98", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1821471-2881-4ab1-a815-ae1f71034f36", "sighting_of_ref": "indicator--a8e8b9ca-6e6f-4829-a598-e4f6decc6b98", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef468639-1082-4745-8dfc-2ac62574b367", "sighting_of_ref": "indicator--b4c15996-09c3-4686-b90d-16f68be100f0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--413117f2-2b0c-441d-aa7e-d3cfb0cb0e6b", "sighting_of_ref": "indicator--606cdfff-269a-463b-bf08-749221774844", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a076518a-55b9-4f79-835c-8c8b238c5f88", "sighting_of_ref": "indicator--e8b1d1d7-d87c-457a-a694-b7e647ea1ae0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50a2f2ed-417f-4337-b21b-2a0ecefd1c85", "sighting_of_ref": "indicator--e8b1d1d7-d87c-457a-a694-b7e647ea1ae0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--101f509f-42a5-4f5b-b977-e153bda48010", "sighting_of_ref": "indicator--59a4ff6a-070b-46ba-a9e9-f3993f1b2f6a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fb43667-8cf5-4d85-ac2f-6ba99b8037e0", "sighting_of_ref": "indicator--4167ab8b-f690-4717-86a4-83fa23ca9df2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8659f84e-42e9-4fd0-a97e-073934db1622", "sighting_of_ref": "indicator--4167ab8b-f690-4717-86a4-83fa23ca9df2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53d21a7f-facc-487c-9059-5f51cdf9f252", "sighting_of_ref": "indicator--21efb344-fcaf-476b-9822-cf27c3037b57", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85b1b59c-c20f-4201-8034-fd3fa6a908a4", "sighting_of_ref": "indicator--21efb344-fcaf-476b-9822-cf27c3037b57", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c41884fc-42f6-45c9-948a-45b913b6353d", "sighting_of_ref": "indicator--03ebee8a-9043-486c-afb8-2ac22d1d8e3c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa3d9f65-9549-421a-b80c-40f9585ea9b3", "sighting_of_ref": "indicator--03ebee8a-9043-486c-afb8-2ac22d1d8e3c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--742bf8dc-62fa-4759-abc8-06ad21acf6b3", "sighting_of_ref": "indicator--bf0ff085-1e08-44af-b5ef-697766df1492", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a9531ce-f30a-46b6-87ef-0890e849b9f7", "sighting_of_ref": "indicator--6ecfba22-de1c-4268-9600-becce67eaa08", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fc51b0e-6e7a-4bb8-b746-80385a8bdd1a", "sighting_of_ref": "indicator--d6870c76-0d20-43dc-8648-9f3140bd7a6b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d67e311-b9c6-4e60-8f91-0def3ab39c21", "sighting_of_ref": "indicator--91a2ef40-5eb1-484c-8f54-00a9cc4f0260", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c801bc47-6fa0-4333-a516-08f00ea18fe1", "sighting_of_ref": "indicator--91a2ef40-5eb1-484c-8f54-00a9cc4f0260", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d447b5ad-8de7-4666-adfd-ee676d465dd3", "sighting_of_ref": "indicator--dd3c2151-06ee-46e7-badc-3753138de4fe", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1761deb3-0779-423d-80ae-dfc21a88591c", "sighting_of_ref": "indicator--1710c293-ba9d-4bb8-a5f5-8eebc2ed578d", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a58e27f-b361-4330-b310-b7a893edcc38", "sighting_of_ref": "indicator--214e2348-dcee-4626-a3c3-1d4703630e47", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d735aa9-94b0-4b32-a90f-ed6d963fac24", "sighting_of_ref": "indicator--214e2348-dcee-4626-a3c3-1d4703630e47", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ceb36844-0338-452c-9d27-d1ebc447849e", "sighting_of_ref": "indicator--8d4d99eb-c218-4d4d-b55a-d510e5756bf1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78fff71e-d70a-4b4a-bc41-0bf8249b0cf1", "sighting_of_ref": "indicator--8d4d99eb-c218-4d4d-b55a-d510e5756bf1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15047dd0-f693-4d5f-8e56-4259d17815bc", "sighting_of_ref": "indicator--6e71c1db-8827-4ac6-8a68-22b0e2af9559", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b4d4884-ef07-45f4-bdaa-1c446d040800", "sighting_of_ref": "indicator--918387cf-ff12-4144-9090-81fd7747de39", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64568c27-5959-41f7-b841-e2cce065a9d5", "sighting_of_ref": "indicator--918387cf-ff12-4144-9090-81fd7747de39", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5422a6c5-a715-41a6-9796-57740e68f1ed", "sighting_of_ref": "indicator--f6360081-05a1-4ed2-9410-c495d7e774b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cde5b2b6-c452-4c70-9728-ca67fb15f797", "sighting_of_ref": "indicator--f6360081-05a1-4ed2-9410-c495d7e774b6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fd356ff-b697-4151-a100-8cd342d1e6e5", "sighting_of_ref": "indicator--aaacf6a8-22ed-43a1-97a1-fdf06ab43e1c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--543b5c81-1eab-465d-aa1e-f3f5b3999335", "sighting_of_ref": "indicator--aaacf6a8-22ed-43a1-97a1-fdf06ab43e1c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4c89e1a-20d7-4ba4-aa86-c80f1c9cbf81", "sighting_of_ref": "indicator--cd792e62-612b-4326-9394-5609684f20a7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fa6f89c-0856-41f5-9344-309b5f9959cc", "sighting_of_ref": "indicator--cd792e62-612b-4326-9394-5609684f20a7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee84398d-3d30-494f-a4f7-0738753c8fcd", "sighting_of_ref": "indicator--b105ca55-e2dc-4a6a-83cd-0651f4fb3126", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6a3b0d7-4bf0-4749-8244-9b4f457e68f6", "sighting_of_ref": "indicator--06719933-6b22-43cf-8c76-9868e507208e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--508603ed-b942-4c00-b8b7-383d0afda7ec", "sighting_of_ref": "indicator--6ae15b81-aa9f-4669-be3e-8de6885137c5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--253da5bd-1f98-42ba-a180-0b6deda1a780", "sighting_of_ref": "indicator--d44093a3-c770-407c-bfa7-7b4d176b7cd9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cfd599f-a6b0-4fa9-8e19-9c42ba142f96", "sighting_of_ref": "indicator--e5701167-8b13-4ebf-a351-daf8b586ba39", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5db5a7fc-ffc4-4403-bc81-02cc1594dec3", "sighting_of_ref": "indicator--8ef77cb0-7059-46af-aef5-7184c44a53a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be1e657c-7f9b-4c72-8a44-45be5678a3fe", "sighting_of_ref": "indicator--8ef77cb0-7059-46af-aef5-7184c44a53a5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09230cf4-7bdf-4112-951f-9d3471149fef", "sighting_of_ref": "indicator--3f2a8092-4d35-43d7-a871-94781d977735", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5335a026-28fc-4d75-9569-e4a7efdd896d", "sighting_of_ref": "indicator--3f2a8092-4d35-43d7-a871-94781d977735", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc0a0407-732b-411f-aa64-e0023ec0bfeb", "sighting_of_ref": "indicator--1d203b1a-cd5f-4def-a08b-9b0ec4b323e6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--891cd2c4-c118-4583-86e3-4d7d432d00ec", "sighting_of_ref": "indicator--1d203b1a-cd5f-4def-a08b-9b0ec4b323e6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b16d85c0-66b0-4fa8-a558-25ae952c9eb0", "sighting_of_ref": "indicator--ba0d49ed-d9f7-4992-afaf-7a49273c91e1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d79c9e74-a46a-4393-b544-3023e70796cf", "sighting_of_ref": "indicator--ed38a64f-3f85-4e53-9237-b5d5dbab34c2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94a47e88-c52a-49ba-bc05-f26049fc6784", "sighting_of_ref": "indicator--ed38a64f-3f85-4e53-9237-b5d5dbab34c2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3baa688-40ae-443e-9e95-2e1bef41de31", "sighting_of_ref": "indicator--75a5486d-a721-4bed-9478-ba24a59e3a5c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1d303f1-71f6-4e6b-aac0-e86605d7fc65", "sighting_of_ref": "indicator--75a5486d-a721-4bed-9478-ba24a59e3a5c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79d734a9-72b7-4980-bfb0-969f5a3a6ace", "sighting_of_ref": "indicator--fa91e9d6-1ea2-455a-8ddc-512c8837530d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b2c88cc-b977-4a56-b86c-9cb520f7d873", "sighting_of_ref": "indicator--fa91e9d6-1ea2-455a-8ddc-512c8837530d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--190b5e08-6928-4ea1-a7c3-2e2d6a08328e", "sighting_of_ref": "indicator--909fcee7-cd64-4ab3-8a67-f9251d0dbab0", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e29dc220-5d18-48c7-b962-127d4f8757fb", "sighting_of_ref": "indicator--e674b569-7db4-4ba8-ad29-3ff2a15851e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--455f4133-1277-4c6c-bdbb-2f942f6c625e", "sighting_of_ref": "indicator--e674b569-7db4-4ba8-ad29-3ff2a15851e4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c93675d-400c-4dd9-9532-38cb7ff1e371", "sighting_of_ref": "indicator--984d7685-8306-4d93-913c-99b3a22ddc78", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0470b214-76c0-4711-9a32-55beab518986", "sighting_of_ref": "indicator--fce005c1-9fc9-45a1-887c-a9f00e5799a2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afd79424-93c6-431d-988b-eca190f175eb", "sighting_of_ref": "indicator--49c9a622-c272-47c2-9000-dfa8ae57ce79", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e24266c3-ed21-4c79-b989-aeabc1d48dfd", "sighting_of_ref": "indicator--53728b9c-a82b-4d6b-9832-b7ec131a1daf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04aaca47-1365-4382-bd3e-ac764dd63331", "sighting_of_ref": "indicator--68b2bb92-3adb-4a30-9b9b-d444096892d2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bee11af-ac0a-49df-962a-85842e90fd28", "sighting_of_ref": "indicator--5b83f9e3-5588-4207-a6f9-78ccc2af0c6d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f2313ab-782c-4b99-a616-7f34eab59465", "sighting_of_ref": "indicator--596c4fb4-2151-4b45-b056-42d5977b7770", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60e8ac16-9c27-4692-85ba-b30bc2ab8c10", "sighting_of_ref": "indicator--20e8316a-fbaa-4c61-b5d8-f83d9d84ae2b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16683ab5-fff5-49a6-94e5-771936018e7e", "sighting_of_ref": "indicator--52496ed5-8448-4a6a-8259-59852e6d5aa1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43f76a4b-67b9-48cc-aafc-d7e518757637", "sighting_of_ref": "indicator--02a0a3dc-051a-4a5e-8e15-45c31cdde7b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8567b42c-8407-4358-80b8-4895a3782aaa", "sighting_of_ref": "indicator--7715ee01-3799-48e6-908c-deab0656cb62", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ade3956-36d4-4d96-a939-58e34ef67267", "sighting_of_ref": "indicator--08534478-76f9-4608-9201-4065382a704d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44485404-5743-4e1c-8e52-36a74da1f645", "sighting_of_ref": "indicator--7602955b-5a5f-419f-811d-7bceca20d2f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cb33922-796f-4a3d-bb55-ded73c3c1be4", "sighting_of_ref": "indicator--f33d3675-17d9-4f75-9d76-a7f8b1f2c33f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c43350d6-96bd-44e6-882d-59e0edcb8ef8", "sighting_of_ref": "indicator--ca0c2df4-310d-4757-bc6e-2e38cb77aa95", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--445ef678-a2b6-401f-b592-467fca2509d1", "sighting_of_ref": "indicator--723aa12f-2329-41e7-8d75-ee23fdc25b90", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89dc1baa-90bb-4871-9d49-bc42eb3146b3", "sighting_of_ref": "indicator--69ce730f-42fc-4f4e-af5f-6fcb9c6155b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca5f7e59-c706-4271-9a8c-432779357f5d", "sighting_of_ref": "indicator--b04d0e37-29f2-44fd-8eec-8c6f87b4c29b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--492bc1c2-2f96-46a5-86a0-85f2e4f3e0fe", "sighting_of_ref": "indicator--1ba1874a-3ed4-41f2-9b86-943889e19ad7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da19d2cf-35c0-4a4b-8617-bf68483b9946", "sighting_of_ref": "indicator--e0255fbc-79fa-44c1-88c1-195ea1b8d8dd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bbcf6d3-8ae3-48d4-ba1d-31fb1712a7a0", "sighting_of_ref": "indicator--cb09f746-f626-470f-83f4-06d716d211d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65fcc61c-f511-40d6-91d6-f7643612b857", "sighting_of_ref": "indicator--2f282829-4ebe-415e-b097-f963e3b566c1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e876e8e-961b-4f99-a6f8-29d395ce6bfa", "sighting_of_ref": "indicator--2a242c9d-ed4e-46a3-9b2d-ee0044c9e36b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbce03e8-538b-48af-a86e-fa9cb3b940d9", "sighting_of_ref": "indicator--ff41f65a-0bab-4748-8525-34816fc1876f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1c6b788-c0a6-4d2e-99e1-b4a3b2fb3076", "sighting_of_ref": "indicator--302fc47f-83dc-4895-ade7-d0e4c4d90b3f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52b81487-0523-4b44-bc84-fbfe52ce9a3a", "sighting_of_ref": "indicator--ff69b0e4-cc9b-41db-bfc2-2533c7d61125", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e7bcf0b-d1ad-468c-a292-a705e3c627dd", "sighting_of_ref": "indicator--e2218e51-92b6-4f1b-ac7c-90515bdebde7", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ae2da1d-05c8-4b68-a644-a76e028455d0", "sighting_of_ref": "indicator--bf78c183-c4f2-4e53-9f40-8741686ba88a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfae1fcf-391a-4bb0-8da6-d0615e563432", "sighting_of_ref": "indicator--31e525dd-01a7-45a7-b9a2-4875c5ccdeb6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1303ce9a-bc6b-4bc0-8d8f-06db8245ea81", "sighting_of_ref": "indicator--bddf13ae-82b8-4fdd-832a-59be09799c13", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29a4cdd7-8bab-4ab0-b952-683b927e6f7f", "sighting_of_ref": "indicator--0c95f811-ac47-498a-b6a4-f300990dfbe4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89db005f-75c9-4611-bf53-f2e96de3ba72", "sighting_of_ref": "indicator--341dd8e9-4b31-4b07-91e5-9bca5dfa9d17", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f60ca3d-0624-4709-b6e0-8bbdc23f07eb", "sighting_of_ref": "indicator--3ffe5ef7-3fb2-4a3e-b87f-002d9767c41f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e51b34ec-6bef-4263-960f-d40bc4581cfd", "sighting_of_ref": "indicator--320e602e-aae7-4f67-97c1-9540611053db", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7634718e-c1eb-4700-a260-13a6d72f0be6", "sighting_of_ref": "indicator--b9f2f1a3-b595-4912-b57b-cb18f09bc1d3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db7d41ed-1108-42fa-9981-f5620b8844d1", "sighting_of_ref": "indicator--17f97b10-f1bb-498e-b1e6-a72fb3762921", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--749dbb97-faa2-46fc-8135-b778ca9a1555", "sighting_of_ref": "indicator--17f97b10-f1bb-498e-b1e6-a72fb3762921", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2628183-74f4-4472-b322-b6bf0f85d1ce", "sighting_of_ref": "indicator--bee75213-3edf-47c7-98f0-5204cc7f4a44", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98f11f0b-3380-4bd5-8340-8f9aaf887185", "sighting_of_ref": "indicator--1476a605-a805-4e1b-b620-90190c88d6f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f68c0874-1dbb-41de-81ed-94c0ef6f76c6", "sighting_of_ref": "indicator--40ff8754-c3be-46e0-b112-b727a2ecfc07", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d052af77-5d9c-429e-ae6b-256e5347de53", "sighting_of_ref": "indicator--40ff8754-c3be-46e0-b112-b727a2ecfc07", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fa9c6ee-ae20-4a4c-adad-e6747eeadae2", "sighting_of_ref": "indicator--72cac501-bd47-4439-98d4-29d3a3e32e32", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1655784-e52b-4944-bf64-0981a5ed7c23", "sighting_of_ref": "indicator--4575a247-5e67-4b33-8ae5-72efc88aec99", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae6412b4-6c92-4f9e-9d94-fbe703957f03", "sighting_of_ref": "indicator--210ae951-a58c-4229-91ff-bcc9801b31ef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a23f166-08d4-4d64-9cd4-54a10f872e55", "sighting_of_ref": "indicator--a33dad68-9ce6-49b5-b2f8-58b8e8f8df50", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a83eafb4-492c-478e-9b86-977f6fb0bed8", "sighting_of_ref": "indicator--c065894c-b30a-44b1-835d-ff9ce1b868d2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0589f6d7-f74c-4f29-82af-07304dc9b772", "sighting_of_ref": "indicator--a4062f95-352e-4e90-a808-5560f46f12be", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e809806c-89fe-49c3-9548-55a8498c809d", "sighting_of_ref": "indicator--a4062f95-352e-4e90-a808-5560f46f12be", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c856cf60-888e-4111-ba02-f99f093ebb1f", "sighting_of_ref": "indicator--46b0f7e3-0ed0-4dd0-9a9e-24bb9e8cf407", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7a52190-b6d8-472a-be26-c73dede30dc6", "sighting_of_ref": "indicator--5c816d24-f780-44a3-87fb-54ec0fd072d6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c1c649f-007e-49e2-b94a-f7ee1a1890c5", "sighting_of_ref": "indicator--6687c943-0cfc-4a82-adb2-eb325f53d855", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--837f4ee6-ff52-416b-9f5f-562315097326", "sighting_of_ref": "indicator--6171629e-aca0-4fdd-8f10-d6cae831f73d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a38a394-6b4f-41ba-b0b8-6ffbbe880bff", "sighting_of_ref": "indicator--6171629e-aca0-4fdd-8f10-d6cae831f73d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3672a952-b7b5-4670-ac80-905063d765f7", "sighting_of_ref": "indicator--6171629e-aca0-4fdd-8f10-d6cae831f73d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5c5559a-5b83-429d-9311-9160dc2cf66f", "sighting_of_ref": "indicator--5a4df1c7-f4bb-4a7a-ba09-dd8b65121843", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acf03eb9-e11a-4309-b30a-09131a527be6", "sighting_of_ref": "indicator--adaa4473-479c-48cd-91ae-bd5b2b9c24f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32f401fd-a60b-4f83-94dc-10879149fcf1", "sighting_of_ref": "indicator--096313ac-5ded-4167-b25f-43f911940847", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1875fad1-1ad0-4745-a63c-b0c5d850c619", "sighting_of_ref": "indicator--fc1e454c-3f9c-467c-bbbb-9bb3753a4a87", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d6a2efd-096f-43c4-9026-112a848d10fd", "sighting_of_ref": "indicator--fc1e454c-3f9c-467c-bbbb-9bb3753a4a87", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ece5933-0a9e-4d4f-87b6-0bd3dab7d133", "sighting_of_ref": "indicator--c46427d4-eaca-444d-b9e2-43283233c192", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec0a1eb5-231b-4fd3-8af6-c3777ed956a5", "sighting_of_ref": "indicator--9fad9271-cb6a-4afa-b3b3-d8c4043a091d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74dac928-8c89-4ad2-9314-9b47e5bfa2cb", "sighting_of_ref": "indicator--95cf4127-a576-425e-a5fc-6695e4c4acce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b899448c-6079-4c9d-b989-c77b93253a1d", "sighting_of_ref": "indicator--45a5a048-4376-4131-af52-4b09a3a000c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b743340-5b23-44b8-bcaa-2c362a99e588", "sighting_of_ref": "indicator--60b9f6d5-13ed-4180-9503-a5974849b94e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3c5eafd-558e-42d2-a675-5f8dde770e11", "sighting_of_ref": "indicator--ff4ce834-0df6-4e7b-9e6b-aa16ca74e714", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8b5adfc-577f-4aa7-8bb4-d79565b80f1a", "sighting_of_ref": "indicator--621aeaca-8979-4587-ab80-3e1ea674a5f5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03f073c6-e2e1-4771-83b5-083e087be9f9", "sighting_of_ref": "indicator--8c30db0c-66f7-4c34-aad9-3db47818291f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3d930f1-f82f-4de9-9e01-f869e477ece7", "sighting_of_ref": "indicator--a6cde41f-5451-4c0b-a02b-cd697f1888aa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1abb93e-cfbf-4845-bdfe-840da4c2fd85", "sighting_of_ref": "indicator--e1164e2f-41cf-44e3-b588-1e52df261022", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc44ce3f-515e-46da-bc48-e804157b9eb2", "sighting_of_ref": "indicator--560acd34-8e22-4a3f-a57f-138214a96535", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7276eae9-0aff-44cd-8036-ccc5acf51f58", "sighting_of_ref": "indicator--dfc1b1d7-f576-46a9-8c53-864cd7326806", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cf9b758-4022-45ba-acfd-d4af190bce5c", "sighting_of_ref": "indicator--4590b1fc-ec42-4edb-b549-3998e1536f2a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de8a0e0c-4b02-49da-b9b6-f31879e29b32", "sighting_of_ref": "indicator--6a7e0bec-93e4-4d04-ac55-7aa0a53abd4e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20ca3a34-1f98-456e-8919-bfa277c13501", "sighting_of_ref": "indicator--b0e7d02a-1767-40cb-9046-a963071b8548", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--601d4ce8-dfa7-4c05-b9df-fecd99e4c37a", "sighting_of_ref": "indicator--b0e7d02a-1767-40cb-9046-a963071b8548", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f428f96-c4cb-4bc0-bfa6-5237e236dd29", "sighting_of_ref": "indicator--633b452e-ce99-4ff9-9076-4e9fe5c86d29", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--725bb189-23ad-435f-b8e6-d677e4100bdf", "sighting_of_ref": "indicator--633b452e-ce99-4ff9-9076-4e9fe5c86d29", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1677bcd0-9e71-4136-bd19-61011f396f20", "sighting_of_ref": "indicator--bdf23761-2642-4e37-8b21-4d97314daec7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93581b01-ed14-4543-a1d3-ab3d8efd139c", "sighting_of_ref": "indicator--dd06f198-b518-479b-ac34-585628cc12c5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2e37bf3-a6be-4c58-81ba-3a2e82e59a2d", "sighting_of_ref": "indicator--e411406e-8c4f-4b53-bac7-cf732a7605f3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0951ac4-a0a3-48f7-92e5-7e972461dff8", "sighting_of_ref": "indicator--e411406e-8c4f-4b53-bac7-cf732a7605f3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b8d56ab-0a79-46f7-a64e-1693fd2488e0", "sighting_of_ref": "indicator--9f32dcfe-22a7-4960-8723-835d7a378354", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96cf331a-4002-4468-9a30-7d860c7a69bc", "sighting_of_ref": "indicator--cec94d7d-4399-4497-9298-c53cf61ac2f4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--254ce268-534a-425d-9f7c-de1e2231b058", "sighting_of_ref": "indicator--cec94d7d-4399-4497-9298-c53cf61ac2f4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1138ed86-1ca9-444d-b336-9099fb72745e", "sighting_of_ref": "indicator--0aa25aa2-9964-4cbb-a036-703012dfbf5f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d75e4c7a-2273-4ec2-a28a-36166f478546", "sighting_of_ref": "indicator--612235f1-3041-45a6-b681-eec3c72d812d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ff7f2ac-8640-4532-80b7-c4df701e4776", "sighting_of_ref": "indicator--612235f1-3041-45a6-b681-eec3c72d812d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d20db80a-529c-41ef-915d-37e20fb9741a", "sighting_of_ref": "indicator--d4f741a5-ff50-49a0-ac1e-b706b60c2815", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1374b31-f696-4584-b482-e38ab2cac24d", "sighting_of_ref": "indicator--29350756-03ac-490c-baae-f4ae37c879ab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--217b4268-bc5c-4e6a-bbb4-11715be1e9fb", "sighting_of_ref": "indicator--07c82e53-337e-41ff-af25-4dff79f78079", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--134ede79-0f6f-4909-971e-3038931ecb9e", "sighting_of_ref": "indicator--e86e8a21-54fd-4dfa-9b44-a03f91c60c81", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc2b8f70-5a22-4ff2-8672-df542c803693", "sighting_of_ref": "indicator--4f8f83b0-b399-4f51-b7d9-b15ebbc1a795", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a51678f-7d69-4fbe-adb2-8981ad65cdad", "sighting_of_ref": "indicator--32928295-661f-4f5a-b042-2512e1eb9710", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4118c869-6bb6-415b-abc6-5b884946d2d6", "sighting_of_ref": "indicator--c68eeb43-ce44-4aff-a04f-6a4c79d87383", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d59cd39-99e4-49cc-8e7d-f2470a4102c3", "sighting_of_ref": "indicator--db5b128b-9d01-4661-ac16-987072fbfe08", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd912da2-6781-4017-97b9-2e9231a21093", "sighting_of_ref": "indicator--83ab7813-f1b3-40ab-923c-d8301584920d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98a86577-f026-4127-9c9d-b15b4f90e30a", "sighting_of_ref": "indicator--f5f49d2e-afdc-4d93-9750-3acaeb1328e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--405c601a-230b-4ad4-8537-a2eeb46de942", "sighting_of_ref": "indicator--f5f49d2e-afdc-4d93-9750-3acaeb1328e2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--089855bf-d653-4df3-9587-bf8b454f2171", "sighting_of_ref": "indicator--3ef702fc-7436-4498-86a4-b35506c6631f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c9f5c40-12be-4eba-9751-73c27cf89f04", "sighting_of_ref": "indicator--9f88b829-7ad2-4a80-8f49-fbc79d6e2639", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--744e6cf0-3a3c-44bd-a25a-8ef0e3a85e4c", "sighting_of_ref": "indicator--9f88b829-7ad2-4a80-8f49-fbc79d6e2639", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd2e899d-8afa-4158-93c1-920448223a10", "sighting_of_ref": "indicator--e5bebf2c-af66-4173-94a4-2af9c1c35c6b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d405ebc1-06f0-453f-be3c-29e2f64e7ab4", "sighting_of_ref": "indicator--2c3affa1-375c-450c-a90f-5be9f904b4e5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f510cdb-6699-4074-9f11-fd8b6035f06a", "sighting_of_ref": "indicator--2c3affa1-375c-450c-a90f-5be9f904b4e5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fecb6a19-9658-47b4-af21-58f323719442", "sighting_of_ref": "indicator--4dd75fed-2a9e-4e51-8957-da5f8536a3b0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89202f91-f019-420f-8eda-1e456f5e8ce3", "sighting_of_ref": "indicator--8c6c1c51-d382-4389-8fe4-d99da6e6cc08", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e279954-54d3-441f-9b97-ad483921ed24", "sighting_of_ref": "indicator--ce6c6136-140d-4247-ba6b-a79573d91cd2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df3bd668-5e22-4504-a3a7-35df6749bcfc", "sighting_of_ref": "indicator--fc3fbdde-662a-4778-a050-ed82379a41a8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0a2103e-f413-4061-84ae-d55c1427b728", "sighting_of_ref": "indicator--7057f1a3-1a88-42e5-b84f-ac6836d2fdb1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed0e7130-5088-4c56-9acb-209c4d6ac355", "sighting_of_ref": "indicator--c9054cf8-ea45-4bba-af98-8da80921043a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be8ca935-6377-4f02-a697-24e6457a46c0", "sighting_of_ref": "indicator--c2cb8fd6-3b79-4dd2-a731-5fbc3e0c863d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d94f12d-b2f4-48fc-b107-905d79e813b4", "sighting_of_ref": "indicator--c2cb8fd6-3b79-4dd2-a731-5fbc3e0c863d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0652ff9b-368d-4331-a127-07002c2a3e25", "sighting_of_ref": "indicator--5135fc05-8d60-44c5-aff6-24e78426e842", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d61505bd-745d-4c11-af37-d608e7818268", "sighting_of_ref": "indicator--5135fc05-8d60-44c5-aff6-24e78426e842", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d25f4f15-b31e-4397-828f-8d301461585a", "sighting_of_ref": "indicator--ffa363ad-0141-4973-8b98-73ded8b29946", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d4b7a43-401e-4f88-b1e4-0607a6fe8ed0", "sighting_of_ref": "indicator--f2b49175-a2f2-4d42-80f6-0503321e1140", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4cdee65-ac8e-4411-bd94-f807932092fd", "sighting_of_ref": "indicator--04281871-eadd-4d76-a53e-50fdc9941b91", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7a945dc-6e78-468a-9d61-340d87bd4376", "sighting_of_ref": "indicator--04281871-eadd-4d76-a53e-50fdc9941b91", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b913e52-db01-4cbd-bf77-c828f879fa52", "sighting_of_ref": "indicator--734a1578-f919-4fbd-afa8-05f918f75039", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64af4719-b3a1-462f-b17e-a12fd242bd4e", "sighting_of_ref": "indicator--570efc52-4025-4322-ba5d-5e1329c69ffe", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0763e42f-5a44-46cf-813d-d9ce8eef106f", "sighting_of_ref": "indicator--570efc52-4025-4322-ba5d-5e1329c69ffe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--815f0471-efd7-42ee-b40e-ea4a9e9ed575", "sighting_of_ref": "indicator--8a30ae8a-a765-4d1b-a72e-6ff3ad8fbba4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba654f1e-9f88-40cb-971e-e53c59f9b0e5", "sighting_of_ref": "indicator--8a30ae8a-a765-4d1b-a72e-6ff3ad8fbba4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71d854c7-ac5f-4760-83e4-67933aa718f0", "sighting_of_ref": "indicator--8fc3021e-bf2b-47c1-92d2-f66c46703473", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dec72e45-e202-4528-8a30-924e4da13e45", "sighting_of_ref": "indicator--8fc3021e-bf2b-47c1-92d2-f66c46703473", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2e201ab-324c-4f81-8a17-26ecce50265d", "sighting_of_ref": "indicator--24cddbb1-7688-4556-b598-5f8f020763d9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84c74ff3-16cf-443f-be3d-e2596759d77c", "sighting_of_ref": "indicator--8f670190-75e6-4d6c-9118-7ebe2b4fa66d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f5cd454-9ced-4138-b0f3-9f67a12dbee9", "sighting_of_ref": "indicator--eb2ab949-a981-4f96-8092-b276f3d2d6f8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--387a0f43-c081-4da8-8d85-6fb884c03583", "sighting_of_ref": "indicator--0bfbf00d-8caa-4b81-a815-2874793b8e94", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b377908-4a7e-4beb-9a1f-c5e2e5f6819b", "sighting_of_ref": "indicator--0bfbf00d-8caa-4b81-a815-2874793b8e94", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa85e560-0ad9-4697-9dbf-160bf54e97d5", "sighting_of_ref": "indicator--a1dec52c-9b01-4403-a9c4-7156fc1093fd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3b41304-acf8-4b4f-9b2d-46b7147beeb4", "sighting_of_ref": "indicator--0b5573ba-3d25-4c89-8b26-54af78ac3346", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e9c7e65-adc7-4f12-965c-c526e12a0904", "sighting_of_ref": "indicator--6f9215a2-4eea-4683-930e-97074273de2a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05c71024-2d65-468c-bde2-4a041407afdc", "sighting_of_ref": "indicator--36eb08cd-beec-4f32-b67a-6a8dd9adb981", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d7c95e1-faf2-4a87-95dc-9b5ca2e85388", "sighting_of_ref": "indicator--c6cfdf3d-5941-4c44-981e-e8b331933776", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e213b8f8-f8af-41f9-9d9b-10e427525f19", "sighting_of_ref": "indicator--b72de176-a1cf-418e-93b2-6af6808c931f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da000e85-bbfc-4a65-abb6-6cf2dda3b966", "sighting_of_ref": "indicator--b72de176-a1cf-418e-93b2-6af6808c931f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--243a3363-5b17-4873-b707-39a4d44321c0", "sighting_of_ref": "indicator--8e8e5bc1-ecc5-4748-b9f2-c363ffd2ff74", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39ce594c-50a6-4dd7-a873-54f48bb1da21", "sighting_of_ref": "indicator--0e899f82-2520-4620-ad66-fc62ece3a642", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9e58d0b-ff8e-4b47-8d25-01ec66d4efd9", "sighting_of_ref": "indicator--c9ae60c5-379e-48f0-bb2a-209e178c1f32", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f2fac38-1862-4fcf-9a35-d53f82559186", "sighting_of_ref": "indicator--cf8455ab-1f30-40af-876c-1fbe80fd2d35", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89482ce8-183d-4713-bf6a-30b3c0e7c6c9", "sighting_of_ref": "indicator--f635fc6f-028f-4e5e-9012-0d69c18b7dc8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d2ee6c8-8d0a-48a5-9da4-9f3077054be9", "sighting_of_ref": "indicator--ba23eeab-e80f-4a83-8af6-d64950124f7d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dff8b595-7e9e-419c-9f7a-afc7454cf897", "sighting_of_ref": "indicator--df7a56aa-e260-4cdf-8b49-b9e52ff770b2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed33df67-509b-4bfe-b2be-201da72b03ac", "sighting_of_ref": "indicator--de655f9d-41e1-490b-9e2f-7cab5fa6dab0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3885ab8-300a-4d50-b200-49064aff4f37", "sighting_of_ref": "indicator--cdf9522f-45de-4450-bf92-ce063368c3d9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61a32b3d-127a-4cab-8990-3bd4be157e86", "sighting_of_ref": "indicator--2c7aa601-5929-49c4-9953-91222dd652c8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71f6c48c-0449-40a3-96ec-0c94f8189a5d", "sighting_of_ref": "indicator--a01cb4cc-0eca-4839-a776-bf293fa4ae90", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1540185c-98ed-4ab1-992d-dd2bac9d117d", "sighting_of_ref": "indicator--0af46fb9-6d7d-45ea-a99a-8d7845226a6c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12bd65dd-550b-48b6-bb89-701dfc675c22", "sighting_of_ref": "indicator--d32c0da9-6215-4a0c-8dc6-e9854c49cffe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bff16244-3f1d-46f6-9ca1-4c167b1e371a", "sighting_of_ref": "indicator--49b59ed1-6ec5-4170-ba55-897f2fd95f5d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e511e01f-0a58-4f5b-a0e0-02e13af784f4", "sighting_of_ref": "indicator--f6c12140-dbdd-4789-bac6-cd7885fec574", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5daa1dd6-da92-439a-a970-b4382bf7ed89", "sighting_of_ref": "indicator--6beff73a-0c7a-4976-bced-1e4901bab938", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b5e8548-992e-499d-86c5-9922c7e341cd", "sighting_of_ref": "indicator--1bf914ed-d9d7-41c3-b121-9587db104520", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9afd69b1-b286-4246-9435-2ef68e4d06e1", "sighting_of_ref": "indicator--ed2ee94b-16d4-4065-bc6e-ef3d7108661d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76c78d1a-f73a-420e-b6b5-f23da48c3033", "sighting_of_ref": "indicator--263869cd-da1e-4fcc-8521-d6b35685ecb5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6618f4c-050a-432f-b0d5-2123b200f58d", "sighting_of_ref": "indicator--263869cd-da1e-4fcc-8521-d6b35685ecb5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d46472f3-b19c-4144-be5a-9ab416e4c2b6", "sighting_of_ref": "indicator--16174540-926c-4112-8f68-b2087ec747e8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06176c07-75a8-4172-a253-c1845a027dd1", "sighting_of_ref": "indicator--2467969f-a69e-44a6-8c4d-a3f812df205d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32b08a98-ba36-41f5-bd72-e61a2f24b67f", "sighting_of_ref": "indicator--2467969f-a69e-44a6-8c4d-a3f812df205d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7abfc510-7da8-4a30-8d90-f76e999aff7c", "sighting_of_ref": "indicator--6666c237-9508-4819-9862-af502ea5cf4c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--067f48c4-6378-48e4-9eda-b960e54051c7", "sighting_of_ref": "indicator--fb0a12d4-5a32-4775-a878-94a5e94b2c36", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7e9bded-7e3e-4552-9217-593db61c8a8a", "sighting_of_ref": "indicator--be4b4d31-3600-4bd3-adfe-caa92656ffc7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c2e9234-a189-4931-ba8b-4c2d94167e10", "sighting_of_ref": "indicator--6320a8e0-8365-40ca-83a7-862a48db8101", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c43387be-22fa-4c22-bf92-b77c35d9a9c7", "sighting_of_ref": "indicator--6320a8e0-8365-40ca-83a7-862a48db8101", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca375d23-290c-4f7a-abf1-410c98506c55", "sighting_of_ref": "indicator--6320a8e0-8365-40ca-83a7-862a48db8101", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ed9260f-a2de-49c3-86d8-2cf3a9c2ca58", "sighting_of_ref": "indicator--81d7cdbb-f196-4413-8d03-844c34f90978", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96e8b74a-02a9-4738-8a04-c85cc42622c7", "sighting_of_ref": "indicator--4f4a429b-67d5-4391-96d9-d3c64db91a5f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--425ad747-b5b0-4e3c-b611-a5131fafdfe3", "sighting_of_ref": "indicator--d0e3ca09-e6a4-4b8f-afd9-2a87a289eb77", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f858b5a2-535a-404f-9e8f-ff14fdaeb847", "sighting_of_ref": "indicator--d0e3ca09-e6a4-4b8f-afd9-2a87a289eb77", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6be62046-790e-478c-b152-63620634e9ce", "sighting_of_ref": "indicator--b163d029-e871-4657-8735-902ac7b56305", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--991f95fc-85a6-488f-925b-b8e2955a225e", "sighting_of_ref": "indicator--43905e6d-15ae-4881-a53c-1923541a5607", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39dd5f46-4b0a-4920-ae32-df6f6c670b6c", "sighting_of_ref": "indicator--af27e9ac-0c37-4e5d-b74a-bb1f0b6b0068", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ea0fe21-eca2-4e01-ab92-97611aaf4467", "sighting_of_ref": "indicator--efdbb111-0135-412c-91ec-49b823df99e2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9e20836-cd18-4c3e-abd5-37aa9e412c3d", "sighting_of_ref": "indicator--388eaab9-b7d9-4ade-97b4-8c0962a06e37", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4adeb6db-cfcd-4534-997b-851cd71c6f1a", "sighting_of_ref": "indicator--03029f64-b6f1-46fa-a0b0-dd8f5f634f75", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de3cc5bf-2b07-4271-a17c-419e2985b209", "sighting_of_ref": "indicator--03029f64-b6f1-46fa-a0b0-dd8f5f634f75", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73507cb6-df74-430f-8f41-c262ccded315", "sighting_of_ref": "indicator--09791b52-6120-4a3c-9a84-db96ef0431ea", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0014b85a-f150-4ddb-a298-5aa405b0109f", "sighting_of_ref": "indicator--09791b52-6120-4a3c-9a84-db96ef0431ea", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f590368-2f6d-4dcf-b8a7-28ec2be800eb", "sighting_of_ref": "indicator--3c7d64cc-52be-4e99-9f0d-d2d75a8923dd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e21c50ed-7569-4088-b174-cbfa0fe61fe9", "sighting_of_ref": "indicator--ddb8356f-fb33-42a6-b86b-66c78018386e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--437f7052-8609-4f90-8990-8f50c41c16b7", "sighting_of_ref": "indicator--fe1ebf79-2cea-4ec7-bd14-7312030f034b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84059b59-ce23-42a2-847f-1d578fc23481", "sighting_of_ref": "indicator--ac30ee05-ee56-4f57-8b16-09b7817c4443", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--691dc98e-acae-4941-bf25-26e425ef19fa", "sighting_of_ref": "indicator--a59e40fb-3f73-44c9-bc4c-9c83ef448be3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3eb883f4-0449-43db-a3c5-02d3da3eee1c", "sighting_of_ref": "indicator--a59e40fb-3f73-44c9-bc4c-9c83ef448be3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abb3638c-1971-4ad3-915c-4643d8f33a5b", "sighting_of_ref": "indicator--df65aecb-81be-465f-896b-ece9d5ab92e7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8eca8b88-28e1-47b6-b961-b8d00095d582", "sighting_of_ref": "indicator--61d00fc5-3131-4ad5-8309-f921b4964392", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f80c565b-222f-4903-ac6b-878b5c2b831c", "sighting_of_ref": "indicator--61d00fc5-3131-4ad5-8309-f921b4964392", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a911521-c15b-4852-b667-f8289bde7dd7", "sighting_of_ref": "indicator--cec7e1e4-ff18-481b-af25-8f567087f473", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--561f9bba-5ffd-43b0-bdd2-9090afc13404", "sighting_of_ref": "indicator--3726d83e-5226-4b95-a1b6-8359792a53ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94646f48-e1c5-4af0-9e47-368e98c17337", "sighting_of_ref": "indicator--31d02286-d30c-4446-95a9-ab0a954b494e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b27182e-3fdb-4a17-8740-8d22f28bd19a", "sighting_of_ref": "indicator--6e70aebc-e155-445c-bf2f-2c99484d6355", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45628a5b-b9cd-4877-bd2c-e952d0d87e00", "sighting_of_ref": "indicator--f20032b0-f4ff-48a2-b37d-ff6a4c465869", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f759afbb-928b-4f71-8239-3746af2f30a0", "sighting_of_ref": "indicator--ab97cb47-bba9-4e25-894a-8d914db35af8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba130dfe-8cb6-460a-aa00-2c2858f3f7b5", "sighting_of_ref": "indicator--00207b83-744c-417d-a7f8-faa560e46127", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93d5befd-a2dc-45a9-bc80-bd0139fa5597", "sighting_of_ref": "indicator--0d929ec4-3db6-4807-90a6-e4b796f01c53", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0df6dbc5-86f0-4fce-92cc-44351ab1d07b", "sighting_of_ref": "indicator--0d929ec4-3db6-4807-90a6-e4b796f01c53", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fd4d2f2-0201-4d73-9881-c44be54a626b", "sighting_of_ref": "indicator--365de54a-76c4-47da-a839-2d347a74b83d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4efa517a-124c-4127-a1cf-891090882b5a", "sighting_of_ref": "indicator--7beec212-5581-4c7e-8f8e-7790cbea9fbf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa4fc6fa-3fd9-4915-89b6-0f068d7f8cf7", "sighting_of_ref": "indicator--7beec212-5581-4c7e-8f8e-7790cbea9fbf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aa99f5c-98a9-4441-baef-3abca257cc88", "sighting_of_ref": "indicator--896b847e-fbb3-49dd-b956-a8f04dfe59b2", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1942a4e5-e54b-4a08-bf45-a2e2e7251a42", "sighting_of_ref": "indicator--c75062dd-81e8-4922-ac28-07dd07a5e573", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1e3bdf9-0fe3-4539-9ae0-07e6c81ff683", "sighting_of_ref": "indicator--22839fac-6be0-42c2-9b8f-ffcf5e43f33f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe1d389f-313a-4aed-8cd0-22181fc72ccd", "sighting_of_ref": "indicator--8a6192a1-2702-4e25-97e3-267422e3d12f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47eef3be-e2e4-48f8-8b33-31f4f574ffc7", "sighting_of_ref": "indicator--8a6192a1-2702-4e25-97e3-267422e3d12f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b233cdac-f192-48aa-b69e-7d23b8f5b7e3", "sighting_of_ref": "indicator--39e995c2-2049-4cd7-85a6-dccae9ac5f50", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56989804-8282-44f6-9e6f-2898b08d476b", "sighting_of_ref": "indicator--202a85a4-a80d-462a-985f-2f510aaab871", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69e30eb6-fc77-40dd-9571-7547f9ae32c2", "sighting_of_ref": "indicator--8f386090-4df9-44e9-ac61-11a6a382a421", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27c00267-a393-45c8-9367-53b141d006c0", "sighting_of_ref": "indicator--a8753d7d-b887-433d-a927-cd6fca12baa1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6af4c0f-889b-4a91-80bf-d65e5cfa35e6", "sighting_of_ref": "indicator--e100be9e-3bd7-40cd-b2c8-6a53762444a6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27c39caa-4fc7-4454-b908-e95ba8322f56", "sighting_of_ref": "indicator--e100be9e-3bd7-40cd-b2c8-6a53762444a6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40b78920-038d-4468-aa77-e12970962c46", "sighting_of_ref": "indicator--09ce1e5c-e5a8-4c1d-8696-c6b4aa2e0f99", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c86a31b8-46f3-4c80-bcab-7a8c80286a84", "sighting_of_ref": "indicator--d4b02d48-c007-423b-99e3-a786c7a351da", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82c3adad-4ae2-42d9-9042-c3304d1fc05f", "sighting_of_ref": "indicator--43407f9b-d6f1-4a16-9346-9029e23b7fa4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d44f5310-ae26-4fdd-9d0a-b2310d287ac3", "sighting_of_ref": "indicator--98e89742-5492-44ea-8b85-e2dd71ff0d0c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60156187-167e-4d71-ba3f-2973512bb6dd", "sighting_of_ref": "indicator--98e89742-5492-44ea-8b85-e2dd71ff0d0c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b64445e8-7053-4a32-aa6e-912e9bb788b0", "sighting_of_ref": "indicator--1cff51c3-f862-4155-9a86-2ca0ff6239bf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d96b08fd-6479-4d72-a121-69b92dd0c1e8", "sighting_of_ref": "indicator--1cff51c3-f862-4155-9a86-2ca0ff6239bf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--265f8c7a-e6c2-48e0-b660-614a1131d5ed", "sighting_of_ref": "indicator--5beaa0e2-d666-45a3-9e28-6dd58d6312d4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05711004-780d-4db2-b34d-adc437e4859c", "sighting_of_ref": "indicator--e3fc7bc4-bd6f-48ec-8d1c-ae7d7a8d4f61", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbc94bf4-4915-46e6-aaff-287b54aa95d0", "sighting_of_ref": "indicator--9cf4e8b9-0fc7-4c78-88ae-7c605f23a7ff", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--915b4919-4028-4b09-a4a5-b215a2694e48", "sighting_of_ref": "indicator--4064025b-4bfa-4c9a-b4f9-bc5765dfd748", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7596bdf7-c664-4a99-808a-dc40b097499d", "sighting_of_ref": "indicator--2825c7da-6756-46ff-a074-9e0ae77b572b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--882a48ef-c5cb-44b0-a919-2668035ea230", "sighting_of_ref": "indicator--2825c7da-6756-46ff-a074-9e0ae77b572b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fc867b3-68c5-45e6-842d-3016130da349", "sighting_of_ref": "indicator--3b5f471f-bd54-4ddd-9d23-b5760da88e14", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61fd8a0a-c9a1-4c34-84ad-395e68ab8d55", "sighting_of_ref": "indicator--3b5f471f-bd54-4ddd-9d23-b5760da88e14", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c01bddc5-dea9-4e3b-a3ef-8ab2e68e6ae5", "sighting_of_ref": "indicator--b71f29fe-bbfe-44c4-907e-b8999b051b68", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d43ed6a9-51bb-460e-b0c8-3a4cd60b34e8", "sighting_of_ref": "indicator--0011d401-1c31-4c7a-8681-74bd83b48267", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50e3a2b0-5bed-408b-8631-31bb34e47fdd", "sighting_of_ref": "indicator--cac99cad-81d6-444b-80e0-b4e6f41100fb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e74dd056-3a59-4be1-a7aa-bf9f9e6f365a", "sighting_of_ref": "indicator--72cf5a98-bd6b-46e0-92d7-43b57f36c007", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3894b6f7-773b-4902-9b9c-6f2b12e270fd", "sighting_of_ref": "indicator--72cf5a98-bd6b-46e0-92d7-43b57f36c007", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cf9c2a5-af84-4005-bfcd-97cdfe8bc0f3", "sighting_of_ref": "indicator--1f790b28-2449-4ddf-ae92-009161624473", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de9bec56-f1b4-40cc-9484-9b13837740de", "sighting_of_ref": "indicator--1f790b28-2449-4ddf-ae92-009161624473", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ce39f8c-fcf4-48e9-b5dc-f33862d384d4", "sighting_of_ref": "indicator--b0f3571b-59b5-430b-a2e6-c1428a91150b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6e6d364-c743-47be-8f91-364e11934df5", "sighting_of_ref": "indicator--b0f3571b-59b5-430b-a2e6-c1428a91150b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86ff8a9b-bdc8-4eb0-8d24-88b04f5f0c01", "sighting_of_ref": "indicator--c7f941af-734f-402d-9877-8036fc3f2df0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df8ebd89-0d36-484f-9204-37b02391dee3", "sighting_of_ref": "indicator--20dd9ec7-b8f3-4426-93f8-adce44707dd6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9d89f0f-1dd0-4981-bcbe-1d7208d7a58a", "sighting_of_ref": "indicator--20dd9ec7-b8f3-4426-93f8-adce44707dd6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ce0bf4b-b485-400e-b296-45708aa6701c", "sighting_of_ref": "indicator--79b85c4c-5de2-46ab-bd9a-80efc7303679", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18d35d50-eee2-4c7d-ac08-6f179c7b3c91", "sighting_of_ref": "indicator--79b85c4c-5de2-46ab-bd9a-80efc7303679", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8353d40e-72b7-465c-94c8-f2772fabe316", "sighting_of_ref": "indicator--cb91b929-c531-4b10-9f70-346b8d6ad81b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b33831b5-d0ac-4635-aee9-7662506b6150", "sighting_of_ref": "indicator--cb91b929-c531-4b10-9f70-346b8d6ad81b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e3315e4-8181-4562-a76c-3bcd3eee13cb", "sighting_of_ref": "indicator--3c3def59-885b-451c-970b-33958380fa1b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07ced39f-0628-40a8-a76d-06225538dcf2", "sighting_of_ref": "indicator--ed088326-5d0a-4108-9bc8-0c10c5ba08d9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2efd2486-ec34-40c4-acf2-a1e8fa760b49", "sighting_of_ref": "indicator--ed088326-5d0a-4108-9bc8-0c10c5ba08d9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef4274f1-96fa-4ff2-a31d-a7402a1d812a", "sighting_of_ref": "indicator--fd6085c1-7347-4f0f-ad9e-23d7f8ee83db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a7c9add-ea5c-4fdf-a2f1-edb46fc6ed99", "sighting_of_ref": "indicator--49066a80-05f9-44f2-b8f1-a210f3a51bcf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fba0fb5-9c9a-47db-86ad-a1f759df8b85", "sighting_of_ref": "indicator--7a77a881-de6a-4c5b-b3e0-a0b1b1c21f84", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74389709-e9a5-48cf-93f1-71682c471af7", "sighting_of_ref": "indicator--73f35d12-92d9-4a27-8072-f30f3d594741", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b7cfdda-282f-43f9-8ab6-04aa286e70b8", "sighting_of_ref": "indicator--f8c29d14-5b7a-4334-8884-4115d369cd87", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42ef3b87-e33a-455c-99e8-df5f56087412", "sighting_of_ref": "indicator--7b4027c0-a41d-4438-866d-9a601d0e06e9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5991338-a3e6-47db-b16c-e96bdd87e834", "sighting_of_ref": "indicator--bf3921cf-7122-46c2-a6a5-8a01343f9b2b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d66cdb4b-79e9-482a-97df-888773c28281", "sighting_of_ref": "indicator--1b35cfef-8bbc-4b35-b3a0-49e0ca9abb93", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f749c93-aa1f-46ae-8be9-574ef54e0239", "sighting_of_ref": "indicator--3003e2da-d3f0-4652-a4a2-a1e166995ffd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--006f8fd5-f908-4ad9-858d-d773538a6736", "sighting_of_ref": "indicator--09a34cdd-3ac3-44bb-99be-957342d9f402", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68791bae-8561-4950-b8ad-154292bec87d", "sighting_of_ref": "indicator--1717d4f0-d2d1-42c7-8ca3-e0fae59eabd5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--654cbc46-77f2-4fe3-b9ec-c9e8053bdaec", "sighting_of_ref": "indicator--28c1b7e8-a701-47aa-ac05-f0cce2db66b0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--877e56cd-5a5e-49cb-bf22-dbc0ba17806b", "sighting_of_ref": "indicator--a17fbd71-fb8b-4cad-8a18-8d45fb50d5c8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--944f1c9a-6f3e-49a1-a367-f9fe2d49183f", "sighting_of_ref": "indicator--69a7966d-c80a-4fd1-9df8-65ac2c262733", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00e93840-f9c7-416e-a81e-79c5822cd859", "sighting_of_ref": "indicator--530a8546-89e0-4487-919c-aa21a4772237", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc253662-f004-41fb-a4cb-6bf6799897ce", "sighting_of_ref": "indicator--530a8546-89e0-4487-919c-aa21a4772237", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcc1599d-69b7-4740-9528-ffebe4f11a2d", "sighting_of_ref": "indicator--530a8546-89e0-4487-919c-aa21a4772237", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e80cdcad-69c7-459d-8015-fe493dc2d3ec", "sighting_of_ref": "indicator--530a8546-89e0-4487-919c-aa21a4772237", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd208db1-c8ae-4edd-9c47-4260cbe193c5", "sighting_of_ref": "indicator--b41267e7-b20b-42f0-8073-640a1489ce99", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8586f208-3f97-4f6a-ba9f-deb2a2133523", "sighting_of_ref": "indicator--b41267e7-b20b-42f0-8073-640a1489ce99", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c57ede8-4878-4cf9-985e-1856101b0c2d", "sighting_of_ref": "indicator--b41267e7-b20b-42f0-8073-640a1489ce99", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d22aafc-8b1d-4815-a6ad-c787250d3889", "sighting_of_ref": "indicator--b41267e7-b20b-42f0-8073-640a1489ce99", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6d66b97-87ce-41ab-9c36-4a3c297a1ef0", "sighting_of_ref": "indicator--6634972a-9f3d-42f9-912a-5a6945553fc8", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2fbd901-172d-48e9-9ac3-925b1d2d85a9", "sighting_of_ref": "indicator--6634972a-9f3d-42f9-912a-5a6945553fc8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e1f7e59-282b-40b2-acfa-37a622895c17", "sighting_of_ref": "indicator--d6eb750e-6586-4577-aba2-932a6b7461fd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47c8ae90-0d2b-4b48-9c5a-b9d52ee85084", "sighting_of_ref": "indicator--bbd0d6c5-6b55-42a0-9b1f-753a97b39e3a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5237dbbc-b6de-46a5-851a-439ec627c412", "sighting_of_ref": "indicator--4d1651df-4f9b-401a-86ea-f0664f3e2fb4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4b072f8-e224-4aeb-9c33-89c155bd7470", "sighting_of_ref": "indicator--8e885aa1-8989-4136-b23f-8007e454edde", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f413e28f-7cb0-4106-afc5-bc40d3109e2c", "sighting_of_ref": "indicator--d7b9932f-5e13-4f28-8f73-4f12d94ac982", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b5c4098-f597-40be-9399-0cef105f672f", "sighting_of_ref": "indicator--bb9f6723-d543-4a52-a648-a028b8bfde12", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a461e50-7857-428c-8ffb-e4a18a8a96d1", "sighting_of_ref": "indicator--8c839e8a-19b7-4b44-b593-a1285577b9d3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e964c475-b267-44c9-8328-1222ebd59ec7", "sighting_of_ref": "indicator--9f090360-83ef-4358-bbbb-46265d4e4501", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9652d811-0147-4a59-93c6-9d9f1fe4b4f1", "sighting_of_ref": "indicator--2d885956-ec76-446b-be1a-42ab87c01093", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--677bb23d-f08f-424f-85c1-93ff6d9f01d5", "sighting_of_ref": "indicator--58803999-96ca-4112-8fe4-373fa7685801", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a491c2e-10ea-40b4-86a2-efed6818d9fa", "sighting_of_ref": "indicator--8a7f62bb-3abb-4802-a88e-f15583406f46", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9f4db53-6ccb-4512-9185-7dcf543f3dc1", "sighting_of_ref": "indicator--c59c2988-c7c6-4090-af36-40d520e738d2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f88740bd-0fd4-4920-9d19-61c32992cf11", "sighting_of_ref": "indicator--4b35d821-a4cb-4f2d-a039-89edf78feb97", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e6a6f6f-e04e-4909-9380-3803fa029f66", "sighting_of_ref": "indicator--42e4907d-cf4a-45da-9a6f-4d191fc27495", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93d448c8-23aa-4f8e-be34-2ad2cd6f42aa", "sighting_of_ref": "indicator--42e4907d-cf4a-45da-9a6f-4d191fc27495", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ceb20f5a-ffab-4578-bf95-372643b7cf0f", "sighting_of_ref": "indicator--64d421ec-61bd-4a3b-b0c6-5cdee5253854", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10341f18-3f81-4403-92ea-78601363e0c7", "sighting_of_ref": "indicator--7815b7a0-7a31-4422-8c1d-d6d14fb998b2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9381e952-cde9-4f56-b33d-c78d7dda6a6b", "sighting_of_ref": "indicator--6ee2cdfb-87e2-4fc9-b5d3-d278b7f21e2c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2492ff55-2e22-4b4f-a381-a0b7c5a0af1d", "sighting_of_ref": "indicator--50382aed-bfcb-4405-a498-df990e3eb8f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc619364-6c13-4b87-bb2d-ee6039086742", "sighting_of_ref": "indicator--9e653fd6-3fa6-48f1-91c2-af1b25ba99f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e64fda4e-b460-441b-9b8a-0522feec295a", "sighting_of_ref": "indicator--1dbd1c74-22d2-4034-8a17-b648b9caccce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b34133f8-8769-4233-91f7-54a55ccd1a98", "sighting_of_ref": "indicator--6169a359-ffaa-4f37-8eb5-128d76285482", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--606e3c53-363a-4ee0-acd0-db38c27768f9", "sighting_of_ref": "indicator--fccab28c-40c8-4e0b-bbf6-bf984339a654", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2a66efe-03ba-4abe-b98d-e1bb79aca873", "sighting_of_ref": "indicator--fccab28c-40c8-4e0b-bbf6-bf984339a654", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5056cc89-8e90-4eab-bdf2-b6258c580ae7", "sighting_of_ref": "indicator--6a6fc8c8-3ad9-47ff-8935-f8c96da01cb4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c65cc41-dfea-488f-ab26-cf69ed9cee7c", "sighting_of_ref": "indicator--5526b438-1203-4c28-8d14-e02869bfa22e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c347194-04f8-4a15-8bcc-32a123c5f018", "sighting_of_ref": "indicator--194d7609-531e-49f2-b52b-6ff4f7cba0e0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--805823a3-161b-403c-b2fc-6ba52b7d09f2", "sighting_of_ref": "indicator--9fc34594-fb27-4bf9-b7f7-3d8164a4dd67", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09550436-9bef-4e0b-a40a-4899444af5e8", "sighting_of_ref": "indicator--649caaf8-229e-49bc-8d96-bc9dd9aa1f9d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce5b4ff5-1337-42de-8776-68339a4d32ef", "sighting_of_ref": "indicator--52954e1e-dd6b-4540-be91-48fc787ddd53", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42a04ee1-efdb-44c7-b23d-d651d4e2938d", "sighting_of_ref": "indicator--16156ff5-1edc-4bc1-b38c-192bc6e35c9b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6527fabf-9774-4666-ba96-b530e91f9dda", "sighting_of_ref": "indicator--5c0feb9b-9ba1-4ff9-910e-1e06db7a17f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e105e7f3-8836-4686-aebe-a57492b1a89c", "sighting_of_ref": "indicator--04314639-4c6c-449c-92da-5b75920636f1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea667687-065a-4672-8608-ebcec671d2f1", "sighting_of_ref": "indicator--16241e80-ba72-4d1f-83c1-ba4ffc601300", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49f29a55-feb7-496e-a274-276964571ac2", "sighting_of_ref": "indicator--6c25d0b5-c252-4334-a554-6fe9d8ebf249", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db2b2b83-956d-47c6-928a-248b5ae51395", "sighting_of_ref": "indicator--29ae4523-bab1-4934-bb71-86946814d9bf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55d7b89e-05eb-4d22-9e81-cbc8aa895803", "sighting_of_ref": "indicator--b0637e3b-d3c0-4da0-bad1-0e2580ff3d06", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8417418-d3e5-48b6-a432-d5cfa6f2a346", "sighting_of_ref": "indicator--6eae53a3-9dec-4d5f-8906-9730841127cc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e37ab75c-d289-4d4f-a3a8-bf62af5892a6", "sighting_of_ref": "indicator--19f08784-6081-4f91-a2ef-e451486854f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08e0a29c-dff6-4002-ad8c-45b63049e86b", "sighting_of_ref": "indicator--36f5a9d0-292b-424b-87b3-18cff768b5e3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfe3ed08-db70-4402-a504-9f9fd8ae7458", "sighting_of_ref": "indicator--02ef1f27-eaab-44e9-9006-ec9fd0ad2da0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8ed19cf-2dfc-424a-9003-859d64623ad3", "sighting_of_ref": "indicator--fc136dcc-43ea-45ac-8b0e-88719fead798", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dd1bd61-9ea7-47f3-8ac3-d520e1bdbc25", "sighting_of_ref": "indicator--b07678f7-07c7-4397-aab7-9d47980afe56", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16e1242a-f37a-4ec2-a4b8-e27f5580311f", "sighting_of_ref": "indicator--8361da3e-c12f-466e-ad38-1f22eb76c33e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28275d26-1b5e-4907-9d3a-f4f961f864b4", "sighting_of_ref": "indicator--c9879f4c-bc0f-4e01-be25-1c1ac4ff454e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88791e7b-97d6-4450-80d7-ac2b9f9bb9a2", "sighting_of_ref": "indicator--c9879f4c-bc0f-4e01-be25-1c1ac4ff454e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f4d14c6-16fb-4ffb-b550-f8552996567a", "sighting_of_ref": "indicator--b356daf7-6d6d-4fed-856a-33a7b0e51452", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf9ebd82-1785-46c7-a045-901c74a92dd3", "sighting_of_ref": "indicator--7785735a-2f42-4b86-b022-a34bf577bda3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaa360af-062d-46d5-afbe-fbad7dcc60bf", "sighting_of_ref": "indicator--53d4579f-cd77-4fcd-9862-744dcd525568", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81b1993e-b171-4bd3-a6b9-84e48c9b0c85", "sighting_of_ref": "indicator--7721366a-be24-4db3-9f7f-516f20762316", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a956e836-3364-4861-b58b-8be52fb617cd", "sighting_of_ref": "indicator--9138cfed-dd05-46b3-b33b-78082c97b0e4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e3c07f8-2805-4d15-a088-1e8d50f29cf6", "sighting_of_ref": "indicator--9e8ced3b-91de-4587-a8e6-8b980660c52d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e891268-7b2f-43b3-9d00-fee35065a6b6", "sighting_of_ref": "indicator--66924d8a-f2ef-430f-987d-a2e4a5cab255", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2669fd9f-6959-4be8-9273-68605ccc86a1", "sighting_of_ref": "indicator--98149bfb-df5e-4fa8-be31-61718a6eb868", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53f53311-3f37-4663-bd02-62a541ff6e6c", "sighting_of_ref": "indicator--b0174b64-5bc5-4ca1-a440-ae23078ae82d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17b82474-1350-4da0-b884-e3955a22fb5e", "sighting_of_ref": "indicator--d65b2908-9705-4d7e-9265-13f6c4204467", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1017dbcc-919d-49e5-9dc1-8d6b39687319", "sighting_of_ref": "indicator--b0078718-254f-4121-ad10-efd0f93817a6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a79c4317-aa79-4660-bc38-7b04b18a2359", "sighting_of_ref": "indicator--9ed06e4b-086b-4989-919a-1eba3ee6aea0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9645f896-ef05-4b74-a0bb-22a3c4987df0", "sighting_of_ref": "indicator--3dda6d0c-80ba-4da1-a632-50bc660ee1f0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42cc9389-e14d-4975-807d-1fa3c7f6b08d", "sighting_of_ref": "indicator--9cb14b78-5704-400e-8964-4a76c2ee60d3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff0101ce-3325-41af-8bf9-268233e44bbc", "sighting_of_ref": "indicator--bb09a430-6f59-430c-89d6-b71d4739e1d0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28292f7e-fcd6-4558-a047-4d6af8906844", "sighting_of_ref": "indicator--df5512f1-af73-4aef-bc89-c817e7abca1f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adb6dd99-217d-422d-a033-339b286806f1", "sighting_of_ref": "indicator--9a3b40b0-83b9-4b12-9569-2129bad25949", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ae4e224-010f-4c7d-b289-d63187d33803", "sighting_of_ref": "indicator--d2ca8b25-6ba9-4972-ac6c-d44301938a4a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5eefc9e0-2884-43fa-a99f-fa2421a7b44b", "sighting_of_ref": "indicator--3ba3cb84-efa6-4ee2-be85-9b13e019989e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--029b8686-f8e6-4860-988e-8d69d269a4a3", "sighting_of_ref": "indicator--dc0389c7-5ab0-4107-a0aa-46347918a457", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d38e895d-5ece-4b5e-a234-64789edac0c7", "sighting_of_ref": "indicator--cb9d4616-db12-416b-80e2-19741208a4b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d088caa0-2cb7-4347-a30f-17b019a1aab5", "sighting_of_ref": "indicator--a4ed3052-df9c-416d-a9a8-2d5c416dc528", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a657a28e-52d6-4bdd-a78d-b27b38013359", "sighting_of_ref": "indicator--82f0a07f-ded3-4ae4-9e5a-f3d23b3f9cdc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8300f2cc-db89-4c6a-be56-d1ac87c1a242", "sighting_of_ref": "indicator--1c408e8b-c4f9-4720-b1ce-a2f562663d91", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17105109-701f-4ef7-b4e4-2447ac47c483", "sighting_of_ref": "indicator--e320b6a1-945a-45da-9d94-eb93f0c13f3b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f040109-611c-4c93-a567-4b5684bbadd3", "sighting_of_ref": "indicator--19d50f22-76d2-40fa-b1ac-a80633852e1b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ff8636b-b388-4222-82c9-5bd20837e55c", "sighting_of_ref": "indicator--0220f869-d040-4004-8865-95729487720b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b35fa6e4-1c91-44c5-81e2-c3356a4e645d", "sighting_of_ref": "indicator--0e55235f-9f1e-4cce-9665-9f2ecf69cb69", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a4e4acb-cdbe-4742-bf1e-e3cda7385d79", "sighting_of_ref": "indicator--6247aac2-6837-4cd5-947f-b1d520c00653", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f6e9c8b-8aed-4233-8ad0-409f8ba807ed", "sighting_of_ref": "indicator--b8a5335e-43d1-490d-aea2-7bf4905e00d9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f29a3075-825c-436a-b592-ba7a5ef15ec3", "sighting_of_ref": "indicator--9d668275-90ff-4a27-9a9b-c945180c317f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1ad9f72-15d5-43d3-a0d3-24245e09a3e9", "sighting_of_ref": "indicator--3a6b351e-64f1-4e53-b7f1-95d5befca13f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19059017-7ca2-40aa-b092-5eccf771009e", "sighting_of_ref": "indicator--2ca76af7-2ceb-4e4b-b572-c9d47f1b2749", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5394b9be-9db3-41a9-b41f-8a617e73f576", "sighting_of_ref": "indicator--2cbac689-3718-4fbb-84b0-9d941ae07d23", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2180d28e-4132-4c28-aaab-11dc6ce11e22", "sighting_of_ref": "indicator--e0221fa4-40e8-42a1-9cb5-01e6fa01afa1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8c0f9d3-e381-4842-935e-913aaff1d556", "sighting_of_ref": "indicator--a81a280f-d90e-4f54-a5a5-9a035f8a750f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e5722e9-77b5-4015-bd94-0d5ae9f613fd", "sighting_of_ref": "indicator--b9a3e188-b2fc-4510-8e25-d877484d706f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ab846e4-9204-4dc8-b091-29ded78d4956", "sighting_of_ref": "indicator--6f067d73-297a-496a-b29e-286277f651ef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--277780c8-7575-4d9f-93e9-b595394f7c22", "sighting_of_ref": "indicator--6e67defd-2c2b-4fe8-83fb-cf35267be965", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03ffcd85-83f6-4b18-8998-2a8c69527a2e", "sighting_of_ref": "indicator--d16e78db-c341-4fa5-a0d4-a4d8257e0289", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6784964-db0d-45fe-a3a0-d7e2b76a8f67", "sighting_of_ref": "indicator--fd47284e-511c-4331-b23f-33f1af4d27ef", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2d09b42-2ca5-4a24-965c-5be0c99603c3", "sighting_of_ref": "indicator--0799dee6-5a4d-4099-be5c-7667e9302f4f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3092eb58-40be-41b7-b921-1323b7b7dd3e", "sighting_of_ref": "indicator--e464a48f-de67-444d-9d45-90b2e575f442", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dd7a29c-bc66-48b0-b026-4cb9a3d92cd3", "sighting_of_ref": "indicator--089534a9-7186-4920-942e-18b6543cacfc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57c97c46-b8da-4af6-91cf-e05f2586eb7d", "sighting_of_ref": "indicator--001a0600-d350-418c-8cbc-9889137b531a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53d27165-ca77-4e2a-af48-372fb29c0215", "sighting_of_ref": "indicator--4962d999-634b-4689-a70d-d54ece65e675", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--266c5c4c-dd80-4ecb-b8b3-70bc2983bbc0", "sighting_of_ref": "indicator--3e9010cc-7594-4ac6-a5c7-95f384dca649", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--184dea58-a459-4d3e-85b4-dd21aef94334", "sighting_of_ref": "indicator--bf4c4e54-da46-43f1-a3ff-b868385fc11a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfde0c4a-e320-4aa7-945d-1d7380b26116", "sighting_of_ref": "indicator--878d0163-198c-44c6-8fa3-3c0dca65a62f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25bd8038-0174-45c6-98d5-15dec856f9e2", "sighting_of_ref": "indicator--c0e6ccc1-fad1-4008-8118-82a9000c2dd4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53636870-d4d9-44cb-a7ca-dd22dd467548", "sighting_of_ref": "indicator--bcd8e884-c16c-4772-b47a-04e77529521e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e46da1a2-9122-4f37-a087-ca1a183f5bab", "sighting_of_ref": "indicator--826220f0-6efa-4d2d-b6b6-4399702cc2e3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96c09851-1a36-41f6-994f-a18d42e3f0ba", "sighting_of_ref": "indicator--ff2beb85-0b02-48ab-a951-0112d8899464", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7962f6a8-7783-48d8-be6d-bfe00f99a144", "sighting_of_ref": "indicator--3bc631c6-df5e-4473-874e-7d67aa54917a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b7e8e2f-6813-4402-93d7-3a4cd0a6830d", "sighting_of_ref": "indicator--43183d08-0532-4c32-a4a2-dc4b8e76f762", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da080de0-6270-4fbf-a0e6-e710b69187fe", "sighting_of_ref": "indicator--e2500260-3ecc-4da6-9724-2c1d7c67113d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8711869a-ce02-408d-94bd-f29d54e936bb", "sighting_of_ref": "indicator--837bfadb-ec61-4024-ba14-d9678af89ff4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4f65588-a8fe-4d4e-978f-79e4dd9500e9", "sighting_of_ref": "indicator--ba236dd0-94cd-43a0-96fe-6e80e5208a69", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a7f7ae3-85e7-4f81-a0db-2a6c1de2cc91", "sighting_of_ref": "indicator--2505a59d-a665-4f4a-9b41-7a1c1803ed7b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93cad0fe-0ef4-45d4-90c4-a014dcce7ef7", "sighting_of_ref": "indicator--2c72e353-3cd6-4720-9787-a81de89a1b2b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e251395e-b71f-460c-a923-84495a5fe19c", "sighting_of_ref": "indicator--435d5fb7-20df-43e5-8e71-5a840ca2479d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fe95492-c93b-4358-b72e-e9d2a9a9c190", "sighting_of_ref": "indicator--62723ba4-4a2b-4eb4-b482-4873dc696e59", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0fae95b-0a5d-4603-b29e-a8ced2f43851", "sighting_of_ref": "indicator--1b36eceb-5b92-4a17-a362-b920b74b0a9a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79281a99-d77c-4f54-baa8-e7bd10e037b7", "sighting_of_ref": "indicator--250ff145-a1f9-4472-a1a7-cab08d751913", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2d28c9e-2be0-4cb9-bec1-97a5bf0a0e0d", "sighting_of_ref": "indicator--4a19f241-7a45-4a33-8d08-1a8c37d614a6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e5aae92-7b53-4652-ab05-9fc3914779cc", "sighting_of_ref": "indicator--632dc166-31bf-4304-be68-c0e4dd1c7381", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8985d663-798a-443f-a899-90dec8bd8373", "sighting_of_ref": "indicator--0a873f71-aaf1-4b51-abf3-f01ac9c83573", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c547d42d-ef36-4829-97e2-cbceb82efeca", "sighting_of_ref": "indicator--a7aa4941-f309-41a1-8eb2-37676a05e006", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4e3f902-bf94-40c0-ac09-2cdee2fb3675", "sighting_of_ref": "indicator--03540fb9-51b3-462c-ad2c-2bb0eac22d54", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e47de698-22a0-4907-a3ab-b32a23d750c1", "sighting_of_ref": "indicator--a09a674e-d833-44c7-8a50-4046636369d3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32b348be-ba0a-46fc-8f11-8934c2315ed6", "sighting_of_ref": "indicator--98a4cd90-48cc-4394-9047-7595c0320b13", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a84f003-3e69-4fa7-a54d-de516ef0b628", "sighting_of_ref": "indicator--ff217521-7eac-42ef-b0b5-a509b7b7ab06", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0e13936-4bc8-4397-97eb-557aa7c1f08c", "sighting_of_ref": "indicator--6dc83b53-91ee-40e4-82b8-3e879b3fc347", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--250a0179-105c-40da-bd80-7a931f0ad534", "sighting_of_ref": "indicator--baea6e41-35f4-4216-a966-8cff685208b7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e5fc2a2-df96-452b-9c03-84a82d240aa2", "sighting_of_ref": "indicator--800883f1-d07e-4079-97cb-d58b69e3974c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fec96dc-1be3-4d68-af47-eaf1ee45125d", "sighting_of_ref": "indicator--8a7101de-2b0c-4358-b730-647b6489b5a0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6c2987d-ff5a-49d1-a336-ff98f7656228", "sighting_of_ref": "indicator--3d962f4f-1321-40ba-a179-6191940b9220", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d409d6f-9ca3-46c4-ae11-2732d7b5a59d", "sighting_of_ref": "indicator--2ed375a8-84c9-49ab-badd-bdabc130fb4f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf82ad9b-e0fc-498d-8c92-09d371e43028", "sighting_of_ref": "indicator--236abc1b-3eba-4a69-8ebb-bfe5551d2fb9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7b99b5f-91a4-4154-9cbf-e1a791670827", "sighting_of_ref": "indicator--f8adacfb-96a2-448a-8c0a-0aa46912336c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2078fb27-002e-4a62-a357-4615691d47f1", "sighting_of_ref": "indicator--f584bf43-7675-4030-8a83-9b80588c7d95", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5142bee-4c8b-4db9-97ac-a269a7f2f288", "sighting_of_ref": "indicator--baf24374-89b1-4af9-a597-170ca3b691b3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d91889f-2a7f-43dd-baee-2a16eb3a25b4", "sighting_of_ref": "indicator--423a5872-a0f3-41a2-8461-bb10db1bd8ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87df8aea-296a-47fc-8cb6-245c823b8932", "sighting_of_ref": "indicator--208b85d0-7d7e-4dbe-8c5d-38feb5aa8f4e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43044001-a25e-489a-93cc-ed7f0117dbdd", "sighting_of_ref": "indicator--4db60ab5-5498-41ab-a325-162455b7306c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d207883-432b-4589-818e-149892e69014", "sighting_of_ref": "indicator--b026b489-4d13-4ef2-b164-160abca61d95", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdada231-4b85-4f69-9361-a3be8f02cc45", "sighting_of_ref": "indicator--a0180954-5c10-4567-9eff-19d8fc600414", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75b63cce-2170-4d4c-9e14-14affa5a8c72", "sighting_of_ref": "indicator--8e2c5ceb-f3d6-4668-8e1b-742a2e976fd6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--981c1c64-1f48-47d3-9a54-de7d3373bacf", "sighting_of_ref": "indicator--11356d1c-eee9-44bb-abcc-fbc1714747ec", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d9069ba-d605-4831-a244-ac59aaf1e49b", "sighting_of_ref": "indicator--4314b1ca-14d4-4ef2-bb6a-42c0c75f0e35", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ee457f0-ee63-47b6-b4c2-430cccbf92f5", "sighting_of_ref": "indicator--0f6c2577-751d-401e-a5bc-d22626fda71b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcd18dd5-1503-45a2-a4e3-d7313c706048", "sighting_of_ref": "indicator--8de4114e-a7ab-472c-b795-6a45576b4b9d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c94fe5e-de9e-4ee4-b5ae-5ae20fa18c9a", "sighting_of_ref": "indicator--1b048f54-5c12-40f1-a562-c84a2a5f165b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73262566-d6b6-4d6e-9e74-7485bfd9fd80", "sighting_of_ref": "indicator--fad7f077-7e11-496a-8853-dd4c24625057", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c73321af-1cb4-4a9e-9dba-d91b5da9cd34", "sighting_of_ref": "indicator--fad7f077-7e11-496a-8853-dd4c24625057", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1fd971b-8803-4d7e-bd34-5b7d80d67225", "sighting_of_ref": "indicator--765e20e7-4bf0-4cc2-8d4a-ee0508eab727", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfc5af71-ce62-4f1e-bfde-252a23bd6f7a", "sighting_of_ref": "indicator--006f460f-480e-448f-8405-68a4df698ab9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38de07a7-5eac-40ac-8ab4-bb4862613955", "sighting_of_ref": "indicator--9bdd7dd4-7eeb-47a5-baf1-6958257ff453", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b439231a-27f2-4a77-8581-b14c9ad6a18b", "sighting_of_ref": "indicator--9bdd7dd4-7eeb-47a5-baf1-6958257ff453", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c01d1bc8-e158-48f6-a15d-749d8e67c365", "sighting_of_ref": "indicator--f154b225-00e3-4bfe-bc8a-1e911cfe65db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c640ebd-8427-44bf-9014-3bc61d8b9fe5", "sighting_of_ref": "indicator--b50364bf-7356-4b20-b13f-2236259969ac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd63298b-0c0a-435e-a117-077ba375db5a", "sighting_of_ref": "indicator--1c3810ee-7ed1-4001-9f1a-7d08d4ef9825", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a36c4629-a72b-4468-8b30-66218a1d7adf", "sighting_of_ref": "indicator--4a292051-b522-4776-8680-2c19d6bc77df", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc07244b-de3e-4261-b575-a906cd47a8ce", "sighting_of_ref": "indicator--aa610a68-eaf0-411e-8b19-0cbac4fb561a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0221f66b-27bc-4ce7-8c73-56088c62eb54", "sighting_of_ref": "indicator--0a9d81b6-a789-470d-bd0d-5a1aaf7c214f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f222070-2fbc-43c5-b389-266d983c0068", "sighting_of_ref": "indicator--8a7fd27e-c377-455f-9070-80cba7c8a6d2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e441dd57-5a53-40f3-a158-0821344a319e", "sighting_of_ref": "indicator--c01d316f-ad5c-45c1-80fa-a18f970981f6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57dc4e2b-df98-4a3e-8674-9956408fb9c7", "sighting_of_ref": "indicator--60308285-6047-474a-959a-c8cde8a11a2a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b5e8544-0cd4-40c4-987f-ddc118805c86", "sighting_of_ref": "indicator--04ca06c7-9299-4792-8f14-600fde1fc446", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8cfd07f-1157-4715-adbb-2b3458e81f8e", "sighting_of_ref": "indicator--b8f783e1-10a6-4386-aca0-7e60bdd96047", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56c876bc-fd46-44f6-b0dc-f0e6203335fd", "sighting_of_ref": "indicator--ac68c646-3c02-468f-82ca-51a49ea6903b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--542a68fe-6a6a-4b74-b72f-3b22a8a25188", "sighting_of_ref": "indicator--d6e5f059-b762-4f3f-92ee-5f2ad42286e9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa70d1e8-67a8-4c55-97f3-f067bcefdf21", "sighting_of_ref": "indicator--6d63970d-d306-4e64-b890-7cd343c6c858", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd263bf0-facb-4da3-b956-bffd6c6f3814", "sighting_of_ref": "indicator--753b8fe9-93a9-493e-9b3d-017479a70fd3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26c5a343-13cf-43c8-96ec-1b73e103ff0f", "sighting_of_ref": "indicator--31143179-d94d-4524-bc5c-fd3eeb616976", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd54465d-abc2-4325-bfbc-61da9950baf0", "sighting_of_ref": "indicator--20e447a9-d5a7-4b1c-833e-e962b9a6b61a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cae14eb5-a67b-4148-87c2-fbeb87642f19", "sighting_of_ref": "indicator--057a4d96-1cba-4ef4-a79c-69661856938a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2757e90d-4b3f-4a71-a631-08469c721666", "sighting_of_ref": "indicator--9ef7b864-37a5-47ee-9d5b-23577a7b3594", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee5abc33-baea-4749-b2dc-f2bd4f20dbda", "sighting_of_ref": "indicator--86f593df-c500-432b-8384-58c814b0613d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--762a1b61-0f63-487e-8606-f1a0a200c50a", "sighting_of_ref": "indicator--fe38fe8c-b975-47f5-a35e-c2176e357e0f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc99d608-9b5b-4e4c-a17f-c82bc0b69ff9", "sighting_of_ref": "indicator--d64f1b29-f2c3-4718-918d-a4e56a73483b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1273bce-c61b-4686-8bab-b9c1f549f5ce", "sighting_of_ref": "indicator--1ecea2eb-f2cf-4bf9-83b9-5ec6de983811", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c7c1dc2-8951-43c2-b524-f14eca8b26b0", "sighting_of_ref": "indicator--eddba688-6687-4ec6-921f-69b3454d1c80", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f1a54f0-423f-4834-9034-b27c9c4f633d", "sighting_of_ref": "indicator--eddba688-6687-4ec6-921f-69b3454d1c80", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3d37c3a-6444-47f1-ac07-49cb9cfde164", "sighting_of_ref": "indicator--84196a46-d0bc-45d5-9d8b-63b9be680d0d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f93d086f-9d51-4958-921e-e5010577a559", "sighting_of_ref": "indicator--e7772acd-436d-4359-9ccf-6139977f82cd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a9a94bd-a89d-48d4-b709-8937800445be", "sighting_of_ref": "indicator--88db2b6d-fb64-46b8-9cdd-fa8a44aca685", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a7e6ef6-ceeb-409d-b5d6-769bf6a90119", "sighting_of_ref": "indicator--0398fd95-4675-4d2a-8829-90177d555d1c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7840d8f4-a376-4408-82fd-51ad658de250", "sighting_of_ref": "indicator--2a33a184-6053-470e-80bc-8de722c35ad8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cfcd2c3-50fd-4f74-b831-167ab46b1946", "sighting_of_ref": "indicator--d717b00d-b957-42e3-a7b4-34712d20cf23", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18667ded-ad3e-4b67-bcd3-b73ff6b17867", "sighting_of_ref": "indicator--ad6a642e-503c-452e-9ff7-183418a040e5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dd40144-20a9-40f6-ab94-2c8cd703e837", "sighting_of_ref": "indicator--4d30f9cb-b27a-4083-83e6-f21b32e7175d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5b9300e-0d02-409f-8f6b-02fbf4c8f028", "sighting_of_ref": "indicator--a19c1ac0-2aab-4746-8cd9-3eb3c9e87c4c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc626f9b-2d37-49d5-8ee7-e67858aa796a", "sighting_of_ref": "indicator--b3bc8ded-6402-44e4-8888-e621084e7956", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cedefd2-a76c-438d-861e-1af205ffeabb", "sighting_of_ref": "indicator--fd145028-2a3c-4d6e-87aa-31bdd4e50ef4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09a26e27-f9a0-49f3-9fcb-132e0a95bc8e", "sighting_of_ref": "indicator--4978fb7e-2aac-4d14-9abd-cee83f7580cb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1125d106-6a82-43e8-9850-17a9020702e6", "sighting_of_ref": "indicator--c9601a45-e68a-4070-9b24-3fbd41ba18a9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fded169-64dd-47b1-a1f7-7121368e5452", "sighting_of_ref": "indicator--f86bb5ea-e4e8-490e-879b-43b67c14c9d4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e56343e-e105-4b86-87e9-8a3d2a17942e", "sighting_of_ref": "indicator--c6358a07-ad5b-4f01-b2e2-a207b4b7110f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6806712-6c77-4739-9fd4-8956882dff60", "sighting_of_ref": "indicator--63975653-3d94-4943-b481-3404527876c7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c562b483-3dd1-4ba5-9946-1b1baa53eda0", "sighting_of_ref": "indicator--b37e1734-4ef2-4998-9e03-ef92cd9eb893", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbc2b75b-05cf-4675-9d53-7a45a70bebdd", "sighting_of_ref": "indicator--6541b164-6c85-48cc-9e5b-3dd478c4b53f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--330a0fbf-741d-4695-8d34-9f28569d2482", "sighting_of_ref": "indicator--f6ccef8e-56a2-4407-97f6-36f92300d6c7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b56cce4d-4252-439b-b386-1bef0e600d09", "sighting_of_ref": "indicator--7130c1d2-9046-48b6-a396-77339433d5ed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31f2634e-db7b-48b7-b1b7-459021ab5947", "sighting_of_ref": "indicator--74640c41-fe37-45ef-976b-2f19eafca5c8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96e0d009-2be3-4ef0-89f5-3c46bbca1cf1", "sighting_of_ref": "indicator--ef1dc131-86bd-4502-9101-612a8d719814", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8414f7c5-576c-4ed2-b7ad-d47235d45828", "sighting_of_ref": "indicator--9732f318-8211-4f7f-9f39-c66751358a71", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53681cb4-2017-422f-9555-4e6bac5d8e59", "sighting_of_ref": "indicator--c2a51b42-3498-40ef-96fb-8b98880b4940", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e4c5d8c-2474-4945-b3b8-c68ac05f237e", "sighting_of_ref": "indicator--8a486a03-8319-46e5-bcae-503d37b43988", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d935b6f5-88fa-49b5-a3c7-3a68eb30c3ac", "sighting_of_ref": "indicator--4582cacc-44c8-4c05-9308-8afd35c8413c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc4af5ae-b389-4a11-b60a-457aa583c0c0", "sighting_of_ref": "indicator--e7bcd250-5691-46ba-92a6-d439610d335c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37bf0b04-712c-4eb5-991e-6d04825244bc", "sighting_of_ref": "indicator--bffd50cf-0000-4f6b-88fc-1a3b9ebfeae0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efafb13b-a56c-4796-8a6f-aaead02c47c3", "sighting_of_ref": "indicator--bffd50cf-0000-4f6b-88fc-1a3b9ebfeae0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f407cfa4-21aa-44ed-8729-47101be8f496", "sighting_of_ref": "indicator--53093e8d-72de-4a8c-9380-1c855d8c5b9b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--367b369f-76f4-463d-82c4-78f7b257c8c3", "sighting_of_ref": "indicator--aa48702c-3511-442c-90b6-72e1fa223a8e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd594033-c2e7-46b9-8c78-c842baf93553", "sighting_of_ref": "indicator--60561752-c60c-471d-bf47-e340e3250e99", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aa23494-731c-42e9-80f0-31877ff09bb1", "sighting_of_ref": "indicator--39ec3c37-0245-474c-b0b5-be2dd5dd67c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e37d5e9-e81b-447a-9101-f78dd2ffc180", "sighting_of_ref": "indicator--e743d668-7ece-4e49-b4e3-63e18a4d6e7c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b284e3b-27ae-42ef-b8d7-aab7af10d5bf", "sighting_of_ref": "indicator--553aad97-78b0-40f5-b32c-a3d4b7d3293a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf4bcb99-1a02-41de-a200-74cbdbec085c", "sighting_of_ref": "indicator--d1b118ae-e379-44b3-b38c-fb107f0468c0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ec60cef-337c-4ee8-8d61-95eee9ba4b4a", "sighting_of_ref": "indicator--411978bf-0b58-4b1b-b985-a0f72f237c7b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ad52f78-94cb-46aa-9f49-53484efd7723", "sighting_of_ref": "indicator--01663c89-0b7c-40e0-b2fe-b0a24dd22a9f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62a03188-b6d1-4884-9c6b-7c26b661fa6a", "sighting_of_ref": "indicator--99b93db5-551a-4da2-b915-22b991acb06b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--286aeb18-c560-4b10-a950-4005c5a138dd", "sighting_of_ref": "indicator--f90e5d83-1739-4942-8ac3-2630e819cccf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5552b87-5d50-4c7e-adf0-ba8fd1be71b6", "sighting_of_ref": "indicator--97616876-3057-4916-9dfb-86e9d56e59e7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60485a9c-e246-4603-b0d3-82c28b11c21c", "sighting_of_ref": "indicator--97616876-3057-4916-9dfb-86e9d56e59e7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2252306-d3ab-40db-9b87-c98a12f6349a", "sighting_of_ref": "indicator--9e38ab3d-d9b0-4e4f-9dea-7551d8e88a19", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6a79a7b-1cad-4655-8be6-3676bd6d66df", "sighting_of_ref": "indicator--9486598b-b668-4c99-bdf5-d04dcdf9f333", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6fe31df-779f-4702-8b49-ff883106252e", "sighting_of_ref": "indicator--60b25f3e-ee0c-412b-9961-9bf0fb88d7ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0c43200-89d3-4c81-b0e5-4852aa55c8d2", "sighting_of_ref": "indicator--0557056f-1e34-4c74-9d20-d0661036d323", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b93aec42-b27f-40d5-8012-b619fd2884b9", "sighting_of_ref": "indicator--997bc6f8-cdf3-4a03-8eb6-9bd8a4cf36db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--892c9232-53d3-44b9-bf1d-0ca33bfd7c9a", "sighting_of_ref": "indicator--003817f9-8670-45af-91f6-05fab25b0033", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--358e491e-957e-47a5-8070-e1b0fcaf810e", "sighting_of_ref": "indicator--3120d41f-79e9-455f-9333-b92235165af6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd536df1-d54b-4e5e-9250-30c2b3022854", "sighting_of_ref": "indicator--b9155920-6f40-4f8e-9013-c6f678aa5733", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ba903a0-1d94-4eb4-88c6-32d65712c222", "sighting_of_ref": "indicator--e3bc42f1-a732-445d-a04d-e43c08c98663", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c54777d-1d83-418b-bcb9-b74f7a714a44", "sighting_of_ref": "indicator--f6a7240a-bbdf-4e17-bc13-600cf5b074c7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ac5c704-1bcb-481a-820f-92cf96e7ca6d", "sighting_of_ref": "indicator--388d331a-7bd4-4ff8-9f74-d696453cf2ab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cca7f1f2-a25b-4760-8f43-05a837b28e4c", "sighting_of_ref": "indicator--25b68d2b-5693-4028-b4a0-4a975aef598f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd7c8fd4-b7ff-47d2-98ff-2e49b351ee19", "sighting_of_ref": "indicator--76504ee8-f318-4c03-82b5-2d135a68e69c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddfced4a-5bf2-4e0b-86b9-420dd768e01d", "sighting_of_ref": "indicator--243b8b4b-ebb9-4e88-b3cf-7aa43e520745", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8de7f8f7-7c36-4349-a2f1-77fea69b8702", "sighting_of_ref": "indicator--dbb2da4b-03cc-4aaa-956a-fd7bc70701e8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c544892e-cfc6-4ca6-8341-6a5e92805dea", "sighting_of_ref": "indicator--fdddab67-6940-4163-b000-17094b29bba0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b710496-5b77-4923-ad98-69061584215f", "sighting_of_ref": "indicator--1d12ab7f-f52d-46e2-8f5a-bc3583601afd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6678cc32-bc93-45c8-9a6a-75b5f66e2d95", "sighting_of_ref": "indicator--cb3ac050-96aa-4ca4-8adb-ced5a0b95252", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a154fff1-33a4-47e3-9c4b-2e34c4692b5b", "sighting_of_ref": "indicator--7f69b0c5-d5b4-4c3c-ac51-8aabd0d52afb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--825c4efc-6d97-4ff2-baa5-24d4e00f0a8c", "sighting_of_ref": "indicator--1d8e6070-6d83-45de-892a-4ff9e7ec67b0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a60ee79a-f6d6-492d-8346-f5ce3b6a862e", "sighting_of_ref": "indicator--d4fa29c6-fdda-4d0e-8995-ce9a70e926d0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60b2448f-a728-4fd6-8cba-68a10463ec99", "sighting_of_ref": "indicator--16ab809c-821a-4848-97fb-58cd1c66fe53", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20f2a5c9-edc4-401e-8f3b-cff979fcda34", "sighting_of_ref": "indicator--3d6ad88d-b41d-49ef-b2c0-dc2b200bc115", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c60b3e82-efb0-4831-abbf-a55ed1382e2e", "sighting_of_ref": "indicator--ebb0ac10-37ec-4af8-a872-e6cf69531ced", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98cbccc6-a574-4fed-a62c-70583a55d012", "sighting_of_ref": "indicator--20efa05f-2a41-4e98-a6ff-644545e3acdc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcd6886b-9e80-488f-94a5-bbf771eb80a9", "sighting_of_ref": "indicator--a5a28376-ff4a-47cf-bde0-e32fc236ca3b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca67a2d0-ae3a-44e3-af66-c9f36de6075a", "sighting_of_ref": "indicator--24e44429-496f-4893-b4a5-d67ce37f3811", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b66476f6-9b31-4e33-a588-bbc4b20118e8", "sighting_of_ref": "indicator--97bb0c00-69cc-41ae-9baf-f0450c9c81c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eddc99b4-1130-44f9-8018-f9500770fcf5", "sighting_of_ref": "indicator--1029d1f5-762d-410e-94b8-058775d8a389", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2d17a12-7a24-48da-a7ba-0b2255627561", "sighting_of_ref": "indicator--5fa224fe-a451-4fb1-b6b8-447e12dc3a39", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--647efae1-045b-4a7b-b452-4d9add24a52a", "sighting_of_ref": "indicator--19181bbc-48b8-443c-b93e-51f11836a9fe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--024ca719-5c14-44a0-b16e-10c20f7798be", "sighting_of_ref": "indicator--19181bbc-48b8-443c-b93e-51f11836a9fe", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c979e71-03ef-4b0d-84b6-5282e5edbea2", "sighting_of_ref": "indicator--4c95858e-adba-4167-82c5-53dad7bb1806", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--415b9928-1934-4341-bd20-6230e15153f1", "sighting_of_ref": "indicator--0114cdfa-eeb4-4c5a-ae3f-0010a1c8a532", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75384905-fa01-4fe8-b546-dc9b3c890f29", "sighting_of_ref": "indicator--e5dc8af6-1704-48e2-97c9-04be93f25558", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99df8416-b718-42b1-9d2c-e97d693e1ee9", "sighting_of_ref": "indicator--23db741b-c582-46de-ae45-6935de1698e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b624d44-e9b4-4149-8289-abe719ceeb8b", "sighting_of_ref": "indicator--4d16d30a-767e-4a6a-a152-805e324b3725", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07704df0-e865-4b9c-add0-790efb5c5744", "sighting_of_ref": "indicator--5b1d82e3-bf34-48c7-b1d9-9525e021264e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f8339a4-7a78-48b6-9658-67b80770d03a", "sighting_of_ref": "indicator--09d103d5-cb76-48b2-99e2-04f8e0c9cc2c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--064b8dff-02d9-4c0c-8830-7bd1e5398221", "sighting_of_ref": "indicator--c9681cf3-3b4d-42e4-b1d3-284c1848cd69", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95102aba-fbcc-47dc-94d6-eba67b7eed9f", "sighting_of_ref": "indicator--4ef50069-2ff8-48ea-8b77-9899b3a50d63", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5890937-1611-44b4-9fd5-0384083a1ed3", "sighting_of_ref": "indicator--75b6462b-1122-4122-92a8-e2005c46e99d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e41b9e7d-5d7c-4c68-bc20-69616213f9a4", "sighting_of_ref": "indicator--2df865b9-a245-44f3-b485-0fe894d1f121", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dac2cad-5a87-4472-923c-7f53c8ca0313", "sighting_of_ref": "indicator--0b2fbd46-9c03-4334-a308-7b5f6a90d586", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ac0cb85-320c-490e-8743-5a700abd6d8c", "sighting_of_ref": "indicator--e0d5e621-755b-4d93-b0db-b8f5cc8cfff0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dd955c6-52ef-4cce-94fe-3aeb42baaa7a", "sighting_of_ref": "indicator--29536d88-162e-479e-9073-bbf84929bda9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8642ab1b-6e24-4e1b-bb9f-85ec5e44909f", "sighting_of_ref": "indicator--8e199b28-0fb3-4629-b7c7-54e87faf2c4d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a80337a-5da9-44c3-af48-785542c38534", "sighting_of_ref": "indicator--a440f0d7-4ad4-4e99-9afb-085d166cbdfd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--989e057a-6365-4ffa-a54b-4f7594623855", "sighting_of_ref": "indicator--8b739b85-4628-41a5-89d7-f97f61daf849", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--637b8121-28cc-490f-96f5-23c48ae2d416", "sighting_of_ref": "indicator--19bc64a7-8722-4e1c-9f42-3b0c10a6da50", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d900226d-be37-42fc-9840-3bcc5a5399a2", "sighting_of_ref": "indicator--30fcfb63-7892-452e-803d-6889ca132991", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4668f1b-c7c5-4f49-ad94-36941b8ea646", "sighting_of_ref": "indicator--35c2019b-190c-4f69-9451-e4837c63128e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82f86961-e8c2-4cea-89e1-1a16613f7e8a", "sighting_of_ref": "indicator--f796f2ed-87cd-48c6-88e8-92a3afd39570", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c134690f-455c-4ad0-bf3f-e56d9d84db8f", "sighting_of_ref": "indicator--d5ca0325-3638-4724-8bd9-2d5f2464d8d0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a75af689-51b4-4e44-844b-a5ef22c34ca1", "sighting_of_ref": "indicator--725135d2-c0ca-4a26-b95f-813d612d2b64", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8aa70bfa-9a56-43f5-98b2-aa6fa7055f4a", "sighting_of_ref": "indicator--d17a1633-d36a-40bc-8486-07293ce8f40e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f32e1e3-834d-4393-8e5c-eafdad89e2ec", "sighting_of_ref": "indicator--534f1c42-0949-400c-acea-423effd46e78", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cfb2793-c69f-4bf1-969e-2aa3f8af530b", "sighting_of_ref": "indicator--1900ce0d-9d4c-4719-b508-16191294a129", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6012afb-6dfa-40af-8325-ead1f0e9ab04", "sighting_of_ref": "indicator--22689481-071c-4483-8f3f-12b01c67882b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de098008-3e56-404e-9a2b-f2c2c2bbc0bf", "sighting_of_ref": "indicator--032b6b22-995d-42d3-9a30-72ec543ac5d6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--949510ac-01d2-4400-a10f-9d8f416275c7", "sighting_of_ref": "indicator--8c668758-1c70-42c4-a7f2-d5884c6865f8", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74bce75d-b577-4c95-9c6b-75546656d1aa", "sighting_of_ref": "indicator--fce03690-6d8a-4a6f-93b9-b2ab057e4502", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8350412-c8c8-47a6-b9a8-e44a408b7a48", "sighting_of_ref": "indicator--475e5778-cc8a-4893-9558-6ad6e8607350", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2ba4bc6-d87c-4944-bfef-91d804c2503a", "sighting_of_ref": "indicator--afbc4886-99df-4df2-b352-b0592bf2d57d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb9d0f9e-6192-4f68-a8d2-2e2fc453e2f8", "sighting_of_ref": "indicator--108ed106-87b2-402c-b5c7-d0d7a73f8d87", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e8853f4-97b9-4513-8328-8bece2753f1f", "sighting_of_ref": "indicator--c748404d-fbf0-41f6-9b1c-3a0485dcff21", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e2fdae2-c157-44fc-a295-809b5a7cddcf", "sighting_of_ref": "indicator--66c06d38-55e6-40fe-8ba7-b9b158c36211", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c9ad738-63ef-46ae-a06e-87374eef8069", "sighting_of_ref": "indicator--c2fb2c89-687a-49ce-a268-cba9872b620b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c14e4299-6931-4cc6-a3e7-8023f70dc32d", "sighting_of_ref": "indicator--76297658-4c4c-41fd-8611-fbf35120058a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58985eef-1ea8-475b-85a3-6d35d1825360", "sighting_of_ref": "indicator--1a95037f-d454-46bf-9e0a-3462098a20a7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac3647d3-c9ed-4209-b8ff-7fa4b44cd7c5", "sighting_of_ref": "indicator--e3c23b86-f63d-44db-8a02-92f1d0bf6dfd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99abbb32-d2e9-4ce3-990a-0499be770569", "sighting_of_ref": "indicator--c165c13f-f1a5-4e9c-bc21-d15e66783626", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fcdaac8-6699-472c-85e7-40052b71736b", "sighting_of_ref": "indicator--ee173d48-e287-43d4-a934-e2edd314e92e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b97d61b-23a6-4556-9d12-c78a29404418", "sighting_of_ref": "indicator--e538e22e-35af-46e1-ab0c-b23fd732204c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feb7b89e-be2c-44f2-9469-6e405c43a874", "sighting_of_ref": "indicator--32eb3477-07d6-49ba-9c80-86c5452cdadc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f717823-f9de-4680-a94a-7a25f24bb641", "sighting_of_ref": "indicator--58006aa1-e6b9-4dd8-afbd-87350d36eba3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f0944e6-13f5-4903-b11c-fe6f5dd93dcc", "sighting_of_ref": "indicator--9f95e199-7e87-43e1-91e8-b8565566f85c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--325d3674-0088-4993-904b-61b24df1fc44", "sighting_of_ref": "indicator--40f3a231-cec3-4bce-904f-fce7102c2f8f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fed219fe-aabb-4d60-a793-3aca248fa76a", "sighting_of_ref": "indicator--2a862719-f889-4bf1-827b-374f1bfe0525", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--049e294e-4235-421f-a085-7a238305eda7", "sighting_of_ref": "indicator--02f38636-14ca-4bc8-b21f-75d0f1fba1fd", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6417eed-44de-42e6-b54e-41a27605210f", "sighting_of_ref": "indicator--0d28b619-8b3b-4412-b315-52d1d88a9587", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94bb1299-fdad-4eec-9c9b-e74777610294", "sighting_of_ref": "indicator--a59dda9e-a71d-45c8-a6a9-b4452fb189a1", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05e78cda-f555-48b1-b07e-39346b8c4d1f", "sighting_of_ref": "indicator--20987bb2-8cd4-4e8c-a3eb-fb5e54ed2b0d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ea32c46-56a8-49c3-93b3-7c50bf59795d", "sighting_of_ref": "indicator--06d92099-69ad-47e9-8119-c06a2d6255f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c12a548-11d5-40b4-a899-cdad52b3e276", "sighting_of_ref": "indicator--06d92099-69ad-47e9-8119-c06a2d6255f2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04d47a84-94b3-4916-8cf5-345d9836a535", "sighting_of_ref": "indicator--621be5c4-571c-4d84-ac09-cbd45b3a8c52", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f05b8c37-ca3a-4b22-8638-52b45fb5a35d", "sighting_of_ref": "indicator--47fe7f7d-12f2-4740-9894-f7b4502f5f01", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6b7e372-363f-407c-923e-e2bf3e593260", "sighting_of_ref": "indicator--ed1a932a-bad3-4798-9ff5-0ab9e20a6f10", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce7e3761-96b0-4be0-982b-713b669b80f9", "sighting_of_ref": "indicator--cd03fb32-cce7-4f2b-bc65-ae4f0592fd29", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93260dfe-08a7-40aa-9fd6-4d8593e00972", "sighting_of_ref": "indicator--85959b11-0438-4098-8b99-2958a735a6f0", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--772d991c-aa01-4aec-8cde-24e01d3534c0", "sighting_of_ref": "indicator--85959b11-0438-4098-8b99-2958a735a6f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c385e30a-2151-499e-8d5a-92b535166522", "sighting_of_ref": "indicator--1833d3ba-bc88-4768-bf88-a069bb468bf7", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4298d07a-699b-42ff-8086-64cc85a9b2ff", "sighting_of_ref": "indicator--0d293b4e-0a1d-4608-a911-babc01a1710d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3499f8eb-34c2-443f-a6b0-76c1d6578054", "sighting_of_ref": "indicator--da015ce0-844f-47d5-9127-8686938f79ed", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ad1be9f-5bae-4e3f-9e74-728f77252ef9", "sighting_of_ref": "indicator--1788c7cc-650d-446e-a7c8-7dde05feb4f3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51a3790d-b379-4636-82cc-4b60b57ca0ac", "sighting_of_ref": "indicator--2184f284-0445-47ed-b93f-a1273cdfb9b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6c93476-131f-40b6-8e45-d20a527b91ca", "sighting_of_ref": "indicator--95dffe31-350e-42cc-a540-b1cc90df52bf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a851c992-d7cb-4617-9668-ed6f10379ab9", "sighting_of_ref": "indicator--95dffe31-350e-42cc-a540-b1cc90df52bf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0090d3f2-6512-4538-b584-b032c2bea1ea", "sighting_of_ref": "indicator--bc892765-65a5-40fb-a410-a93b61d91aaf", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d03242f0-a70e-4187-bd77-7f1659c5a10e", "sighting_of_ref": "indicator--bc892765-65a5-40fb-a410-a93b61d91aaf", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b786cdc-3285-45ff-858e-8bf007e39741", "sighting_of_ref": "indicator--d392184a-50f7-47f8-aca3-17085a20790d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05901fc5-61fe-4d88-a10e-15e221b2dff7", "sighting_of_ref": "indicator--5af7eb0d-d827-4d0f-957c-af36d83a40b3", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1c0fa93-782a-4651-bf21-4227b1a17ec9", "sighting_of_ref": "indicator--7a87487d-35ed-4a3b-856a-5daa9b2c691d", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2173ac08-093b-4cb2-b263-44324a68b3d5", "sighting_of_ref": "indicator--de7b2f15-85ef-41ff-83f5-ebf9e1ea040a", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc6e11af-1838-45e8-9e29-3338b60d69a8", "sighting_of_ref": "indicator--e0277146-d5ac-49b9-8b92-14e5ff9b0393", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--644a120b-f91b-4be9-9067-1bb35b6d20a2", "sighting_of_ref": "indicator--b746b46a-b2af-48f3-a846-e719fde143c9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12baf7d1-6626-42b6-9f47-b32aa44545ef", "sighting_of_ref": "indicator--97814db6-aeb6-4ac1-ba20-d4ed5e6ea6ec", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98d0ad47-75c5-4a65-a24d-57d3437c9f32", "sighting_of_ref": "indicator--fae94ca4-7469-4c1c-9f4e-61d8f92cfce1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52164acf-290a-4a9e-966f-9c68c8766bba", "sighting_of_ref": "indicator--aacc8982-05fd-446c-95c7-31e35b489eb2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0347564b-4a23-453e-8546-a757f8a38fd9", "sighting_of_ref": "indicator--fa42cdce-ebb7-4ce2-b01b-bf655bec8b0f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e01200b4-fdd9-4ecf-bece-bb2e5ef24ca6", "sighting_of_ref": "indicator--fd6ad630-3a77-4692-b51e-76f488f135d6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e395a00f-6ede-428a-ab9f-89f81d34fb46", "sighting_of_ref": "indicator--fd6ad630-3a77-4692-b51e-76f488f135d6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccf4ff6e-942f-437e-aef1-2e7981850fe1", "sighting_of_ref": "indicator--f6361b61-5f4b-476d-8070-a518913c4eb8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33326bd0-6d99-4cf2-8da2-7024931f568f", "sighting_of_ref": "indicator--a2430e78-4ea8-41a5-bfa0-739181a627a0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16d881da-2b2f-4c78-a643-cb8ca4770b27", "sighting_of_ref": "indicator--a82ca71c-4e3e-494f-9b78-9a40ac34b0c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1643cb88-8a99-42f9-8b16-3e77f0258a42", "sighting_of_ref": "indicator--a82ca71c-4e3e-494f-9b78-9a40ac34b0c6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d73459d0-8ad1-4a88-a08f-a6e591701e66", "sighting_of_ref": "indicator--ee8bb315-7705-4df5-b026-8194e3eab344", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0e7aa5c-d7b9-4a27-869c-d82f7fed298e", "sighting_of_ref": "indicator--ee8bb315-7705-4df5-b026-8194e3eab344", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f61f553b-608a-4e77-869d-374eeec6aad8", "sighting_of_ref": "indicator--7130128c-c0b0-4383-a9b5-95ce1be3187d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fd14f71-0071-4c9d-ab01-c3906f8def70", "sighting_of_ref": "indicator--895a7f65-27d9-46fd-ba7b-b663b59637b5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf58e8f0-44c8-4136-9ce1-854b156dd300", "sighting_of_ref": "indicator--c1bc1162-75e1-478c-b2ba-06be8f84dda4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89c2b25f-e489-43bd-b628-ee8afb59247e", "sighting_of_ref": "indicator--18d1b5be-fc8d-497a-9599-b9fb3e969107", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff3b525c-5cd8-4c99-8b3f-fd1710d00ac2", "sighting_of_ref": "indicator--9c77153f-2b34-4af5-a97a-3e56c0e5b8eb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08f03124-f35c-414c-b07c-a97856ccd20f", "sighting_of_ref": "indicator--c1058447-9241-4152-9921-f40b27859378", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26ccc7d6-5d5b-4e7e-a8f0-1762e514155b", "sighting_of_ref": "indicator--cb7c6ca1-f02d-4bfc-9597-bcf7a0078e33", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae778e58-7690-4a82-9a7b-c98a6dea3254", "sighting_of_ref": "indicator--33cc3b8a-bc02-4bf8-aecc-2d2bb93743a1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bd94dea-6ba0-405a-ab91-79e0a080ae54", "sighting_of_ref": "indicator--d4fdd72d-cf4b-42fe-826b-a0a75a220ed7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11e14264-f30a-4c7d-8c25-a828124c27ee", "sighting_of_ref": "indicator--a62d1baa-5d9c-43c8-8f1c-334e0e1dd0fe", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21fad1da-dd20-451f-93cd-d34ae2dd7e7c", "sighting_of_ref": "indicator--58eb9100-06f7-4292-a027-f860e46d82f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e96414a-1c38-4f7f-823f-bf7cd6fa7926", "sighting_of_ref": "indicator--3c845c5c-ce01-4ff7-a017-98a6fcd75183", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--939c038c-6e30-4dbd-880f-98ec3c2f19f6", "sighting_of_ref": "indicator--edd9f1bd-813d-440c-8ce4-d99d4c896491", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dfc7f8b-b61b-4bb6-8b6e-89948f89f2f8", "sighting_of_ref": "indicator--c469aab5-210d-4bda-9058-9ab2e8f103e4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--968e511d-4b3a-4cb4-b6c1-8ab22aec5014", "sighting_of_ref": "indicator--e4c286d2-bf34-4d07-9cff-60f81dde302a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a62b243-ec4f-4ac2-9be4-75237d27afa6", "sighting_of_ref": "indicator--072505fe-8e76-4f38-8b7e-dd8fcbbf3029", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ab4bac9-dfdd-4f6d-8a78-50c6fe7ad5ff", "sighting_of_ref": "indicator--ad761322-5d34-43ad-b928-d66baefa41c1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3458f75-6776-45ff-9f75-7021f3b1d08b", "sighting_of_ref": "indicator--7a8e9713-d2a8-4d4a-bc63-098e588fe9ce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31560f06-8f46-428b-b4d6-38c54d21c2f7", "sighting_of_ref": "indicator--048d718f-7781-48bd-b5ca-f2c9f6a5ad7f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcc2fb7b-6cc1-4505-a11d-cd6202243925", "sighting_of_ref": "indicator--b0942d9a-efac-4907-bc70-fb5a3d615ccd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9790e767-e0b4-4a74-9f1e-a70dff6efdeb", "sighting_of_ref": "indicator--58560c40-d2f4-4b7a-aef3-6faf10067cb5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b08d20f1-2fe5-45c0-b4d2-e0a2daef89a5", "sighting_of_ref": "indicator--d52482af-e858-48a2-90ab-c87e9ca7a4b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d03e381-b562-4cbd-be53-5087879b42e6", "sighting_of_ref": "indicator--d52482af-e858-48a2-90ab-c87e9ca7a4b6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1f06219-bc3f-47c4-848d-b85115107a0b", "sighting_of_ref": "indicator--1a8906a5-655a-4443-8fc7-ccca66514f82", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4706c9ba-ccb7-4a8b-8459-bfd0462d9cfe", "sighting_of_ref": "indicator--d9dd4ae6-4455-4916-abfe-32d465ea2c10", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e75bc67-892c-4fa8-8c02-14a7b0130238", "sighting_of_ref": "indicator--dc2302e2-29d9-4e24-ae94-9e9f098fba4c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--193c1c59-9f58-4a8a-a00c-d35ca61608e8", "sighting_of_ref": "indicator--dc2302e2-29d9-4e24-ae94-9e9f098fba4c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88e37998-a9ce-4966-b33f-a58b5baedb88", "sighting_of_ref": "indicator--e49bec8d-cdaa-43de-9f64-c6626007cc10", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7965773-cff3-4bfd-b154-32f1dd4c6bc4", "sighting_of_ref": "indicator--cfbe6ea0-6c97-40b0-a1f0-c934b09e2ab9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1fd1591-382d-40b2-999b-cdca068982a8", "sighting_of_ref": "indicator--cfbe6ea0-6c97-40b0-a1f0-c934b09e2ab9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69519ebe-2d9e-4790-96bf-4286e94334b3", "sighting_of_ref": "indicator--5af42854-8102-4eb2-a5f1-41c3ffb0cc20", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--826f1288-a1e3-4420-b1cc-2c4eec8dbf08", "sighting_of_ref": "indicator--5af42854-8102-4eb2-a5f1-41c3ffb0cc20", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f77c368-d122-4ffa-8c3b-ce43203d6681", "sighting_of_ref": "indicator--4c52b14b-5819-448c-a8fb-af98f44c4b9b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58906aa1-e07c-47be-a632-ac93e7de8540", "sighting_of_ref": "indicator--0a6571d1-db68-408c-a4d5-04c79749ca6c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8e8c687-188a-420d-b790-8b4a82abab17", "sighting_of_ref": "indicator--a80174c4-4dd4-414f-a8ad-9ca6cc4c37ec", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1f1f834-f5c1-4813-8d23-853284a727c3", "sighting_of_ref": "indicator--f673c3b3-9633-41e5-a1c8-9d69f22ff117", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--789dbb67-ffd4-401a-9a3a-1f0fbebc12e8", "sighting_of_ref": "indicator--f673c3b3-9633-41e5-a1c8-9d69f22ff117", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3130327-72a4-410a-a018-f613921246d2", "sighting_of_ref": "indicator--03af3080-6bfc-4efc-bced-58a105773423", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b731838a-ef75-427f-86ff-a621fef4927c", "sighting_of_ref": "indicator--03af3080-6bfc-4efc-bced-58a105773423", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa46c248-1390-4c8b-86ba-5d60feb6797d", "sighting_of_ref": "indicator--db8f8bc4-269c-48d5-a9c8-14656d38d8d6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--229b71d2-b5fb-4123-a5b1-495680151fd4", "sighting_of_ref": "indicator--4f3f1327-7027-4cb5-a675-62ff2639ff58", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c861a75-ab41-4b6b-ac3f-a8c5fba17a37", "sighting_of_ref": "indicator--4f3f1327-7027-4cb5-a675-62ff2639ff58", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa80d5d4-323b-4a87-9a88-57e71c9280d5", "sighting_of_ref": "indicator--1adf67aa-2e53-4e3e-867c-0b03fe6dd78b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4872a41-5e9e-46b4-8998-44cb139edf8d", "sighting_of_ref": "indicator--d1d8e32e-4caa-457f-85b5-4554d7a1fa02", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1520a3e-eaf1-48b6-ac24-bbf9c7ffc432", "sighting_of_ref": "indicator--a0dfd396-20c0-4f1a-b52f-5444098bcf8e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5afa3263-6b88-47ce-bbc5-a55d98abfd2f", "sighting_of_ref": "indicator--ef85cecd-2140-431a-8c14-1c3bf9ef8893", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ec3aa36-2d17-4f36-859b-6bdcb9ce5ce5", "sighting_of_ref": "indicator--ef85cecd-2140-431a-8c14-1c3bf9ef8893", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcdd7fd9-5c0d-45b0-abc7-6d34286c252a", "sighting_of_ref": "indicator--55702a43-f96d-4794-ba02-b19bd1d13cc1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf113d49-c52e-498b-9eff-9fb906d2ec62", "sighting_of_ref": "indicator--d193bfae-8229-4166-adbf-b222f5b1f8a4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbf1538d-34a0-4af2-8139-9b940789e753", "sighting_of_ref": "indicator--d193bfae-8229-4166-adbf-b222f5b1f8a4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54680b85-c200-4de5-84f0-6c4dec9b28bc", "sighting_of_ref": "indicator--afef556b-058a-4478-bf3f-09e4f4aacf88", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab7fdab4-dd19-4fea-a933-29117118c4a1", "sighting_of_ref": "indicator--8e60f429-80a9-4053-a8d5-975324021777", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--366ee1b1-d42f-40aa-8943-9fe42b1ba7ec", "sighting_of_ref": "indicator--8e60f429-80a9-4053-a8d5-975324021777", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1685440a-973c-407a-be9d-3c4443770f37", "sighting_of_ref": "indicator--aa24d078-5662-421c-b7a1-09c8f3ad14a3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c17a4e2-4013-43f9-83ec-8b6c451b2827", "sighting_of_ref": "indicator--d3dabd69-8bdd-444f-b687-7d4c6ef2ac0e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55b185b5-8010-4ab1-830f-15ee9f491a44", "sighting_of_ref": "indicator--d3dabd69-8bdd-444f-b687-7d4c6ef2ac0e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c866045-aa33-4d7c-ba3e-c1a5e48c7186", "sighting_of_ref": "indicator--170b2290-9f18-4ec1-be49-1c2d5ae5d285", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86a39881-33f6-43d9-820f-2ef549a3c495", "sighting_of_ref": "indicator--0606c8ad-ebcd-4c7c-bbdc-b7b174c2ac9c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22851e72-5daa-4e52-b2b4-ba5cc43de3b8", "sighting_of_ref": "indicator--6cc2a7b3-8609-42c8-b34f-0e88bad8bd80", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c884ba8a-1022-4ae9-adb0-9b68285b6b4a", "sighting_of_ref": "indicator--3f50e7c4-aca1-4c26-a311-81606f441f69", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f3df35a-f7fb-41af-ade9-e95be780de8d", "sighting_of_ref": "indicator--0225cbdd-585d-4bd1-8084-6fce5d52b3f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9db49988-2fef-4196-befb-fbe742ec58ce", "sighting_of_ref": "indicator--d1c26e6c-2cec-4631-97b3-c2f3f6a2cd9d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f86ea41c-7777-405f-b9a7-8ce9da528c38", "sighting_of_ref": "indicator--e6a6c7e8-d9ed-4b9c-8ee5-ca952b381c34", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a61840f-44d1-4738-9d83-7b177dba188d", "sighting_of_ref": "indicator--47b9cb91-39b5-4c52-b31b-52f460b1549d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b25d109-c07c-4a92-a256-f4782c439d45", "sighting_of_ref": "indicator--cd8847ea-9b78-4c27-9676-a1dd51edf939", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3574f2a-a192-4130-be33-70900da433fd", "sighting_of_ref": "indicator--cd8847ea-9b78-4c27-9676-a1dd51edf939", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93b5ed3d-7ed2-412a-98f5-90e6b1d11508", "sighting_of_ref": "indicator--3690b5e1-df78-4940-83c1-e7e5be1777d1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b5fdc56-a40b-434e-9279-f7d2381cd759", "sighting_of_ref": "indicator--50ed4fb0-59f4-4f2f-a86e-44132b40a047", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8f78c22-67b4-45a5-a752-9de43ee15158", "sighting_of_ref": "indicator--1762ff11-96a2-45ca-b25f-b549fb12067e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e185f71-2a76-40c0-a261-7bc099f01e22", "sighting_of_ref": "indicator--507f76f8-dbcd-40d9-8825-709e9b43fd8e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92cbcb4b-d56a-4e91-9586-9edc4ad55e64", "sighting_of_ref": "indicator--e0f40f3e-7530-44f2-b289-fd5663be99c5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a75f33fc-22fd-481b-9897-f16330bb9391", "sighting_of_ref": "indicator--2c844d9f-8d4e-4b63-b1a5-10f91bb47858", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2b2895b-f823-4f84-94fb-227ddb0fae52", "sighting_of_ref": "indicator--f7a13143-51fc-43f4-b416-c98c4c9cd9e6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--149238cc-c232-4f9f-9102-99a39851cee3", "sighting_of_ref": "indicator--2311be75-1eaa-45f7-8667-dfdf110601d3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc85e716-9016-4b46-b730-63770de0c4a3", "sighting_of_ref": "indicator--7f3ca3fc-321d-4241-a378-d2f031caa025", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0720289b-a5a4-4b84-8e95-da592bc807e9", "sighting_of_ref": "indicator--416bd479-9bd5-4d9f-a6df-3b51da3a7a12", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22d81fb5-c7c4-4963-8a26-98b231c39a2a", "sighting_of_ref": "indicator--496f732a-a3d7-4409-88bb-bfee15352814", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4716717e-99e0-467a-9cd9-34ebf83a67d8", "sighting_of_ref": "indicator--496f732a-a3d7-4409-88bb-bfee15352814", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--571b6495-f2e9-4f2f-8945-0b1f05f0b92b", "sighting_of_ref": "indicator--44a9fa75-c61c-49eb-97d0-4793a3a5debc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e491881-acd0-4a4f-aaa6-a4012579ff82", "sighting_of_ref": "indicator--569f70b6-db8d-446a-be1f-d143d660e9f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--add7aee5-e8f2-49f7-8325-98e4a7850a00", "sighting_of_ref": "indicator--569f70b6-db8d-446a-be1f-d143d660e9f2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0009ecb0-4d0c-4701-8c98-15f514bfa776", "sighting_of_ref": "indicator--e53db97d-9f7b-4165-95a5-dfcec41633b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19bc6bc3-2bda-4d39-8dd7-913ccc4d41c8", "sighting_of_ref": "indicator--e53db97d-9f7b-4165-95a5-dfcec41633b7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a3fb8b6-2e07-4323-b21a-829710661c6a", "sighting_of_ref": "indicator--dced0d52-0aff-49a1-b081-5b1f78eab9f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35383f1f-406b-4f28-8e88-bdcda1aa0de2", "sighting_of_ref": "indicator--d142d54c-cf79-489c-a98e-e7c2754eee34", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e305ee1-1014-41e0-80d8-181070e3cbd0", "sighting_of_ref": "indicator--0554bb74-281e-4ed1-b211-a4462ed1978c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81900a82-2dbd-4504-95cd-13af3bfe242f", "sighting_of_ref": "indicator--1df8fb8a-2ad9-4961-bf18-5995c053f3f4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deb95842-66ee-415f-92d9-9f55b21e5c92", "sighting_of_ref": "indicator--8bcb424f-86fe-4253-87b6-1d9693e2f48b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--523a8c30-b706-408d-95b1-359c42355089", "sighting_of_ref": "indicator--86c3328f-b03c-4915-9f54-5d83bc280fdc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7fcb477-f15b-48ac-9ee0-29f8c3d47fa6", "sighting_of_ref": "indicator--ed7ba0e9-ed09-44fb-a541-df51488be565", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48db099f-5ba1-4423-9693-2e453ee10b1b", "sighting_of_ref": "indicator--ee2ced71-73b1-4d26-a743-0cada4c13d2a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--307c88d4-5be8-4cab-b3ac-59ab0d3f37fa", "sighting_of_ref": "indicator--ee2ced71-73b1-4d26-a743-0cada4c13d2a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--884f9c54-3a4a-4e36-9224-f316f7575137", "sighting_of_ref": "indicator--941daf2e-a4a5-4c77-b07e-2268a22882e7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0666ba86-864c-44fb-9b48-57e3551f3890", "sighting_of_ref": "indicator--a6b2b72d-192b-455b-9de4-14825738ad96", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a2e9c87-9554-4a86-8875-d2ce3bb1f165", "sighting_of_ref": "indicator--54db5aed-1afb-4238-8feb-69f6fa6a404f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c5eb35-c531-48a1-998a-08722570349e", "sighting_of_ref": "indicator--28d34e5d-ceee-40ae-95cb-3d342dcf1513", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3db9c5db-fe8e-4725-8b73-396d0d3a1388", "sighting_of_ref": "indicator--28d34e5d-ceee-40ae-95cb-3d342dcf1513", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b955b7c1-332f-4a3c-9e3d-494bce5d73c7", "sighting_of_ref": "indicator--34bf8b1e-a343-4074-9cb0-b53c3527310d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c7040e3-c9ff-4fd1-91a7-77a802df72ed", "sighting_of_ref": "indicator--34bf8b1e-a343-4074-9cb0-b53c3527310d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f277da9a-a40a-44c0-9cfb-bd419d508584", "sighting_of_ref": "indicator--ceddc63f-3dfb-4956-a1fd-d02150dd768e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--138db144-959f-4b67-8f02-5246929a1a58", "sighting_of_ref": "indicator--1d9ed170-1ab3-4cfd-8fe1-ca900f454cae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--621c82de-5b7e-4d4f-b526-dce6de628833", "sighting_of_ref": "indicator--77066100-6206-4025-8e0a-fb09a6f3ff23", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbd54772-76fd-4033-8f52-3468e42a2448", "sighting_of_ref": "indicator--106c9d6e-7b6e-4ee7-a712-fa2fd789be43", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b345fb13-b869-43e1-84aa-637e53e8c23f", "sighting_of_ref": "indicator--106c9d6e-7b6e-4ee7-a712-fa2fd789be43", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12a48a29-e41b-4478-9d5a-2a56ee417ccd", "sighting_of_ref": "indicator--1ff29bf0-32c9-4e48-b930-14ed09ea4ce3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1ae5dc9-327e-48d6-9da9-2a533643422d", "sighting_of_ref": "indicator--eb8b1922-2946-437b-bb7d-6558a44186ed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47ceb453-a0e0-44fa-858a-418845259bf9", "sighting_of_ref": "indicator--eb8b1922-2946-437b-bb7d-6558a44186ed", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cfcf9d8-b0bb-4ce3-9286-129cff071ae6", "sighting_of_ref": "indicator--6d6ff799-d133-4712-a1ac-afc9c54a1699", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68067b65-eaa8-48bd-80bc-6dedb9c073a5", "sighting_of_ref": "indicator--6d07e164-097d-4448-bef1-ebd3d1436325", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78715331-ad21-434a-aa71-68e914890250", "sighting_of_ref": "indicator--6d07e164-097d-4448-bef1-ebd3d1436325", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a71e4aa-5364-48a0-a26c-64ce356f2de6", "sighting_of_ref": "indicator--45401d43-ef5d-4fe7-9a6b-8b9745988eeb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fc43a67-fb35-4c15-9934-1cc2fd762994", "sighting_of_ref": "indicator--1a233139-64bd-4287-b1c2-015dea78158d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--503bf668-f6ca-410b-a52b-0c5d04732901", "sighting_of_ref": "indicator--ea62f8ab-455e-4c02-8192-451b57fe8a7e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96ac8e14-6979-49b6-844f-316ac523d2db", "sighting_of_ref": "indicator--8eed37b9-67b8-4ff5-bff0-f3814df44704", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0adeb1f-79d5-4060-9720-3667bacbc887", "sighting_of_ref": "indicator--8eed37b9-67b8-4ff5-bff0-f3814df44704", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dcd2614-bf36-4fae-8b44-9e32b29f0536", "sighting_of_ref": "indicator--a1952bef-83ec-451b-8980-fbcfd6e9c697", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb922815-c65e-4862-8ed0-83884eb7c019", "sighting_of_ref": "indicator--a1952bef-83ec-451b-8980-fbcfd6e9c697", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73cf8da9-2cd3-42cb-a52d-a81f6782dcd6", "sighting_of_ref": "indicator--4bacb6c6-306f-4a03-924f-c31ca98998c7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20baa9bd-9c22-4684-9b7f-0a83fdd39348", "sighting_of_ref": "indicator--700f77e1-f954-49a4-8fba-39132b4e56f5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5bb417e-764a-4295-ae51-00fe2744c656", "sighting_of_ref": "indicator--f416094d-a859-41ad-9662-ca1429f006dc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86847203-9a3a-4c00-903a-241cb6d39b21", "sighting_of_ref": "indicator--766b466c-fbcf-4786-a617-463f5f18db4f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--623b1efa-4542-445a-87e2-a1deb59cbf70", "sighting_of_ref": "indicator--766b466c-fbcf-4786-a617-463f5f18db4f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c7c4ce8-d94f-400a-b224-a943d1599d3d", "sighting_of_ref": "indicator--fdc402f8-a5bc-4037-905a-84139bd6d8ec", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88e736fe-f406-4e1c-a996-5abffbb2efb6", "sighting_of_ref": "indicator--8f173662-681f-4d9b-b61b-b3168179deea", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1abcf9d4-a577-445f-a358-8b7aa0adc8ff", "sighting_of_ref": "indicator--9d331c78-357d-4663-82e6-e5ca175f7468", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f57ca44-107a-4724-8244-bbab64c5df73", "sighting_of_ref": "indicator--baccdebd-5806-4d3b-b7d7-d81f75a492a9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a09e2fdc-7977-4b1b-b879-8ee09d35ede4", "sighting_of_ref": "indicator--145be544-579b-49a8-aefa-6c151121ee90", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41ab5a27-dbd0-4007-8829-09dd7d5150c5", "sighting_of_ref": "indicator--c5b81ef0-293d-498c-bbcd-bed1c47fce5d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1f846e1-d47e-4336-ae5d-dc5edb7bcee0", "sighting_of_ref": "indicator--c5b81ef0-293d-498c-bbcd-bed1c47fce5d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20b08a7e-ca48-4059-aa2d-d16d3406e0df", "sighting_of_ref": "indicator--1c470895-766f-4f19-9979-9aac9e02ad99", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a902cc8-18a5-41c9-8ab3-b84aea015066", "sighting_of_ref": "indicator--c7a49826-539d-4b5f-b03e-7dd61caff40d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f365c289-20d1-4e39-ac77-a2ce47e1a420", "sighting_of_ref": "indicator--1f886689-79e0-4478-a4c2-73ee35fd4be2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73957d54-c982-4e2b-b921-bbc96499caac", "sighting_of_ref": "indicator--1f886689-79e0-4478-a4c2-73ee35fd4be2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--169256bf-b30e-41bb-b528-d65523eb9ea7", "sighting_of_ref": "indicator--6a35da38-26f0-474b-9827-3cae8e69c4f3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bc65780-9952-4565-8dd4-335f06db6b28", "sighting_of_ref": "indicator--2313fa25-df53-4253-a519-237f6b96be38", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d536f65-31fc-4371-9655-353f7696a229", "sighting_of_ref": "indicator--e794e9a3-a613-4e0d-9ef9-d89ef9c804de", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c33f24cc-c078-43f7-b307-517603172339", "sighting_of_ref": "indicator--feba1513-800b-48d9-aec5-b8e1062e0429", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a751bf5-5087-4158-bd25-b5674cc758cf", "sighting_of_ref": "indicator--efc19208-2367-492a-b373-2cf26069f14b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b75915e3-a79c-40d4-bc53-cd06b32db619", "sighting_of_ref": "indicator--2f84e4a4-e4ff-4672-a667-7ede7aebfec6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--707afb5a-15d2-4be1-8597-141342ae29f3", "sighting_of_ref": "indicator--f5a83c0d-3474-425d-b833-382efbb24e4b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3adc6c1b-79c6-4013-87c9-5f9460fa1b80", "sighting_of_ref": "indicator--f5a83c0d-3474-425d-b833-382efbb24e4b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d3aa4ae-f760-4907-91d7-af7fa7ff5949", "sighting_of_ref": "indicator--cd5fd6b1-a8a7-4298-886b-d968474561fe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--430a9f8d-7408-4054-9f34-e9180391220c", "sighting_of_ref": "indicator--25b9e481-6143-499d-adb7-2c0ff0e118ce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34e8c493-62a4-44b2-a598-a5d98eabe8ab", "sighting_of_ref": "indicator--e9b3caea-38ab-4b4d-9969-ff6baba8a93a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3757f51b-0f35-4ad3-aaa0-e65278d03bbb", "sighting_of_ref": "indicator--6973792e-bd98-4cdd-a8b9-47cedea10a73", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6009dc4-9588-451e-b768-ca10c98541b2", "sighting_of_ref": "indicator--6973792e-bd98-4cdd-a8b9-47cedea10a73", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31e254ed-ac55-47c2-bcde-447c547f1579", "sighting_of_ref": "indicator--971301bb-5883-416d-ad84-68d685733066", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12b5bb47-f426-4fdd-b677-e3de4aa5555b", "sighting_of_ref": "indicator--2196bece-4a4c-4f49-b1d2-3537c99c0451", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fce6be73-c48f-4354-8b9f-f46e9d32214a", "sighting_of_ref": "indicator--250f8e2a-6160-4c6e-913c-91cdbcc82efe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03cd6982-4bf3-4297-a92d-defc495eb425", "sighting_of_ref": "indicator--250f8e2a-6160-4c6e-913c-91cdbcc82efe", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36d9a17a-c89a-4c25-980d-05459c814153", "sighting_of_ref": "indicator--d96a051b-1b79-4dd4-b925-eb54ec26cbb4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05cdf5e7-3cc4-4787-a497-b7975f025d6b", "sighting_of_ref": "indicator--a06b3fd1-1ee9-4b53-a118-60d82538ccfa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42fc05ec-795b-4231-a766-0b0127ab68e7", "sighting_of_ref": "indicator--4bf6c44b-f17a-4fdc-88c4-8b63590540c8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c62e501-afc7-4e9a-b29b-f50b491dea4f", "sighting_of_ref": "indicator--8365cb2e-f2db-404b-8575-15a2b43957f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--073f9d85-469a-4756-8654-b5ad79407cb4", "sighting_of_ref": "indicator--c3efbffb-634b-4c94-9fdb-c1f42d8b08bb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3bff7a3-8e40-4644-a0e4-ac74ba8b2ae5", "sighting_of_ref": "indicator--c3efbffb-634b-4c94-9fdb-c1f42d8b08bb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a62b76a-ae23-42fd-a048-04e5a3e00be7", "sighting_of_ref": "indicator--b97b9ce7-0354-4f35-affa-8819ed33cf2b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5933f85-a7e5-49ba-ae13-6e1d18eec198", "sighting_of_ref": "indicator--b97b9ce7-0354-4f35-affa-8819ed33cf2b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81a28ea7-2c0f-480b-bb94-6ef425c3a644", "sighting_of_ref": "indicator--e562e195-9b83-495b-b606-89d5d826ebe9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3af0717d-24c8-4cab-91c8-03552ae32d49", "sighting_of_ref": "indicator--3ffa7d5f-5a54-4abc-97c0-07c40d571c59", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d3653c4-0311-4d8d-9814-3e6efac84953", "sighting_of_ref": "indicator--3ffa7d5f-5a54-4abc-97c0-07c40d571c59", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e168f14d-5ed8-4c95-ae67-2a53b53137a2", "sighting_of_ref": "indicator--d6f467d8-693d-4031-b471-5718f3d91f58", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92ec3933-b942-4f21-9be7-b3de1394f33b", "sighting_of_ref": "indicator--d6f467d8-693d-4031-b471-5718f3d91f58", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aee9d80a-54b1-4a00-83d1-76a63233afd0", "sighting_of_ref": "indicator--43e099e3-c12d-4b6c-ae7e-adea8977cdc7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1024d1b3-7b45-435d-94dc-05c6e99aa842", "sighting_of_ref": "indicator--43e099e3-c12d-4b6c-ae7e-adea8977cdc7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebd823b2-d2dc-4917-9f1c-e0aafad9be7a", "sighting_of_ref": "indicator--a7393020-4ba8-41fb-89b1-465a1cf91a0a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d691c2c8-a1d8-4f23-b417-45c808cee44e", "sighting_of_ref": "indicator--a7393020-4ba8-41fb-89b1-465a1cf91a0a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00a4b8a6-0330-4ce2-96fa-994e48dfcef9", "sighting_of_ref": "indicator--3c1b00e2-ed19-4657-b245-1a63b16a5ba7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92e39fc9-3b0f-4f75-9e98-ec16cce7b8bb", "sighting_of_ref": "indicator--c066aea6-34c8-49e2-ab4d-ab6e3114f715", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8615b060-9608-43df-971f-69df7b0d02f8", "sighting_of_ref": "indicator--c066aea6-34c8-49e2-ab4d-ab6e3114f715", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0921fbe-8239-435f-9e41-7b53be2e2cbc", "sighting_of_ref": "indicator--f85de16a-608d-48ce-b276-6a62106d22ef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbe86d25-2b1b-4c53-99b0-48c5b680b9ef", "sighting_of_ref": "indicator--5ca2b35b-6788-4176-9f01-0b312baa2aa9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2c6b7b4-78d9-4b53-9c76-b40b7ceb32b3", "sighting_of_ref": "indicator--b7e7608f-9417-4552-921e-ca8635e846c8", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96020eb3-9e68-4c85-af1f-317dc4d53f53", "sighting_of_ref": "indicator--83dd48b6-823d-4a50-a8a5-34f061863ae6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e9a5aef-5e07-43b1-95ed-acce055db312", "sighting_of_ref": "indicator--3b2117b8-c799-4eca-a64a-d1f5240e6652", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1197af10-d747-40ef-b24f-1fd0f7119e42", "sighting_of_ref": "indicator--3b2117b8-c799-4eca-a64a-d1f5240e6652", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7158797-a3d1-4019-be1a-f2a43c4694b2", "sighting_of_ref": "indicator--b813ca58-dbb7-43ef-b697-29501baf4734", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47fdfc5f-17f5-4441-b722-be26e2e64ca6", "sighting_of_ref": "indicator--86cf2a92-7c0e-40e8-a011-8dafa2bd36b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdeb26c4-c81e-4407-a15e-18240ff3b662", "sighting_of_ref": "indicator--66511de6-f8f8-4d74-8f52-6075f87c35eb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b27d955-f853-4358-8fa6-dc566e5deffb", "sighting_of_ref": "indicator--e7542117-6396-4cb3-9fc7-4198ebd5f255", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa1be479-2edc-4605-85be-130523388a73", "sighting_of_ref": "indicator--a4a9316d-a88e-4ba8-bba9-641240421d21", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75047884-88b3-4aa0-935f-98eea1044bdf", "sighting_of_ref": "indicator--3715a0a3-0023-4e73-ae30-0ef052d4e046", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--324fd3cf-7d45-47b3-bcc1-1d7bfda1e95e", "sighting_of_ref": "indicator--a9ca17b0-5037-4d13-b26b-4457223ad286", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bde98104-c616-4e40-9a05-f18919d3310e", "sighting_of_ref": "indicator--252d888f-f001-401b-bd14-301b712806b0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6ed7565-e3e1-4063-8f41-2db338b056eb", "sighting_of_ref": "indicator--5f9bb639-d548-4d68-a1a1-addbf7671ef9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63c0a86c-29d1-4fc6-8a00-b0eee7a52cfb", "sighting_of_ref": "indicator--e185bf2a-b9bb-4287-ae3a-bce9f7fd6dc1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2267c9db-75c6-4cd1-94e8-02b437148724", "sighting_of_ref": "indicator--e185bf2a-b9bb-4287-ae3a-bce9f7fd6dc1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ec3a8cd-295c-4fd2-892c-6aadcf424037", "sighting_of_ref": "indicator--2c854c17-d6d7-4e9b-8393-772f0f056276", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd0415cf-8a4b-4536-bdd5-8bb677be326b", "sighting_of_ref": "indicator--5cf9bee5-0e30-4249-9859-cc494d36b1a5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c32dd64-e12d-481f-9bf5-076d640fe5f7", "sighting_of_ref": "indicator--7c587e0c-6fb2-439c-8346-3033442d438e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--442e3b4f-eab4-4f45-bc90-d9a28bb0e039", "sighting_of_ref": "indicator--b9ec1d13-f6d6-43ed-83bd-6ba4787f920d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b685871-2783-45c0-8d8a-de254ab1ffa4", "sighting_of_ref": "indicator--e85b620c-55b7-4790-bd28-41541009dfc2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c62b228-141f-47d3-9348-4df929b1a893", "sighting_of_ref": "indicator--f6eaf770-94d0-4c0f-99de-82c43688aed6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f99833bd-8808-49b3-93f8-66f2b0458e83", "sighting_of_ref": "indicator--fa81bfd0-166b-4904-9cfe-412d6e6e0481", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d17205b4-0f5a-4342-8838-4ae8dea7fc0f", "sighting_of_ref": "indicator--fa81bfd0-166b-4904-9cfe-412d6e6e0481", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c8b8dd9-cfac-45dc-bbca-811d6de10459", "sighting_of_ref": "indicator--d61bdf8f-120e-44e2-9bdc-fe1387ecd09d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98e51e5b-4b49-4eaf-ad6f-0d37c7c33993", "sighting_of_ref": "indicator--4ccdbd60-277a-4470-8111-7228ebbbe540", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9650383f-57cb-4595-b605-f573119af400", "sighting_of_ref": "indicator--42136253-96a2-4cbf-98a1-6052e68b0c80", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1be01aa-a889-4a54-8c08-f0f8680e95ab", "sighting_of_ref": "indicator--048a0ed0-b4a3-474d-88cb-b24a305cb822", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3145faf-374e-44a3-9a86-42e21cc043cb", "sighting_of_ref": "indicator--0b74b988-69d4-4801-88a9-c80a4fcd07e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cae4fbb2-00fe-483e-81c8-16981ea1794d", "sighting_of_ref": "indicator--0b74b988-69d4-4801-88a9-c80a4fcd07e1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21184d2a-4f0a-4536-adc5-dd03e0961e0d", "sighting_of_ref": "indicator--4c6265fc-50d7-4783-a8e7-df0f637a0fee", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01fba5b8-dbf3-4dd6-84a9-7519980d6a3b", "sighting_of_ref": "indicator--475bf9db-5a3a-4900-a534-b5684f50a5d4", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad6b59c3-5fac-4356-a240-5f8171203d34", "sighting_of_ref": "indicator--3556f1de-ff85-4607-a602-6e1a56826aa7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faed08d2-965f-4864-b3de-860a7f47d36c", "sighting_of_ref": "indicator--63b0986a-cc0b-4e05-970d-ab4723224b9a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70618466-acbc-40f4-837d-dc278851b86a", "sighting_of_ref": "indicator--5cefc7ac-14a0-480c-87e0-62931b97a029", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62c29d7f-f2da-4d5e-842d-c58c42a723bb", "sighting_of_ref": "indicator--45b1b1dd-778a-4454-9a3b-c69610e679b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--095f0c6b-0c35-4cef-9ee1-82aef0c19224", "sighting_of_ref": "indicator--b9e00250-62bd-44cd-b3b9-4d65cd76156e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd3cd0a5-c59a-4b03-a681-5e96da8d71b7", "sighting_of_ref": "indicator--976776cf-2d56-4c9d-a1b0-b2df88228332", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5104293-7d41-4899-a4a9-ca07f5ac2db4", "sighting_of_ref": "indicator--939bd219-6ff2-4bda-bc8a-81ce52ccb13b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87b4a482-9086-44e3-826e-dd33271dbc2b", "sighting_of_ref": "indicator--526bb531-7148-42d9-8ac1-235fef12c1f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54755897-ff94-4bac-ae2a-730ef1798cd2", "sighting_of_ref": "indicator--89e146f6-570e-4017-8687-dccaf9128bdf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b278f452-6d01-4f5e-8d8a-07faf9579446", "sighting_of_ref": "indicator--89e146f6-570e-4017-8687-dccaf9128bdf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--188f1512-2fc0-48bd-bf8f-e4db11f335e1", "sighting_of_ref": "indicator--75c96cfb-63b9-49ef-b1e1-3173a8a69a62", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ccff8c6-0dac-4737-8793-abcfac367854", "sighting_of_ref": "indicator--b416eabd-e9b6-47fa-bbdd-7416c70aebde", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--744808fb-aa4d-491d-86b5-d7e91cc8a4a8", "sighting_of_ref": "indicator--b2e9e409-64bc-4a48-9a90-6f9411dd157b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16e13e1a-b67d-4558-856d-dbcf81944d47", "sighting_of_ref": "indicator--b2e9e409-64bc-4a48-9a90-6f9411dd157b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf13f6ed-6657-4ccb-abd2-c4e9e1ad7659", "sighting_of_ref": "indicator--702c5cda-9d68-4d1c-b79e-a4aa7f86167a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--981d9278-1853-4844-9236-271378ab896e", "sighting_of_ref": "indicator--d768016b-8b3d-48f1-a0f6-c093f384d42a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4aaaa5f8-0b36-43d4-b999-f2dcf93eb101", "sighting_of_ref": "indicator--d768016b-8b3d-48f1-a0f6-c093f384d42a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9e7ec28-14b5-431b-8e53-194f0dad8bfd", "sighting_of_ref": "indicator--1035a323-b120-42cf-b990-7c5c44388981", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28b64e2d-c988-4d14-a5ae-db5142ee32d0", "sighting_of_ref": "indicator--5996eeed-59c0-4c77-a1ee-ebe947c172e9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b76f5a8f-5588-476d-8577-eb0536441831", "sighting_of_ref": "indicator--5996eeed-59c0-4c77-a1ee-ebe947c172e9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc66c665-7e2c-4ccc-9769-a129d9caf8f5", "sighting_of_ref": "indicator--0e4eac8a-9fd8-46eb-9589-3c1df82d4267", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cd33db5-6a7c-458c-98ad-971e3692f962", "sighting_of_ref": "indicator--09d10b5e-61b3-42f2-8b96-323e6b475b6e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5eb33680-e777-467f-8b00-8a814c92d346", "sighting_of_ref": "indicator--09d10b5e-61b3-42f2-8b96-323e6b475b6e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddd44a19-c180-4de7-b7a3-5f3ffbbcccff", "sighting_of_ref": "indicator--1df7a0e6-4064-4f73-9060-ef13f67a4542", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9721e874-cd48-4309-a42a-6f54ad93d014", "sighting_of_ref": "indicator--1df7a0e6-4064-4f73-9060-ef13f67a4542", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6eb2d5de-f1ac-4442-aee2-2d8d635a168a", "sighting_of_ref": "indicator--21c830db-a2dc-4558-aa7e-12a8ecfd3eda", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84a9a075-e66b-4116-8d61-7500d79ffcd1", "sighting_of_ref": "indicator--7a800218-2127-4ebc-a549-0f639a9f0ec0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ea08ea8-705a-40b2-8196-994745f6fbe6", "sighting_of_ref": "indicator--7a800218-2127-4ebc-a549-0f639a9f0ec0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0ca8a5a-0ca7-4680-80f7-c08e317a8da4", "sighting_of_ref": "indicator--26d000ed-0ab8-42c8-8256-a90d4a97932b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ffa946f-4a9d-43f0-9041-251690272bfa", "sighting_of_ref": "indicator--e7c6f99c-8736-4e4d-9eba-3387ade6fcca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a89141b7-4b46-4283-9783-7b53e944d7d7", "sighting_of_ref": "indicator--71e6ca6e-2f62-499a-b5c7-209cb081cca2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f23af56-c6f6-41f5-969c-fc458550745f", "sighting_of_ref": "indicator--2d366b5c-931b-4e93-98e7-52dc256383e7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38d8b644-a0eb-4e2f-97d0-d8b035f8032e", "sighting_of_ref": "indicator--2d366b5c-931b-4e93-98e7-52dc256383e7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f280912-36f7-4a6f-b057-ab5201ae7c7f", "sighting_of_ref": "indicator--b046c180-ff4f-4971-b11b-a48a88cb3905", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--990e52f4-e224-482b-9e08-853c3cab8903", "sighting_of_ref": "indicator--63326449-c89b-458c-8705-81feb5cb3285", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40627649-01b8-4be4-8a35-f064aec1b026", "sighting_of_ref": "indicator--bb62efc9-ba79-4748-abaf-40950e4c31e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a4a2181-5fb2-4f43-a96d-b2a8703d34b8", "sighting_of_ref": "indicator--a720e408-91fc-425c-8015-7521ccc54048", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6235be8-b212-4613-8c61-df97043a0db2", "sighting_of_ref": "indicator--63817e86-4f58-4cab-b9b0-d652614a7793", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ec933b4-0f8b-4e98-9146-d64bde427d42", "sighting_of_ref": "indicator--45079d0f-a9fd-46bf-8963-223a659d739f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42731e2c-2732-4b94-b84c-e7f64bf8ea03", "sighting_of_ref": "indicator--45079d0f-a9fd-46bf-8963-223a659d739f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--299aa0c1-0e66-4d60-a7ef-687c9d630f6a", "sighting_of_ref": "indicator--a4d9fe5a-019b-471b-a105-d0863c544112", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ce184b0-45da-4f1c-812d-a868e47caeb2", "sighting_of_ref": "indicator--154e654f-2792-4ec0-9df5-92c08d46c0de", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60fb92b7-2a99-4acf-a295-4ef5de5dedb7", "sighting_of_ref": "indicator--4a1690d2-29c6-49b4-9b5e-af9ebacc919e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a5d6aee-3afa-4a65-b310-78aabb1627d4", "sighting_of_ref": "indicator--4a1690d2-29c6-49b4-9b5e-af9ebacc919e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ef8dbe9-3492-4870-a224-93450cee4257", "sighting_of_ref": "indicator--8390196d-5b0e-4ec6-951d-5348bcac03ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61ad5fd6-95ca-4e93-976d-9255678cffc9", "sighting_of_ref": "indicator--8390196d-5b0e-4ec6-951d-5348bcac03ca", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf7727ad-2c71-4bca-8398-384bad05fdcd", "sighting_of_ref": "indicator--7c588329-8d3c-4782-95a1-07bd696286bd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eed6dbb-daee-440d-905b-f653067eb788", "sighting_of_ref": "indicator--f4e9967a-ded6-4fdd-83fc-c3165fe99ee5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6435565-40df-4d6c-bbf6-f391e1890089", "sighting_of_ref": "indicator--f4e9967a-ded6-4fdd-83fc-c3165fe99ee5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4c1791f-f90c-4451-b6f1-70370473d317", "sighting_of_ref": "indicator--bff0c1da-68fa-4307-8381-8c58387ba093", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1599e093-74ed-4de9-ad2e-9e8bcd2a8759", "sighting_of_ref": "indicator--bff0c1da-68fa-4307-8381-8c58387ba093", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a630fd6-d796-4f1f-9071-8b27a9818268", "sighting_of_ref": "indicator--fc2a066c-894a-48c0-8025-75f1e875bdaf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--634841ce-e8a6-4ea9-88b4-abacd48bc49d", "sighting_of_ref": "indicator--16d1ff3e-842d-49e5-9a8f-29e9ae6eb86f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9362e71-5426-407b-9e10-2769ab0e7c5e", "sighting_of_ref": "indicator--16d1ff3e-842d-49e5-9a8f-29e9ae6eb86f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eef688fb-60eb-433d-8286-a71dcad45f77", "sighting_of_ref": "indicator--3b98b06b-b2d5-4c52-b5d8-24aea333ae6f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b25180ba-c097-469e-a03c-047bd9ea1c74", "sighting_of_ref": "indicator--955e4261-28ba-49e0-bfe8-e022ebafaf96", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e4ae0a0-56d9-470a-b881-6a428a6a7a64", "sighting_of_ref": "indicator--955e4261-28ba-49e0-bfe8-e022ebafaf96", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6214e7f-ecdb-4247-ae50-230dddb12d48", "sighting_of_ref": "indicator--9809e8c6-8a7e-4005-9122-ecf49d7e9f30", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b83b6fd-ceb4-4ace-968a-a0c159b30cd3", "sighting_of_ref": "indicator--9809e8c6-8a7e-4005-9122-ecf49d7e9f30", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b591a7fd-134d-43f5-86b0-c618c8470c2d", "sighting_of_ref": "indicator--41244daf-1fe6-4683-b704-184e4f36929e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c623227-8699-45e6-8e2f-7f71bb3e6751", "sighting_of_ref": "indicator--41244daf-1fe6-4683-b704-184e4f36929e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4c793ad-20b8-40d9-be5e-4be890c05b7a", "sighting_of_ref": "indicator--0767b441-5397-4b09-a38c-10c5b248109e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b3b5e25-dff5-4032-9def-75e337f64d5b", "sighting_of_ref": "indicator--f91360ee-fdc5-4d2f-b29b-6adee6d12333", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d397564-7d5b-4161-ad91-9375fab6fe28", "sighting_of_ref": "indicator--22661b1a-4bdc-4f9c-8af6-f607a837cd3d", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c38829e-fd17-43a5-9530-b5942a549fc9", "sighting_of_ref": "indicator--22661b1a-4bdc-4f9c-8af6-f607a837cd3d", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1e468ff-9642-4676-ac45-0aabf9c83837", "sighting_of_ref": "indicator--22661b1a-4bdc-4f9c-8af6-f607a837cd3d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db134652-f264-472c-8ff9-3b932152430c", "sighting_of_ref": "indicator--22661b1a-4bdc-4f9c-8af6-f607a837cd3d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cbf7a5c-6ef4-44b3-a113-3edec6c81161", "sighting_of_ref": "indicator--bbb03238-a4be-415c-9c7f-47c419ff6275", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62859f98-210d-474b-8707-50d941590471", "sighting_of_ref": "indicator--0ea2b565-0405-400d-a026-d55e4b7146e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ae36ebd-548a-4b27-988b-0e613f3cc683", "sighting_of_ref": "indicator--0ea2b565-0405-400d-a026-d55e4b7146e1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6762a0d3-5475-44bc-af8c-a05a8abb2916", "sighting_of_ref": "indicator--d1f7c519-8e0f-451a-add1-7ce74f9553a7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb609051-6972-4ea1-8825-bf3b2855c597", "sighting_of_ref": "indicator--2540e2f8-fdb5-4f67-b096-a9678fb9aa24", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e1d4bee-54f6-44c1-821d-3c67e424d594", "sighting_of_ref": "indicator--564ee783-dc95-450a-827c-ba146461b7f3", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42b320c1-2414-47db-ba1e-6bc8bca71132", "sighting_of_ref": "indicator--0497727c-c2bc-4a31-bacb-cfdf9f9a5658", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f2c53fa-5d9c-49d8-a828-8c8391dfe0e7", "sighting_of_ref": "indicator--f179f2cc-7e89-4498-9696-77b7becb76ae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d18302c3-2aaf-4723-8697-61b92dc9de18", "sighting_of_ref": "indicator--19cf3072-97ca-4ac9-bcc9-b0220a68d990", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb508d3b-e100-4300-ac70-5d63166da9e5", "sighting_of_ref": "indicator--2216e91d-8537-4ed1-802b-21b349b35db0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9219e78-5d8a-4758-9438-7ff91d66520e", "sighting_of_ref": "indicator--2216e91d-8537-4ed1-802b-21b349b35db0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--017d2f55-2e8f-4190-80f9-2255b5aede9f", "sighting_of_ref": "indicator--a80138aa-a9b6-4c0c-9acb-498ad1dcffe9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22bbbebf-7c32-4890-9f6a-14ad66e6a404", "sighting_of_ref": "indicator--61e8fdbe-9ca6-4da9-97c1-4162dd841e0c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dddbbef-35e9-4631-a1a7-e470dd223e83", "sighting_of_ref": "indicator--ea101671-b716-4d63-8fd3-22dbaad4135e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70cc90c7-642a-41d3-9fef-0be1fa101acc", "sighting_of_ref": "indicator--92c9933b-d8d7-4492-b07b-7b162f9f8e9a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0142ef9a-6694-4aef-a9db-53a2efdef171", "sighting_of_ref": "indicator--d50076fb-ed06-48d0-a38d-a041ee2bd975", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5ebbf78-88c8-4612-b5d3-9f698d3b2245", "sighting_of_ref": "indicator--ff5537cf-1ce1-40e7-98d4-12b3ea0df1eb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce4e178d-69b5-4908-b267-28dd271b76d7", "sighting_of_ref": "indicator--ff5537cf-1ce1-40e7-98d4-12b3ea0df1eb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e97b0e77-9c11-4a40-99af-8dcec0b5c252", "sighting_of_ref": "indicator--4f1ba8ce-da09-4def-8fc1-6fd2c156aa66", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51606d1b-8dae-4963-b474-8deecb5468ab", "sighting_of_ref": "indicator--a6ce62dc-370c-4acd-bbc7-5fec5450a736", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--606ef38b-3793-4aca-bb80-f57e02a49a7f", "sighting_of_ref": "indicator--a6ce62dc-370c-4acd-bbc7-5fec5450a736", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4636a30b-3b4e-4a10-86d2-1c73010d636e", "sighting_of_ref": "indicator--decef7ef-3a26-4543-b8f8-0acc579728a0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e01b0012-bfc0-43ee-9807-8160f831092b", "sighting_of_ref": "indicator--decef7ef-3a26-4543-b8f8-0acc579728a0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaa5dc9a-4f30-4892-8330-22d97e1ed592", "sighting_of_ref": "indicator--70419fd6-2837-4643-9682-36e8d913cf52", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14532e46-9d68-448a-9839-4f27a4ef1776", "sighting_of_ref": "indicator--c84bc280-508f-4c13-a0ff-43fbfd18fc99", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39d727de-028b-4b7d-bccb-56eb0f17455e", "sighting_of_ref": "indicator--5101cf20-1cd9-43d8-9a27-515afcfcb6c4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6710f483-5346-4c6b-b7a6-2d308d7bcd75", "sighting_of_ref": "indicator--5a905962-6a40-47de-bd01-c8fdb0bc4094", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9254ec1-d402-444d-b16c-c67df593c62c", "sighting_of_ref": "indicator--fd237ab6-215d-4309-825c-9d2bf163d1a6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffe4223a-8ea9-4cbb-a419-8fe3a2176aa9", "sighting_of_ref": "indicator--43b96c99-10ac-4495-a82f-b6a96f0a1caf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--645bf515-7e51-48fe-9ca4-e9c51217b0fb", "sighting_of_ref": "indicator--80f69d3d-5df5-49a3-88cf-c4f8b7f79da9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4767f4d8-5132-44b2-bafd-50cf0a70ca8e", "sighting_of_ref": "indicator--8a895ec6-60f9-4df4-abe2-ed747d110876", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--058ba47c-2465-4af5-b795-d21d5decc1d1", "sighting_of_ref": "indicator--8a895ec6-60f9-4df4-abe2-ed747d110876", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--359544e4-3309-4644-b83b-f3b629a72e9a", "sighting_of_ref": "indicator--3f4d450c-c8af-4885-9fa0-cedf8d56c158", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--524559d9-f485-41c7-bb57-6b6c93a64180", "sighting_of_ref": "indicator--4316c64d-ca02-46c4-bf88-cc8362f616f3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1c2323d-b0fc-4433-b10f-414b9f7be0a1", "sighting_of_ref": "indicator--81b27a86-44fe-4bfc-bf56-03621e6fb9dc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1776bb36-2826-4fbc-b0e3-80e0ca3858bd", "sighting_of_ref": "indicator--464983ed-4422-4220-99f7-1642a59d15be", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--331db6c5-50c7-45d5-bff8-4766d8d6b15f", "sighting_of_ref": "indicator--ef9b3ae6-efa3-4b9e-9e57-f9dcd8b3372c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c92c056a-b00a-4189-b30b-18472834dc07", "sighting_of_ref": "indicator--6728e520-2813-49d2-9147-6e4ad075abb3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a7e38a5-a2a1-4d43-a63d-78db61e473a6", "sighting_of_ref": "indicator--611cc143-e2af-4729-8dd0-52922d4e34cd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe7c6864-ead1-42b1-97f1-beab10eb6ee2", "sighting_of_ref": "indicator--0cf766f6-57c6-48ba-94c9-1df7d6e1922f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47158001-6444-4b58-a512-eb0351cae719", "sighting_of_ref": "indicator--ad1a3f99-2adb-4dae-8943-cb454243d639", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0202b0d-e4b7-43f8-80d4-40b64df10b49", "sighting_of_ref": "indicator--b3045ae5-96eb-4a25-9d8b-626bd69007ad", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--313c229f-ecfd-4b64-a4c2-153409744cc4", "sighting_of_ref": "indicator--b3045ae5-96eb-4a25-9d8b-626bd69007ad", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e63ec524-5b96-426a-a1f5-72c153894160", "sighting_of_ref": "indicator--b4d9b56e-24ab-4ab2-84ed-4c8ac6cf7bd1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b0cedbd-3c44-4872-8ace-f3e723db595f", "sighting_of_ref": "indicator--797e7f35-0c0c-43c8-b894-43140a06ced4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8687dcd4-b26b-4d4c-b0f6-80186b69ecc1", "sighting_of_ref": "indicator--797e7f35-0c0c-43c8-b894-43140a06ced4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e130f6a4-327d-4234-b3b4-d1802d3cf90f", "sighting_of_ref": "indicator--93533b4b-be44-4611-93da-4d2c823c175e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--490ba130-5844-4ebb-be35-c3ae216eba3b", "sighting_of_ref": "indicator--93533b4b-be44-4611-93da-4d2c823c175e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ab72a2a-1337-4da9-a0dd-708b2598fefc", "sighting_of_ref": "indicator--4bcada27-b7e4-47e6-b2db-8d50dacb58ff", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65fd83ef-ac5e-4f91-aec3-25e6b7f2df99", "sighting_of_ref": "indicator--e5637f9a-853e-456f-a9c1-24146f2e4004", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9485c653-f433-4fbd-99e6-cddc38461daa", "sighting_of_ref": "indicator--e5637f9a-853e-456f-a9c1-24146f2e4004", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c431fbc-1a32-4b56-8802-392800a11034", "sighting_of_ref": "indicator--233e7e51-d419-42a6-a248-aa0c05a095f2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b054f130-a523-48ef-9cf3-177e118ebb6f", "sighting_of_ref": "indicator--dc4ecca0-358e-4548-8eb7-3425c8476ddd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8f994ba-890e-4c4a-9b93-5198b8f596ec", "sighting_of_ref": "indicator--7d3237b2-7730-4171-b5d8-272d447d934b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3594764-a324-4589-9d55-e5b39a42bfa2", "sighting_of_ref": "indicator--0b0a1b10-43fd-4b09-b538-d2597563f99d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--682eec33-0132-43cb-be5b-299b4005c259", "sighting_of_ref": "indicator--0b0a1b10-43fd-4b09-b538-d2597563f99d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03e22b1d-9957-41e9-8e61-efe56d303fbe", "sighting_of_ref": "indicator--428866b7-94fa-4339-b21f-2a408d1b1d13", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c525c00-4dc6-4bcb-b14d-2a14fac6053c", "sighting_of_ref": "indicator--2f0cc852-d050-4480-80ce-87cd733f53db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb7413d8-9b23-4e31-b11b-9ec195c41810", "sighting_of_ref": "indicator--55bae2c8-fd1e-44b6-9386-933ef227d635", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b260b194-9d3e-48e2-aaa2-286c602ef816", "sighting_of_ref": "indicator--55bae2c8-fd1e-44b6-9386-933ef227d635", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ba2b018-ad18-404d-8583-bcde905767ba", "sighting_of_ref": "indicator--c762e323-a386-4fae-8a45-0d2b84735648", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e9e4196-a18d-4ffd-b30c-3175fc0fdbc5", "sighting_of_ref": "indicator--bba94118-69ca-4e9a-9b90-24036f42b841", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63313b62-d685-4d59-bdda-9fb80dbba246", "sighting_of_ref": "indicator--5365a56c-1438-4c88-8c13-bdcc204e2cc0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--204ba4f7-0ecd-401d-8460-ad2ddec4232a", "sighting_of_ref": "indicator--5365a56c-1438-4c88-8c13-bdcc204e2cc0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e770aa53-71c5-46e2-bd06-cf516cea4226", "sighting_of_ref": "indicator--ec766c82-01e0-4e42-9a04-a639e69f4b40", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--032a04e8-d80a-46a0-bb28-432efba612c0", "sighting_of_ref": "indicator--1b498897-d549-4c6f-8033-443e4d757d94", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f49d5a3d-417f-4ddf-ba18-4a6743ee8523", "sighting_of_ref": "indicator--0d626607-2ded-4467-a849-6c9ea4116500", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbef2f07-dfd0-431f-9d09-2b314310fd2d", "sighting_of_ref": "indicator--cfc246d3-5651-40c4-968b-556b686a642b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d76e441-a785-4cfc-8296-9a153e3dc402", "sighting_of_ref": "indicator--d6cc3829-9cdf-4b0c-ba39-15d51a858691", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3371ff0b-6750-4bd6-a922-1ab7b94f0f82", "sighting_of_ref": "indicator--5e51889c-b0bb-4762-9141-dabb836bdba8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0789e852-c0e7-49ee-85ed-0b6aee772c33", "sighting_of_ref": "indicator--903a73f4-baf8-47c6-b387-a9d8bf7bd58b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61d340ef-6460-4d0f-b8b2-2c29d264c622", "sighting_of_ref": "indicator--5fda1562-384f-4867-a0bd-049db6cefb5b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a82c463e-f771-4b80-9fb9-49c2dd4a99e5", "sighting_of_ref": "indicator--4172cdfa-67c2-40a5-936b-97c3cd9b9fc1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--512252cc-92cc-465b-88a9-579bf8f0f941", "sighting_of_ref": "indicator--4172cdfa-67c2-40a5-936b-97c3cd9b9fc1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f125dba3-77fc-4c2c-8c65-b58ddc807390", "sighting_of_ref": "indicator--dc5f4609-b04c-405e-b301-c564d82a3d62", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--485cea7d-a9bc-4130-af00-10c3f7ea9cfa", "sighting_of_ref": "indicator--011dc356-744a-42ec-9fa4-2a8d116a3379", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c2a41c3-7540-4c47-bb6e-35232363ff71", "sighting_of_ref": "indicator--59b0bb3f-b412-4a41-9f1b-07694b44e80c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ae0878a-1f6f-4ef6-9359-0ba678452261", "sighting_of_ref": "indicator--4766b282-158d-4952-9cf5-570dd37f93f5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c35c8623-adf8-4bcf-8010-4faf13fbf5e8", "sighting_of_ref": "indicator--473c6f9d-7e6b-4660-a5ff-7b03ac49c1ab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88087daa-9ba2-48b1-a09b-b7f27dda690a", "sighting_of_ref": "indicator--1fc72986-9ff0-42c4-85a5-2a0f65ff91e9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--795333a3-ee0d-4dcf-affd-7dbe80e5e728", "sighting_of_ref": "indicator--a76213d5-a05d-467f-9cd9-2c36400c7110", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--475d453f-4621-4a05-935a-1537fee6c85f", "sighting_of_ref": "indicator--a76213d5-a05d-467f-9cd9-2c36400c7110", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6a68817-d68c-4109-a21d-80d1805e1c38", "sighting_of_ref": "indicator--883470c6-c12c-4d43-af71-8d89c680d7eb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d67096f-936d-4d7b-bdd1-c9eada333ace", "sighting_of_ref": "indicator--d7e7dce7-bdc5-4ba0-adf5-cd068ffb0e71", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b71a435-b786-4d5e-acb9-a216bf3aadcb", "sighting_of_ref": "indicator--5c6ee274-7fff-432c-b3f6-feb8d70852a7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3eb19d13-c1dc-40db-a27d-186e5fc20320", "sighting_of_ref": "indicator--5c6ee274-7fff-432c-b3f6-feb8d70852a7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22442264-c3cc-49cb-8f5c-2488547fa865", "sighting_of_ref": "indicator--47cc6186-3449-4f08-9e59-73b050263665", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a99f119-8eae-4f4b-9c3c-f96de6f1e675", "sighting_of_ref": "indicator--47cc6186-3449-4f08-9e59-73b050263665", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2012211f-8bf4-4e7a-b4c4-af2e0cb80c13", "sighting_of_ref": "indicator--6ee5cb6a-26fd-4187-ab60-2d4605f1b966", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24f29bfc-7bb7-4a5d-bb40-ee0365d4f106", "sighting_of_ref": "indicator--6ee5cb6a-26fd-4187-ab60-2d4605f1b966", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef3ac0c8-ce14-4ad1-84ef-f83f2bd54662", "sighting_of_ref": "indicator--8ef09e91-f349-46c1-8494-871cb3cfec6e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b11eb18b-e440-4a6d-88f3-fd2fd5ce9d91", "sighting_of_ref": "indicator--9eff9c61-2298-4e33-90f3-d234dd54e142", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--728ece83-0c43-41fd-8c48-0729297726bc", "sighting_of_ref": "indicator--9eff9c61-2298-4e33-90f3-d234dd54e142", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfa1e35d-9e58-4919-a10b-78035586fb12", "sighting_of_ref": "indicator--defd1d03-9674-412d-9eef-3cf6a325d00e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3f6295a-2560-46fa-a9c4-d3188398b784", "sighting_of_ref": "indicator--1c0afbf0-5899-428c-b524-e3febbbaa9e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f777326-0b16-46bb-81ef-1c85edf737cd", "sighting_of_ref": "indicator--699f485a-0349-4493-a7ae-381badc89068", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56cc9921-7cf5-4770-b0f3-c61e018d9b89", "sighting_of_ref": "indicator--699f485a-0349-4493-a7ae-381badc89068", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db2237d8-d3f1-44e6-8450-1235022ee39b", "sighting_of_ref": "indicator--7691b928-da7f-4132-ae6b-c7bb0ac6d53c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20a8d350-0f13-4f1c-b447-04eec36aea8c", "sighting_of_ref": "indicator--92f40fe6-4066-444d-9f62-a2e0655cdceb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--408626b7-4dd0-41f3-a4f8-371d2a6215e5", "sighting_of_ref": "indicator--92f40fe6-4066-444d-9f62-a2e0655cdceb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87fcb26c-8816-4915-adaa-a274c06173e5", "sighting_of_ref": "indicator--be6d1942-823c-46cd-9c59-e2a003732bc7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b10d3f5b-bee9-4202-988c-05681552edaa", "sighting_of_ref": "indicator--79aa6f3c-3f13-4af5-b5c3-1be3f3a1e0ca", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd9c3992-ec18-4b69-ad82-01c2dd9db407", "sighting_of_ref": "indicator--0fd02e2f-295e-495f-9e25-67206ce15601", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb21e141-e9f5-405c-b680-4dc308226bc5", "sighting_of_ref": "indicator--890ced2c-60c4-45d2-a862-b6efbda288f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33868745-0a61-41a9-835b-9f3b563f8802", "sighting_of_ref": "indicator--5501a012-6f4b-42f1-bdfd-4beeca0b271d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78a4dc47-9b49-4368-bb78-e4b69e3b9ef6", "sighting_of_ref": "indicator--9c75707e-fa83-4265-9e84-c375cf713e61", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4182005-70d8-46c8-b8fc-0f636b41e107", "sighting_of_ref": "indicator--6f102e41-ce43-4025-9601-5c21e60f704f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b53d314c-421c-4c95-8ecd-510788ffb5eb", "sighting_of_ref": "indicator--f74fc19c-22dc-4b98-b561-600ea1cafaf6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebb21a46-964f-42bd-9044-9baa2591c51f", "sighting_of_ref": "indicator--f116c9e8-a1da-4e02-b840-1637f4d493ba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50bb4111-0dfc-49c0-9252-bd9c00ffd053", "sighting_of_ref": "indicator--968c9da3-6832-4766-8fa9-a21fd796275d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cd228df-258a-464f-b821-4a0f698d1aee", "sighting_of_ref": "indicator--1348a83f-bef7-498a-88da-9ca16e08239f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35a51381-de8b-45ca-ac1d-6c101dd1ab5e", "sighting_of_ref": "indicator--6de26366-626e-48cc-8d27-8fbd80cb4a53", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11014287-9560-46e2-8dd0-920d8881ddb6", "sighting_of_ref": "indicator--7718b56b-7c58-4d33-ae9c-a69ac1db5f11", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1094c708-4fa3-4281-85ef-afab03984d5a", "sighting_of_ref": "indicator--106f8d64-3242-47d1-9541-af727ff793bf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64ff0efc-a323-41a5-b429-fd0014aea2e2", "sighting_of_ref": "indicator--106f8d64-3242-47d1-9541-af727ff793bf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaafb744-b1a3-4255-b5e2-fa3929d248af", "sighting_of_ref": "indicator--9f7d2738-24ef-40a1-85b5-48c7d5d50655", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03f2b79d-c492-448b-9032-ec23b5f9bfaa", "sighting_of_ref": "indicator--9f7d2738-24ef-40a1-85b5-48c7d5d50655", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cfbc596-bee1-46f1-a2ae-12b83f61dbe9", "sighting_of_ref": "indicator--e785c6da-5a25-4f3f-87f0-2421a6d30c8a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1769a7b8-3821-4edb-9b31-6e22a08b0675", "sighting_of_ref": "indicator--e785c6da-5a25-4f3f-87f0-2421a6d30c8a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e65fcf91-a1db-46b9-aad4-2e8cf1507278", "sighting_of_ref": "indicator--6a3cf878-33a2-496b-a206-f0669df9a3a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b918260-314c-4862-a05d-4926cecb92f8", "sighting_of_ref": "indicator--6a3cf878-33a2-496b-a206-f0669df9a3a5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4615f9d9-9122-4910-93ca-cf57a8707be9", "sighting_of_ref": "indicator--e806b2da-f5b2-4015-afb3-855964643707", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc4e2cab-c9ce-47bd-bd8c-57e8772f3c71", "sighting_of_ref": "indicator--e806b2da-f5b2-4015-afb3-855964643707", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--309fafdf-cff3-48d5-8dcc-9f11ddc816ba", "sighting_of_ref": "indicator--d49aac98-b0f4-4050-bb4a-92f3a3821c40", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8eced7f1-5bb3-47d8-8baf-19a832fabfcc", "sighting_of_ref": "indicator--d49aac98-b0f4-4050-bb4a-92f3a3821c40", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--503bad97-a8e1-4627-a6ed-a13455cf3d08", "sighting_of_ref": "indicator--0a1a6891-1da7-4aaf-9180-714b999682d5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20c0a340-e699-4a7e-b559-68ad7c1a4739", "sighting_of_ref": "indicator--7aabea9a-a4e0-47a2-b630-1bbab8fd010e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1cd7cff-aaaa-4574-b52e-e7559ea2c7d4", "sighting_of_ref": "indicator--45ebbe37-d005-47b9-a42d-e717dfd3b344", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1222ff4d-6eb3-46ba-83bc-fdf57f1b3f12", "sighting_of_ref": "indicator--d2c732a5-4147-4a6f-900a-fbb8a21660ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9720ae46-ad2d-4c1c-a65e-49be99402280", "sighting_of_ref": "indicator--9296bd59-a150-4712-a366-82ecfa383ff1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e436359c-35ba-45cf-ae9c-528397d28e34", "sighting_of_ref": "indicator--9b6189c9-25e6-41b8-8bd6-c83628d3a691", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48783e1c-29f0-46d8-a2ec-de582b0d4ce8", "sighting_of_ref": "indicator--b4ae1a7b-db9b-46ee-acc3-60b130fc75c6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33c07e74-65dc-4a55-821f-0cfbfbd77622", "sighting_of_ref": "indicator--e0a83924-4a1f-4162-b446-941b889b2585", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51d37804-94e7-48f8-9fb0-753302875ac8", "sighting_of_ref": "indicator--9c7c1152-a3f8-41e0-91b8-74b4c20aac9b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ca26b63-268e-41ad-92fd-96808eee0516", "sighting_of_ref": "indicator--9c7c1152-a3f8-41e0-91b8-74b4c20aac9b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a33ca11-8918-4ae7-85f2-97593cb77507", "sighting_of_ref": "indicator--dfabf4ce-ed21-4330-a90e-4b12a69be408", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12a6ab72-8f31-451d-b03c-0f6f917bedcb", "sighting_of_ref": "indicator--dfabf4ce-ed21-4330-a90e-4b12a69be408", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24980091-e3ea-478b-8069-c12c9d1812ca", "sighting_of_ref": "indicator--a5bdfff9-46a9-49f3-97e2-ae7cda5a6915", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7a89bb8-8cac-4322-a804-d612befc5116", "sighting_of_ref": "indicator--66240fdb-d70a-43dd-b127-7910ce731375", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf5afee4-344f-4df8-9f15-477d937f27d2", "sighting_of_ref": "indicator--ee9eaa93-4782-4851-955f-7097a6725281", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8c521df-91f8-4bc6-9bbe-0495da91926b", "sighting_of_ref": "indicator--ee9eaa93-4782-4851-955f-7097a6725281", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4cb8e50-61bb-497b-b66c-8e6fd8655032", "sighting_of_ref": "indicator--12b09207-2093-441d-b9fa-7d2283606ad7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95f660c6-2dbb-4ca8-a899-1102006eb089", "sighting_of_ref": "indicator--05d9313a-f807-41ca-bbd2-ba0a572016a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39b16b7b-1bb5-41f0-806d-0203c718032b", "sighting_of_ref": "indicator--8ba14a6a-b6ae-4132-a81a-a1ea511ffa0e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--498545bb-68c2-4268-965f-73274f9815c0", "sighting_of_ref": "indicator--298c093d-c978-4751-ba55-815e53d83804", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97555a09-d9fc-4787-97fd-0043521aa27e", "sighting_of_ref": "indicator--e949eed8-c05c-469f-a6b2-73c2a407e645", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80b2544b-7a0b-444c-8e47-ea25820de448", "sighting_of_ref": "indicator--bcbba2a3-fa83-4960-b375-ce1810e2b27f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3593e75c-a470-4daa-bc5f-11364a44221a", "sighting_of_ref": "indicator--b255fe88-41c3-4e4b-92b6-a9c4671e82d7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cdeecda-d2ec-4624-8d38-e8365e438afe", "sighting_of_ref": "indicator--b255fe88-41c3-4e4b-92b6-a9c4671e82d7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71dfce65-f233-4d8a-81b1-9c36b0dd58be", "sighting_of_ref": "indicator--cc9b3e21-57f1-45f7-bc5f-46f62bca3717", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfcb19fd-4f66-4ede-a2d4-829e4d97768a", "sighting_of_ref": "indicator--12bd6d4a-b32b-4e02-b4f8-c6031fc1c66d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df79088c-7c6e-4a45-9a49-d8a83813beec", "sighting_of_ref": "indicator--040d1f32-2de0-4147-99c3-6e848e93b54c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96615aeb-182c-4608-97b2-b5f229cfe2f0", "sighting_of_ref": "indicator--aa2469b4-9886-4e35-8e9b-ba00699cc65a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d519500-73e9-4d9b-839e-7dd5340efb0a", "sighting_of_ref": "indicator--fc33904b-674a-45fc-a507-e30649bc0ac4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3acbd01a-7ae5-4f01-a255-74cb796e501a", "sighting_of_ref": "indicator--e37a8aaf-baab-4b4d-8eb2-94be5a9034a4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--772dd09f-72b2-4769-91ce-993f56c11dfa", "sighting_of_ref": "indicator--0b525c35-8e32-4aa7-8615-e42c6884036d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5446deb-53cd-45a1-b355-7e67de4f9aee", "sighting_of_ref": "indicator--4dbdc0ad-8089-4fe9-8925-c3e9ddf1bcd4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e7849c1-fc15-4fed-910b-54cfa02d657c", "sighting_of_ref": "indicator--5154631b-c820-4772-8e14-7ae81ecbc2db", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0de559f-f6c8-45ee-b650-786ee54a0f13", "sighting_of_ref": "indicator--cd986b8d-0df0-49d7-8939-0b7cdb78587b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa8c7e94-31a5-4c4e-9f63-33588036e2ff", "sighting_of_ref": "indicator--1649ed59-1ccf-4dec-819b-16dd48059474", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0ed44cd-392a-45bc-92eb-aa7f32b80bdf", "sighting_of_ref": "indicator--9076cb31-5a19-4ec3-b394-3a3e8c618755", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7eb4033-7e9e-4d1f-b21f-7a06194f8a11", "sighting_of_ref": "indicator--c9c6de1c-3c05-406e-8721-02e6af9205d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c11d6fa-9e9f-4aba-87f9-752851a8a039", "sighting_of_ref": "indicator--b6e002d0-6989-4192-ae27-3f4119e82368", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bf47603-f6d3-4a6d-9e65-705cdef9ee3c", "sighting_of_ref": "indicator--b3468bc1-049f-4c6c-9276-fdeae24cfae7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c2d28f3-1fc4-4c49-a326-c8de54d05d85", "sighting_of_ref": "indicator--79521110-b395-4c57-bb36-f0446f139e56", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5d3c03d-2bdb-4026-81d6-b30b17fcbac4", "sighting_of_ref": "indicator--fc5ce5d4-ebf0-4190-a0de-8d5d4cbd821d", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b35be49a-8d30-4a55-a630-50a571cad90e", "sighting_of_ref": "indicator--402de88f-f261-4231-a7a6-daab7b51625e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bc48bd4-91d9-4323-8799-e362f08f6fe6", "sighting_of_ref": "indicator--b9bfeb9d-ba74-4a4d-98cc-5241964cbc2f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d29f388-5406-41b5-96ce-942a20d50d40", "sighting_of_ref": "indicator--b9bfeb9d-ba74-4a4d-98cc-5241964cbc2f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b0c5430-dc31-4555-9508-c54d2ae3ff8d", "sighting_of_ref": "indicator--4e26ad72-153b-4ec2-b964-a6b8d28d2912", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3cb6664-0f91-46e7-8e4c-4be9b81aa9d0", "sighting_of_ref": "indicator--f92673bb-4bc3-4de2-b3aa-fb42cf716f5a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f87ca1f-b86c-4859-94f0-dde6244bfbd2", "sighting_of_ref": "indicator--f9a7bfd0-48dd-4b4f-900b-d19eba50475b", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--068db310-66bd-44d5-ae18-4854009c1002", "sighting_of_ref": "indicator--cf47ce08-2ec9-4cd2-8271-7c50ef015ff6", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ee3d0cc-875c-43c6-b611-eff11589c9d4", "sighting_of_ref": "indicator--35e8f5fa-7113-48a9-ae24-29ab06300cb3", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e9eb41a-6995-4bb5-9724-5b94b7c3a485", "sighting_of_ref": "indicator--0b382551-2607-425b-9fbc-c5e939a5dc66", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc64a0b4-4c59-4487-8ffa-2d7b0dcc48ea", "sighting_of_ref": "indicator--fe254817-73c5-4391-9da1-ac7e63eef4c9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1094208-7773-4eb6-9871-a555baf46e3e", "sighting_of_ref": "indicator--dfff1526-4e7b-434a-81ad-6cedf3fb1cbc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cef3c57-8201-4b9b-8a72-4c555f42f439", "sighting_of_ref": "indicator--13a1de9a-17a9-4a04-84e6-d5cc1c331c1f", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cf331fe-beae-4b97-9a5e-a203521164e5", "sighting_of_ref": "indicator--956d843c-28de-454f-8e2f-9460322241da", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de0d9dc0-f398-4862-8686-beb04e271e91", "sighting_of_ref": "indicator--956d843c-28de-454f-8e2f-9460322241da", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7291c67e-e204-41f5-910f-864dbb3c3d92", "sighting_of_ref": "indicator--878a8be4-dec3-4872-be73-ac46a327ce4c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84daa7b3-c395-4670-9daa-27c0438aed9b", "sighting_of_ref": "indicator--6663cfd9-450e-4c98-bb11-caef8e908f90", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1b03d62-a86e-4c16-aa13-df4f65184995", "sighting_of_ref": "indicator--c8beaee9-fae9-45e2-bf55-51f433e4c694", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1835c185-e975-46f1-a555-99d877fa1f0b", "sighting_of_ref": "indicator--de1dd6a7-9442-48bf-bb76-5cac5c7d034d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c301aee-6a9c-483f-8a27-94482f3915d7", "sighting_of_ref": "indicator--7003dab1-7311-4263-aa03-369dffc37d06", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98e5eecd-1d2b-44f0-96b0-0184b86dd763", "sighting_of_ref": "indicator--5a442d3a-eced-488b-b245-9618b0571a81", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23d125f7-f536-431b-8634-d704b67cc024", "sighting_of_ref": "indicator--5a3c9733-54de-489d-b434-e9c19115a12f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6f38776-de7c-4e37-a41e-4004c097f3a5", "sighting_of_ref": "indicator--20112dbc-9f78-4d37-bb52-7d42a63a7873", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--800875d5-8af5-49bb-b1e8-9f2bf1ea836c", "sighting_of_ref": "indicator--20112dbc-9f78-4d37-bb52-7d42a63a7873", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e118bc66-b987-4e1b-ab4a-8e5a6456cbba", "sighting_of_ref": "indicator--73de7dee-c4f5-47eb-81ac-1c84e7d28ef4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a9c57e4-800c-4ff0-bfb2-894797a683ed", "sighting_of_ref": "indicator--0309f566-200c-46fe-9c71-1612d54f8b2c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--172dc499-dc2b-42f2-b5bd-90e467a24a14", "sighting_of_ref": "indicator--c07f7ce9-7b69-4bc9-9af3-0f1b5866c33f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cc77438-5eca-4804-80dc-0c5448f2c2ca", "sighting_of_ref": "indicator--bb97ee57-dd18-4241-85dc-9b7105897ba8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd7ecef1-4639-4e58-b74a-412072841d2a", "sighting_of_ref": "indicator--7c216826-eabd-4570-925b-a33bc6dfa95d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--728a5db2-7ea2-4989-89de-774faf7f70ad", "sighting_of_ref": "indicator--ba0f3ed6-235f-40b6-8663-2838b0326cd1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b0c1824-3d1f-4843-9ec0-1290b1369583", "sighting_of_ref": "indicator--889e6c64-6c2d-4cff-8afe-6c42079f8537", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9578d333-5747-46a0-af2f-f4101284c4b9", "sighting_of_ref": "indicator--edc79aa4-2420-4241-a57d-f9dff6012029", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d5c7bee-e3b4-4a43-8ebc-394cf12ea1ef", "sighting_of_ref": "indicator--8b1a46ff-41e7-4142-90c6-d99d6f1ca51f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62a3406a-94c8-435a-99f8-9424cb44f5e5", "sighting_of_ref": "indicator--8b1a46ff-41e7-4142-90c6-d99d6f1ca51f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae48012e-582c-41a8-95ce-53a2133f2718", "sighting_of_ref": "indicator--78ed15e1-e867-4e63-82c9-809a92a4373e", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d2f9b08-cf52-4efb-89ea-a7ffe3ea87a1", "sighting_of_ref": "indicator--85e621b6-de18-4781-8426-477647109173", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d7d10a3-fb26-4f59-a06d-c848ca7d5d7c", "sighting_of_ref": "indicator--811c0eca-0fae-4931-b218-61f3df71685b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a58f89f1-7f84-4afb-b55d-d7ff61cfa83f", "sighting_of_ref": "indicator--4eca9439-6252-4e85-8ef7-3813d9c476ac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e122eccf-a6a2-4b8b-b393-22ab40f8e5af", "sighting_of_ref": "indicator--4eca9439-6252-4e85-8ef7-3813d9c476ac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a65e15ed-92e9-4b23-946c-a7cc3077a3de", "sighting_of_ref": "indicator--a00c5de0-b785-4412-8ba8-6f72b34b7e4b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80b1c4d0-958f-41b9-9dfa-3255404ded5a", "sighting_of_ref": "indicator--a00c5de0-b785-4412-8ba8-6f72b34b7e4b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--588d3735-bf90-4d90-9f91-8577b26f07a0", "sighting_of_ref": "indicator--61f483a5-c0af-4898-9d89-67b5466baaa2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e776ece-6e11-4f2e-84e8-cabc3b5af73e", "sighting_of_ref": "indicator--0b201a9d-258c-4ff4-a4d1-4e7f68790f64", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca0fd71b-b5ca-41a1-9ac7-b056d0d814f0", "sighting_of_ref": "indicator--8f6152c8-3aeb-46e0-8e2a-2a0540c9960b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a713dd9-8fc5-4fa1-8ee5-368d34acc3f1", "sighting_of_ref": "indicator--8f6152c8-3aeb-46e0-8e2a-2a0540c9960b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f47e47af-516b-4c04-9eac-8ccb1dde8a23", "sighting_of_ref": "indicator--1803141f-2af0-428b-b6f8-004c75198d59", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c91cf41b-c9cb-437a-9f61-fbcc14911e0f", "sighting_of_ref": "indicator--09a16053-231a-4c0c-afcf-8b837348f612", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00640c21-7be6-49cd-a4d1-b504077d0f62", "sighting_of_ref": "indicator--e90958f2-9ad5-4c7f-83b7-899014f0365a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--413bc73a-1e60-4f47-a3f8-9568b832779d", "sighting_of_ref": "indicator--21b3e2ed-a899-4c75-a112-e814e2b62e21", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c82abb08-10da-4ac4-862b-5491cfb0ee63", "sighting_of_ref": "indicator--21b3e2ed-a899-4c75-a112-e814e2b62e21", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44a928b0-6c28-4ef2-8950-0e8b6ea979f8", "sighting_of_ref": "indicator--6d6a8d42-7cf2-4d06-8696-67fc64969e28", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7903cf96-f0df-41bd-9249-fbeef2e8967f", "sighting_of_ref": "indicator--83030801-c650-446e-a82a-be43a051ac35", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4abb78f0-fad2-4108-94e4-ef0b5831827b", "sighting_of_ref": "indicator--8d85c101-e170-464a-a695-2834c61c6b38", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b92bc947-fbc0-49ea-926a-59bba6e7274a", "sighting_of_ref": "indicator--098dfe90-642e-43b9-96b0-5c0a1e66e68f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84fbea93-5615-41c8-b3b0-7e4b8ce3d8f1", "sighting_of_ref": "indicator--631bb065-d81f-45e8-ae98-55d903dec9f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0b04615-2d68-4c67-853b-fde1b1d14566", "sighting_of_ref": "indicator--e1678ee6-017e-4bb8-805a-fc9e2e0b9d61", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51f28013-28d6-4d7f-b53f-b6d7eba5de26", "sighting_of_ref": "indicator--d6b71ea6-601d-40fd-9db4-644e0807f406", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eab2650b-228d-456b-8152-7354df0b36a0", "sighting_of_ref": "indicator--b2cdbbb6-a49c-470d-8e02-2269945d4fff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c746d62d-af86-4f54-a552-8b584437ab00", "sighting_of_ref": "indicator--564f58fa-f07c-46a4-8cbb-36cab58f9160", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce18d54c-4adf-473a-a1dc-065f2439b2b1", "sighting_of_ref": "indicator--884feea5-7b54-422f-965f-e35423b3d12d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67c2c574-2d7c-415d-832f-cc5145e595cf", "sighting_of_ref": "indicator--ddc3d218-bfbc-4b8a-9f0a-e7d2e87388ce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06c62560-3eec-47f3-abfa-bfd2e009a807", "sighting_of_ref": "indicator--aa0eff1e-471a-41dd-bfc4-59332bc2450d", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3490b50-e098-4e4b-9bd5-cd2546646d19", "sighting_of_ref": "indicator--7748c6b7-b26f-42c3-a632-639c91875769", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67a67966-f24e-4058-ab6a-fd15c9ee943a", "sighting_of_ref": "indicator--7faea370-c44e-41f2-8236-1aeb5a17f56d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aefc11c-7521-4068-b1d6-5c22a0335a92", "sighting_of_ref": "indicator--03d22bad-eb99-42df-8607-b0f86870b39c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6967d078-3d23-427b-9aab-38be9f0369fc", "sighting_of_ref": "indicator--d5111ed0-deee-4e0d-a283-08364b0a2d8c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d06da585-6dcb-480e-8f89-12f8ba60991f", "sighting_of_ref": "indicator--b1d06576-3879-4704-9d1d-fdfa400c76e4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3218bfa-4f6d-45fc-a60c-e44d55b0d3c7", "sighting_of_ref": "indicator--35c1ef9d-de7d-4aea-864d-e607492f8313", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f65f1b2-9de5-410d-9935-37a176d723ff", "sighting_of_ref": "indicator--ee04461d-c889-40a7-9176-eb50372080b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--146dba7b-5d89-4a2c-a005-17379746ef7a", "sighting_of_ref": "indicator--cced908c-5d1f-49db-908c-a047623f642d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91001a91-dd45-45c8-9b70-dc66556e207e", "sighting_of_ref": "indicator--cced908c-5d1f-49db-908c-a047623f642d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7fa29da-f2a0-4ce2-8ddc-fb72a6955a0a", "sighting_of_ref": "indicator--ccfc2426-d9ba-4faf-abcb-9fc0b8edfb0a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a573d7b-e8f9-4107-a7bb-1a2c06329bd2", "sighting_of_ref": "indicator--ccfc2426-d9ba-4faf-abcb-9fc0b8edfb0a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--836250c5-572c-4f3e-88a2-0efbb2d333bf", "sighting_of_ref": "indicator--3b228bc0-0cff-4da2-ac3f-0932e27ee3d6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e3e6637-4147-445d-92e1-7e2991c5a71d", "sighting_of_ref": "indicator--3b228bc0-0cff-4da2-ac3f-0932e27ee3d6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4c25488-8a55-4db2-aeec-ba299c9f7dba", "sighting_of_ref": "indicator--4415bd8f-128b-4244-a623-28295a7ee0ab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--073e7d53-d72e-4c92-8085-b4bcb9787eb8", "sighting_of_ref": "indicator--52d44786-9250-4a01-aaa9-37a199560a23", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf87618d-175f-467f-97a1-51befb0a10c7", "sighting_of_ref": "indicator--e3bce525-2806-4978-98e4-5ea62138c256", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6e356eb-f096-4138-a4c4-8b298f0567d4", "sighting_of_ref": "indicator--ca842260-dfb0-4142-802b-944a0380d808", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--535c7917-2b89-472f-bcc3-39dfa850f5e5", "sighting_of_ref": "indicator--38702222-186d-4730-9c4d-b1832f25f005", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0899d00-7929-4119-918a-6706adf6dfdf", "sighting_of_ref": "indicator--38702222-186d-4730-9c4d-b1832f25f005", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da78a7c5-652f-4d7b-affa-33824be74d03", "sighting_of_ref": "indicator--91093fd7-a0e6-4e0e-87e8-d462338139c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ace6180b-0964-4fbe-bc97-b180cbea178c", "sighting_of_ref": "indicator--a4d1c0eb-3dbb-4919-aee4-48ba2b7d1756", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--904d9fce-1371-49fd-8de1-fa6720239288", "sighting_of_ref": "indicator--f8989ff2-13f3-4175-b66e-1e559c1390d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc7f7100-a2a7-4f87-84fd-cbaca52c2bad", "sighting_of_ref": "indicator--612d38b5-6887-49d2-bb1c-e2cab35aa381", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6a0fb08-a416-4d69-8528-f452309b19dc", "sighting_of_ref": "indicator--612d38b5-6887-49d2-bb1c-e2cab35aa381", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c21e0c35-6067-46a8-9adc-6c3714642416", "sighting_of_ref": "indicator--b4662158-23e1-4746-8b95-ab54ed88acdc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f01a3bff-6782-4aff-a4d1-c29ac4c4a52b", "sighting_of_ref": "indicator--fab7d258-2b1f-4690-b186-c2f5bece0785", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5bff527-bf43-477c-a106-e6b0eef93ccf", "sighting_of_ref": "indicator--0312e975-3389-46e8-9b6f-5bb455a749d4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--124108fc-fc48-44ee-9580-674c29d61ca4", "sighting_of_ref": "indicator--2ca13f30-5d73-4b58-818b-3e874741dc2d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e831a5a5-8d1a-4ae2-bee1-669393e4a3cd", "sighting_of_ref": "indicator--90670770-d6bc-4431-8a1a-10cbe1d0af4d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddb1c187-c7c8-423a-a021-237263dfad80", "sighting_of_ref": "indicator--605fda91-b8cd-4a7c-a08f-3d4e2aa2d841", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51c80fae-c26a-4d8e-94e3-2b83b3aaa417", "sighting_of_ref": "indicator--46a5fe0d-faba-4979-8e95-33e023835807", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b647f37-45bd-419a-80a7-6c08390bc194", "sighting_of_ref": "indicator--5d4ba4d7-ccae-47d8-bb55-868be08359e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8fdd484-82ba-43c3-bfdc-a6a9437242f3", "sighting_of_ref": "indicator--4e64ca40-b111-4e47-913f-7ba0365e5c0a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97ed8cad-67d5-43cb-9f1b-0e9cca5d7385", "sighting_of_ref": "indicator--ecb76e56-8968-432e-a799-bc6edeb83acd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--269b9488-f889-4d9a-a1c0-a6e45669744e", "sighting_of_ref": "indicator--7e60235a-4dab-4983-a048-f7026eb3049b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eedf5d0d-bed0-4565-b58b-3ab8720a2123", "sighting_of_ref": "indicator--b3323e99-928a-4677-a9be-34fa47ddc3b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f7b5c8d-18d8-4c04-b50d-d9612dc8e8cf", "sighting_of_ref": "indicator--b3323e99-928a-4677-a9be-34fa47ddc3b1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f1480d0-d244-4398-9507-6adbf95b3137", "sighting_of_ref": "indicator--b8ee561c-2cba-448f-9505-3cae771f31ee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03e681a3-d974-439a-9405-7f4b29b58b4c", "sighting_of_ref": "indicator--89f1b9e8-4623-4f8e-8967-d43af4db0613", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eca7b77b-e186-42b2-93f5-0a3d4b4f3dcf", "sighting_of_ref": "indicator--0459bf11-cec4-4d68-85e3-a093561ef365", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--800400fa-2215-45f2-9f84-2d0701fb988f", "sighting_of_ref": "indicator--d90828ab-7382-4565-95a9-ed119b665126", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1841e8bf-73fc-4dff-bb42-ce8e05a8e1e4", "sighting_of_ref": "indicator--72da52ab-f0b1-47ae-b049-f1080897f5ac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c883ca5-0218-4744-96c9-5270f5215c48", "sighting_of_ref": "indicator--72da52ab-f0b1-47ae-b049-f1080897f5ac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09343865-2394-4379-b7b8-d345d6af407c", "sighting_of_ref": "indicator--581066db-227a-41f8-b03c-8dff85b10555", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bee7a93f-fca3-42ce-8fef-d489fca3d722", "sighting_of_ref": "indicator--46e197c9-c611-4edc-a266-59a70f278844", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0db1d34-7250-4b7e-8553-43df0fb8217d", "sighting_of_ref": "indicator--46e197c9-c611-4edc-a266-59a70f278844", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d9409d1-2067-4843-8b5f-83a06a5e2154", "sighting_of_ref": "indicator--90e99e3c-a0b7-40a2-82fb-dd7247568c08", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2b76724-326e-4fc8-96ae-4034a519d146", "sighting_of_ref": "indicator--90e99e3c-a0b7-40a2-82fb-dd7247568c08", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a065df75-dc97-4900-a5cc-80768a2cc5c8", "sighting_of_ref": "indicator--e7906ce0-9836-48fc-ab84-8c0d7b02402b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac5ee16-3fae-4cb1-8ff8-d5a1dcaba0e7", "sighting_of_ref": "indicator--7adf6eb2-5a6a-41e3-95c3-bdba8f609568", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac94493c-9232-47db-89e8-f441fdf2fa14", "sighting_of_ref": "indicator--7adf6eb2-5a6a-41e3-95c3-bdba8f609568", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--985925a7-5de3-44fe-b54e-c8619f7ead2e", "sighting_of_ref": "indicator--20ea1da8-df6f-443b-adfe-9f65638daf05", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59c77b94-c21a-4a03-97bd-a5a03cf24591", "sighting_of_ref": "indicator--8b63bf2f-08f4-4319-ae1c-7ffeab3d4861", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--591cd739-1074-489e-8111-e8c2e0744cc3", "sighting_of_ref": "indicator--4fec544f-7832-4e55-910c-43ae33f3daf5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--097fd9c3-9a6d-4a2f-931e-cfbdd7f7ac83", "sighting_of_ref": "indicator--4fec544f-7832-4e55-910c-43ae33f3daf5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be57abdb-f67d-427a-a44e-6787cec59459", "sighting_of_ref": "indicator--7deb00ae-9dc1-4692-8882-5a369c03200f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc3521df-d866-439d-9602-7a14cdd921e8", "sighting_of_ref": "indicator--33422f42-6bcd-4d0d-b5b3-11f9efa9434f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2875d5aa-9ece-4874-8bc2-9e0f6259e6ae", "sighting_of_ref": "indicator--34d6daab-648b-411a-ac11-e8392dfe52d2", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ba7475a-c8b5-46fd-9fed-6e0e34277fd4", "sighting_of_ref": "indicator--1b4680ce-8f42-4547-97d5-6be708f31f9a", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bfc14bf-3e6d-41d6-b1b2-7ff282af5715", "sighting_of_ref": "indicator--e0aca13e-788d-42b5-8ec0-0711eb418291", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58142448-f3e2-44a9-b7fc-0a531d50746e", "sighting_of_ref": "indicator--7ef5eb16-8ba3-4e2a-9f07-72f8395d8511", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40b82694-fe3a-44f3-b59e-7bcf68323c66", "sighting_of_ref": "indicator--b5002990-8329-4266-a015-dd5c94b462b6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f1e462a-d152-4ad1-913c-cdeb2ec6416a", "sighting_of_ref": "indicator--984a1e8b-fa32-49ed-bff8-e437a186d259", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89089ddf-43fd-417e-b954-4b311b10a056", "sighting_of_ref": "indicator--06a3f481-7bb2-49ec-9f1c-00ee350027f6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--771f2e2d-e4d6-4190-95e8-214ec1cd2ad8", "sighting_of_ref": "indicator--ed09dded-ac70-4238-a08b-9b9157911b08", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3baaecfc-e1a5-40e6-923c-b3fc99c26044", "sighting_of_ref": "indicator--98c8d289-373f-4b0b-a51c-c9ef76fafa07", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--622a9dca-6486-4635-9397-8fa0658d1cdf", "sighting_of_ref": "indicator--8742d439-7e0b-47a8-bd90-2e2b0a13c1f7", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37bc5873-6e05-4be3-b199-b8ca83dfdc7c", "sighting_of_ref": "indicator--8313957d-0d1d-44fe-b41f-9b140935d994", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--881b5298-a7a2-4fc3-b3ca-7b3670258d85", "sighting_of_ref": "indicator--fabeb9c8-9d10-4735-aa6b-dbc839e644f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--789fc451-26d7-4d72-afcf-aeff5a428502", "sighting_of_ref": "indicator--9ece4fbf-7ba8-4fd4-9297-08c2bab496b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0b003f8-a785-43a0-9cc8-5a5ca32fd6a5", "sighting_of_ref": "indicator--89922546-a8d5-4106-b706-2eb52336b9fc", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2262356d-bf3d-4dcc-9ed2-8fcb258c1ab5", "sighting_of_ref": "indicator--d262f41f-86be-4797-bbff-98d3744d390a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6048ca47-928c-4f7a-a931-7dcf40f2f65e", "sighting_of_ref": "indicator--d262f41f-86be-4797-bbff-98d3744d390a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d365f822-5fa1-46ba-966c-fa32933118bc", "sighting_of_ref": "indicator--1f9d39b1-f686-4d30-ac0f-acd7c475775e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fc6e7bd-8578-422a-a95b-9d7bffad6a85", "sighting_of_ref": "indicator--79d92dba-9fe8-4f69-9a93-2567f7013987", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21334bca-3a99-48e3-9623-0fd9e1169a33", "sighting_of_ref": "indicator--c6e670d6-7270-4c50-987b-8e126fabe2f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec4f7639-3788-46d5-bd64-4789229a9163", "sighting_of_ref": "indicator--b572367d-1144-454b-a395-be8823aa7ff7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a37633c6-a303-4d30-bc9a-0a23af4f51ce", "sighting_of_ref": "indicator--d6bf3e41-bda1-463a-b5de-fb0bb14c04c3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7767422f-e5dc-4970-ad51-bce27aa09993", "sighting_of_ref": "indicator--d6bf3e41-bda1-463a-b5de-fb0bb14c04c3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--991b56ad-4834-4e75-904d-55a5d9ca997b", "sighting_of_ref": "indicator--60f2dee1-623f-4b81-b3b2-de76b595659a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83e901d2-c912-40d5-867c-a2a2ea725a91", "sighting_of_ref": "indicator--dda97938-27c0-479b-abd4-7131b0d458b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0701b26e-99e5-43ba-aec7-6811da23997a", "sighting_of_ref": "indicator--b089f4a2-a570-4811-bf7f-851649fc6e53", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5444b88d-415e-4aae-92dd-c39bf8044645", "sighting_of_ref": "indicator--f4434f77-bd83-470b-86fd-de5df30163d0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baadb2cd-6b3c-4ab9-837b-1adf8436b881", "sighting_of_ref": "indicator--0eb4f9ac-ff14-4451-a466-05eed9ef2510", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ed0b80c-c510-4554-9ff2-38b6a4ed8f11", "sighting_of_ref": "indicator--0eb4f9ac-ff14-4451-a466-05eed9ef2510", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a3c09cc-5932-4b98-ac36-272372229ebb", "sighting_of_ref": "indicator--0eb4f9ac-ff14-4451-a466-05eed9ef2510", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eee68e1b-1624-473e-92ec-8d48034344c9", "sighting_of_ref": "indicator--c90c59f3-187c-4ec1-a7e1-7c4c13c81682", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68148fda-e19c-4893-b540-730a5ec9535c", "sighting_of_ref": "indicator--f75c4a90-15fd-46b2-8e08-903884e236ac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aed6898-dcaa-49c2-8fd6-b2e7e16a9d00", "sighting_of_ref": "indicator--72c75cd0-ad74-4f41-9abc-2bc632509aac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8da59fac-02e1-4dcc-a1c7-18fcd13908cb", "sighting_of_ref": "indicator--72c75cd0-ad74-4f41-9abc-2bc632509aac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c9126cc-697c-4f85-b186-3b5b1a70d1e0", "sighting_of_ref": "indicator--acac4520-b135-47fb-9342-3107e14f5e01", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--084b89ee-3a89-43d5-af02-50444962587b", "sighting_of_ref": "indicator--2dfec0af-72de-4379-bcab-7b8adcfb4488", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcfdbcfe-7255-457b-bbfd-99e7d4861ca9", "sighting_of_ref": "indicator--2dfec0af-72de-4379-bcab-7b8adcfb4488", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--097dd8ee-8da2-4054-a250-d014875d7b22", "sighting_of_ref": "indicator--116c7908-0d41-402a-8cfc-4567d22f1d1b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d5cae13-9096-4697-b2b0-3972fbdd6deb", "sighting_of_ref": "indicator--671ae7ec-7a72-4396-9fe6-196954d74c32", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5669bc2d-9806-4417-880a-2d69f2da2174", "sighting_of_ref": "indicator--671ae7ec-7a72-4396-9fe6-196954d74c32", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1f12e26-600c-42a5-bb10-9da0d6478a2c", "sighting_of_ref": "indicator--76edefec-2d95-45cc-ba8b-8f8e65667e2b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59f8b991-f0bc-4262-91c5-a7fea0c2d7d3", "sighting_of_ref": "indicator--d977f276-0aaf-4282-9677-bfd953b1f7e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5467565-7365-49a0-ad4a-a87503d766cd", "sighting_of_ref": "indicator--d977f276-0aaf-4282-9677-bfd953b1f7e4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4310fba4-ef07-4f95-8511-8bb88a99cf52", "sighting_of_ref": "indicator--3287fe56-2a8b-4e87-b711-93d8f80d9120", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a6c5c9d-575f-4674-95d3-729851a3c76f", "sighting_of_ref": "indicator--570feb27-7d58-4c47-87d6-25a6694c5735", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12f046c8-8f2f-4778-9267-2ea98a475508", "sighting_of_ref": "indicator--2f54146a-9b01-4693-9326-6ccdb306c290", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2adc334-1071-437a-b1da-bc6e27ba1256", "sighting_of_ref": "indicator--c8b0cfb4-d5ca-4614-82e9-b80c2df19f2b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--612e8759-70d4-4303-bb57-8cc49dfdb19e", "sighting_of_ref": "indicator--fb1825c8-4156-42dd-8706-8cccd44b06ea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e12b9caa-1dab-47d1-a15c-e3eafe0a7ec4", "sighting_of_ref": "indicator--ed2bc52c-239b-4135-9c14-6a8da12c33e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3adac4c5-b2de-4ea0-ae7d-968abd0ca4ee", "sighting_of_ref": "indicator--d5d182ef-a180-40be-8d52-28b928fba25c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f9b42e8-477e-48b7-a665-d22cbdb08a09", "sighting_of_ref": "indicator--d5d182ef-a180-40be-8d52-28b928fba25c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ef2b1e9-9ceb-4f30-ba35-f54b19a60f31", "sighting_of_ref": "indicator--847f6375-9b9d-4e09-8c8c-485ea1cf5e49", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d352beb-3abd-4dcc-bf60-c5fd517e635c", "sighting_of_ref": "indicator--3ed8b604-0261-4097-b98b-af436780d2dc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d240b115-a270-4819-9b65-eae6e199255c", "sighting_of_ref": "indicator--3ed8b604-0261-4097-b98b-af436780d2dc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc9e9506-57f6-4eee-873b-ea2f669e41bf", "sighting_of_ref": "indicator--e65ba142-59e9-40d0-af64-4c4533be3ad7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d321da9-a6a0-48ce-8557-1a9cfaec7cc3", "sighting_of_ref": "indicator--431aa179-83f5-4026-bb7d-953f0fece396", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a404c2a-a2b5-4dab-b974-7a0c939754cc", "sighting_of_ref": "indicator--a3b341a4-d431-4704-850c-51353a8a5e5f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3caad838-978a-4b38-aa3d-fe6373a94119", "sighting_of_ref": "indicator--90328eb0-eb04-4df4-a409-ca8099d51285", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b92f2329-3e4f-441e-aa2e-7f350b1c09e3", "sighting_of_ref": "indicator--59e6e776-3a6e-4f9c-b80f-2a18e27d85f6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9df8affc-8885-41d4-b8b1-6556f0e9b15d", "sighting_of_ref": "indicator--59e6e776-3a6e-4f9c-b80f-2a18e27d85f6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bf6f881-d9c3-476f-bf68-553919ef7206", "sighting_of_ref": "indicator--5ee06e2a-cc53-47c6-8afb-e06bf446db32", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c45526bd-cfd3-4a7e-8ff1-09649a66a9ad", "sighting_of_ref": "indicator--2c5bd13c-6e3a-485a-856f-80d243e41d34", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70160ef8-30c9-483c-9eaf-8689199d9c31", "sighting_of_ref": "indicator--48b97c41-9e4c-4835-a9e3-cdbe45d9b9af", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--537a4cc2-554b-4a12-98d2-05cf43c62232", "sighting_of_ref": "indicator--64045c07-a9f1-4e5a-8ac3-bcd7ac32cb80", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78bdd874-33ed-43b4-997c-23e3a10b1d3b", "sighting_of_ref": "indicator--64045c07-a9f1-4e5a-8ac3-bcd7ac32cb80", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--869ed3fc-3dac-4100-b8fd-f69a774545ef", "sighting_of_ref": "indicator--a95afcde-2d78-48c0-bf42-6d735d696a43", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e3025dd-1746-415f-8a28-a0dc454f58bc", "sighting_of_ref": "indicator--dd485ef9-44d4-4e21-ac33-e5d95541c98d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcde20c9-1332-482e-8b72-30079d2f3b26", "sighting_of_ref": "indicator--dd485ef9-44d4-4e21-ac33-e5d95541c98d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd351525-a5de-4353-b3fd-30a0d834fc4d", "sighting_of_ref": "indicator--dd485ef9-44d4-4e21-ac33-e5d95541c98d", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5949be60-1abe-432e-8a84-fc53f13341c3", "sighting_of_ref": "indicator--5650aab9-0134-4904-b35a-86318bb1b3e5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be5f555a-63c7-4900-99af-0581dd606a11", "sighting_of_ref": "indicator--ae1efd71-c946-4fdd-b3bd-56d17d7cdeee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a9efd3c-675f-4ce0-adb4-171de7ad1281", "sighting_of_ref": "indicator--1f5d45b6-f8d6-478e-bbd6-bb80944c1303", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84aba300-cba8-4cd0-b9c8-4f213e5bd6a9", "sighting_of_ref": "indicator--1f5d45b6-f8d6-478e-bbd6-bb80944c1303", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d8fdbbc-c332-4404-b26f-cac813e5a5ff", "sighting_of_ref": "indicator--979fe1be-3882-4db7-bde2-6abfc4b45710", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad4700f3-6739-456b-ae18-73e937ff8eb7", "sighting_of_ref": "indicator--979fe1be-3882-4db7-bde2-6abfc4b45710", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--576f85ca-2900-442f-b691-150d0862046b", "sighting_of_ref": "indicator--44575c79-fbe9-4b1f-9ad7-58e0871f41b9", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a36fa273-9bed-49ca-a38b-3a3db8661ad9", "sighting_of_ref": "indicator--d4a208b1-abbb-44e2-9160-259b2f3d9d7d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--099f9700-00a3-45b0-aed8-134623a1192d", "sighting_of_ref": "indicator--d4a208b1-abbb-44e2-9160-259b2f3d9d7d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8740ceaa-55db-45e8-96b6-dabd8d7023c3", "sighting_of_ref": "indicator--e3460052-fd7e-4059-bfcd-5ca698a63a30", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aab4f8cb-8df8-440b-b4e4-5f83aedefdac", "sighting_of_ref": "indicator--e3460052-fd7e-4059-bfcd-5ca698a63a30", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c348fcde-1def-44e2-bafe-fd1fca85e1af", "sighting_of_ref": "indicator--339d3462-b8db-498d-a6df-bd97c8b31197", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3de989d8-d3c9-40cc-ad3d-c52bbe2554ce", "sighting_of_ref": "indicator--6f725ca0-0ece-411b-a4f2-290c79b76378", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d4bdcd1-f0e6-4d72-9ae3-03167ed0e805", "sighting_of_ref": "indicator--14fe4b49-9a44-4eaa-82c0-8a336f2654fa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83cfb533-e1b7-4add-80d2-8afc4065182e", "sighting_of_ref": "indicator--b38b62d5-4a8f-4540-94ef-5955695fc28e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c5aec98-6eb1-4e13-a310-39da5c675aa1", "sighting_of_ref": "indicator--b38b62d5-4a8f-4540-94ef-5955695fc28e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5c46b48-a33e-44df-a6e7-aa84dcfc6435", "sighting_of_ref": "indicator--399983ed-6e77-41b5-95e7-41dc66058625", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ad254f0-54b5-401c-b3d5-f042c9b54b4f", "sighting_of_ref": "indicator--8ee653db-161d-478f-9c61-59fd7cee12af", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15497255-9bd8-4687-ab5b-14aa30fd0390", "sighting_of_ref": "indicator--8ee653db-161d-478f-9c61-59fd7cee12af", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdf76278-91fd-4800-bd4e-27eee499d2b1", "sighting_of_ref": "indicator--515ec99c-286f-44be-901a-69a2de1bcdb6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9170003-ea49-4ecc-92c1-4d0c0930afdc", "sighting_of_ref": "indicator--910bac9d-fc0b-44d8-90de-f2148202cb26", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--959bb06c-ffac-444e-be6f-1ce9b75f3c06", "sighting_of_ref": "indicator--910bac9d-fc0b-44d8-90de-f2148202cb26", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--117c90e9-e6ad-4332-af16-6c7e518de720", "sighting_of_ref": "indicator--5deeb6d5-cdbe-452e-8556-22290771cdc5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd022dce-bd25-439e-90f8-e3a42f380bc2", "sighting_of_ref": "indicator--8e1a15c1-847c-45b6-81ef-f7ef337a733a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60885fc9-4b8b-4ab3-b3d7-7eff4ea20f1d", "sighting_of_ref": "indicator--6a362d7e-25f4-42f5-ae4b-35b88be27074", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e0d0ef0-e9a5-44be-aa26-3c5de3d6b925", "sighting_of_ref": "indicator--123fbc06-e032-4fd2-b568-82a14fb26533", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a2a7125-c64a-4ae3-bc07-1d01104b03bc", "sighting_of_ref": "indicator--0c833e4b-491b-46b2-8da7-049c5fb5fece", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5b572a1-21f0-443e-a5b9-91f18347ffc6", "sighting_of_ref": "indicator--0c833e4b-491b-46b2-8da7-049c5fb5fece", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab946398-73bc-421c-958b-ed4992632ffb", "sighting_of_ref": "indicator--d7bb137e-05dc-4048-a6fb-8a7eeb354a59", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2ef6154-f29b-4bb1-ad72-adf3255fc9bb", "sighting_of_ref": "indicator--5647ab0c-cb38-4ce0-a5ce-8c2bb8cec2e7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f91fee73-7bae-4b3b-91bd-f15e97cffb52", "sighting_of_ref": "indicator--f29831df-6891-4889-8a7a-7941d2b9cb30", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f308769-5f4b-48a4-9434-364abf8be2bf", "sighting_of_ref": "indicator--79d2b914-2013-4e25-ac7d-3f590a83ae83", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3468be9e-89e5-4c87-aaa8-5014eb8a619f", "sighting_of_ref": "indicator--cae08f5b-aa65-475c-9315-1ad83db9bdb8", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7ba1921-c177-496d-bf40-49473e714e0a", "sighting_of_ref": "indicator--ecf0dfa1-46e9-4dab-89f9-8a4b9f76d7f8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--133349a2-4277-441c-be2f-f2bbc2dd1bf7", "sighting_of_ref": "indicator--48773c81-fd9a-40d9-972a-acbe6e40d661", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d65b2fc9-ad6d-4dbe-8158-e70603fddc55", "sighting_of_ref": "indicator--2fbbd291-71d1-47cd-8be8-35ae442f9d54", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0233c4c-0050-4bc7-a8c3-9673f4786253", "sighting_of_ref": "indicator--9eba89b7-4411-4f7d-8ee0-de13b755211d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d91737a-c90f-42fd-95d6-73ed49b10262", "sighting_of_ref": "indicator--51afcb4c-c95f-4eea-82d2-81aa01e116fb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b589476e-d660-4665-b1b0-8f7e0fb88253", "sighting_of_ref": "indicator--51afcb4c-c95f-4eea-82d2-81aa01e116fb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba1fe21a-ae6b-4331-8112-a7ca6b872128", "sighting_of_ref": "indicator--fe6799f6-2fd3-4384-9a1b-6e54e5051dbc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b15ee375-4ccd-4ec7-8f6b-ab70bd9e8a8d", "sighting_of_ref": "indicator--ad65bbe7-f783-4994-aab1-eb82885f90a7", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--670f2566-dc9d-4947-b94c-2947f59195b1", "sighting_of_ref": "indicator--a55bf613-db6a-4f8f-825a-679426ac85d7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06b2c355-e7d6-4607-a0c2-3aa7e269f03a", "sighting_of_ref": "indicator--a55bf613-db6a-4f8f-825a-679426ac85d7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9776eed4-0385-454b-b5e5-72cb89672d3a", "sighting_of_ref": "indicator--655d1769-48bb-4dc4-b468-f6c604a5a9a0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--630ff386-0546-4102-8a77-02ba0c1dd165", "sighting_of_ref": "indicator--655d1769-48bb-4dc4-b468-f6c604a5a9a0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49aeb810-45af-4f65-b2b4-b06f8c50691e", "sighting_of_ref": "indicator--f11b8235-5862-409b-8c9e-64bab55f98f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66c84ef5-da63-4e6e-898f-f1a800293c37", "sighting_of_ref": "indicator--f11b8235-5862-409b-8c9e-64bab55f98f8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfcc3e26-3d9f-4a88-a5aa-6d84a1625503", "sighting_of_ref": "indicator--53d3b69f-a721-44d3-b9b9-6f604145c88b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4be240fd-27f3-4ada-bd62-b1b49d567aa2", "sighting_of_ref": "indicator--18fab03a-21af-4a2b-983b-6b611a74d1e6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27488a35-ef02-49cf-8edb-3886a0dc8d65", "sighting_of_ref": "indicator--876a8c4f-ae2e-4e06-bce6-89d7a19f0cd1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4061b4b6-699a-4d5d-bb1f-f4062620944c", "sighting_of_ref": "indicator--89ead486-43de-4c07-a2c9-a3f0ae5dce24", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c78b955b-fc65-4c3a-99d9-2a8b29dc7862", "sighting_of_ref": "indicator--89ead486-43de-4c07-a2c9-a3f0ae5dce24", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74308b47-9d52-4449-bcdc-430f40c592b3", "sighting_of_ref": "indicator--d13d071b-9140-4a6e-8a53-26fad148af6f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa1764ef-32d2-422b-abd1-de7198bb5ac2", "sighting_of_ref": "indicator--3bf23852-ad67-4abb-89f2-df1678726236", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f80f78e5-8b5f-4be2-8a3a-8b528a754ab7", "sighting_of_ref": "indicator--3bf23852-ad67-4abb-89f2-df1678726236", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad8a1f32-8b2c-498f-b82c-d7ff7e50d436", "sighting_of_ref": "indicator--c3579fa0-647a-433f-80d0-4c8686a940ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e037ec4f-b001-4a4d-86a5-dec924c4074d", "sighting_of_ref": "indicator--66ca3c5e-b42e-4982-b352-911744baf6c8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8745815-987c-4dd5-a436-365a6b5d28a4", "sighting_of_ref": "indicator--64fce084-55cf-4143-826b-bfb4b44665d7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f551e26b-b1f3-43e0-930e-5ad5d1b2f093", "sighting_of_ref": "indicator--f010b443-c2fc-4aa9-b4bf-d96426fbe93a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c661db4-8506-4c99-84f0-d6f62023316f", "sighting_of_ref": "indicator--0e37a7b2-6eb4-4d8e-9d7b-45446f339745", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7da406c-940e-45f2-9397-5617f3d4facf", "sighting_of_ref": "indicator--617bd05d-6600-4bf5-8025-bdc5f938205c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--026e746a-3137-41c0-903b-eecc1f07ce49", "sighting_of_ref": "indicator--17bcd118-8259-4b04-9b9e-4feeca1fd6f3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18ccc099-c626-4053-8fea-2d38b075e8aa", "sighting_of_ref": "indicator--17bcd118-8259-4b04-9b9e-4feeca1fd6f3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--996e21b9-2bb9-491b-b004-78d63a218ccb", "sighting_of_ref": "indicator--3c19ca02-179b-4f43-ae2c-d051068ac0f6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c44fa466-3703-4d16-bf9d-12a89e10923c", "sighting_of_ref": "indicator--d9a11276-3e7a-4ebd-b60b-9ca6dcd026a5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fc090f8-311d-4631-8708-4e284f9a6347", "sighting_of_ref": "indicator--a517a0f1-0ffe-42c3-b965-de1a7907ea02", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db79d919-036c-4d5a-b722-626cfa5c4425", "sighting_of_ref": "indicator--7256e5fd-97d4-4150-860f-70ae9be486d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5d0d25c-0ee9-4be2-bf84-f23aee437b8a", "sighting_of_ref": "indicator--612e2d17-0462-4842-8d26-13cccbc27bcb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c500f6f-e36a-47f0-984c-bf9acc657658", "sighting_of_ref": "indicator--541b6cbb-6635-4fd3-8c27-3745dc6a4b3c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9a58a67-de70-4d96-9af1-132ba968fe3e", "sighting_of_ref": "indicator--b2cbe4b4-6fe9-466d-8fb9-c9ed3c9c3f9c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35720810-3cc0-4873-9373-a5849ac2dbdc", "sighting_of_ref": "indicator--b2cbe4b4-6fe9-466d-8fb9-c9ed3c9c3f9c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26ef7720-a638-4181-8f5b-7d76c534f5a1", "sighting_of_ref": "indicator--cfb1afbc-e438-4d3b-bca7-0e0df3e34673", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6da01885-5f9b-4201-b381-ed86e3f2b71b", "sighting_of_ref": "indicator--2b5580b2-38b0-4c2f-ba08-6d6f72cf8842", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de200227-b626-4158-a583-24a2bcfb1100", "sighting_of_ref": "indicator--7148a173-6fea-4263-a457-68917d1e9e06", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93ca4a42-cb21-43ab-b6cc-51d01972782b", "sighting_of_ref": "indicator--9be01e54-db51-4b61-9aad-94090e0accd1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f5cfded-8d49-4e7a-9cb4-9a210c47abee", "sighting_of_ref": "indicator--ae156ce4-953e-491b-8a7e-699e5f62ff7f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1d72a78-2fef-4af7-97ef-49b7a3e7c6e2", "sighting_of_ref": "indicator--e073b8cc-c286-4e18-b1be-44b3e6fe3dc2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc86606b-00d9-4bad-8445-d9a52fd9472c", "sighting_of_ref": "indicator--71a9e588-fbda-4765-b7f5-be01bb753836", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02aa9f8c-de80-4fc9-abe0-d8dcfa9c337b", "sighting_of_ref": "indicator--f1217a07-392d-47fa-a4e7-f57e01c5978a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f4294c3-6e6e-450d-9fca-7c9834b1834d", "sighting_of_ref": "indicator--b761f65b-54e0-4464-b5e6-24d6b03efe4f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c38e5de7-54ec-445c-8518-48419c0e3304", "sighting_of_ref": "indicator--00bdfdca-3798-41de-a7a5-0952dc469bf0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e28217c-4709-4daa-9136-ade5d4a6c2fc", "sighting_of_ref": "indicator--6b406bbb-4fd3-4fb6-ab15-f20237c3e815", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58b72234-d0f2-42a7-9373-3772a8437907", "sighting_of_ref": "indicator--1d806389-c1d8-4611-b370-ad5c0f3c3ad8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca2db99d-ffa4-43ee-ab9d-61840bcda915", "sighting_of_ref": "indicator--37bd42ab-6602-461c-8fdf-1d5493841280", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7ff1113-e2a3-467b-b2f6-953390389929", "sighting_of_ref": "indicator--51c90bac-540c-431e-bd22-f60b443ce651", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6759bd80-8580-4d80-8f88-0570ddb8a307", "sighting_of_ref": "indicator--8ae01f3a-9508-4b75-b87e-44ae6be9c78a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4186f9b7-5ab5-42c2-937a-4262273a1082", "sighting_of_ref": "indicator--c421f9d3-db5b-4eea-b06d-384cfe6c63a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d090f69c-3994-47a8-a811-505365083e31", "sighting_of_ref": "indicator--c421f9d3-db5b-4eea-b06d-384cfe6c63a5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56d4797a-f426-4f03-816a-0938431f8f97", "sighting_of_ref": "indicator--e1caba54-f9e6-4e34-9b45-8148f4fbb656", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dd73126-0274-4d81-8458-12ab934efd4d", "sighting_of_ref": "indicator--9d8053fc-ef40-46c3-9b93-a3a2a2181e10", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78bd3540-d67b-41aa-ab86-f56906316e30", "sighting_of_ref": "indicator--b55b57bd-bf6c-4fc9-ba48-eb39617e8fdd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8279ffe2-252d-427f-95cc-0b45300129fd", "sighting_of_ref": "indicator--a62f121b-6b04-4d39-9890-8e2806b5b203", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c082318-b27c-4bc4-a2b0-3d874985af59", "sighting_of_ref": "indicator--42099b30-9509-42c7-96a0-90c129d5cb69", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81dce424-47e4-42c3-988e-59d6613c0760", "sighting_of_ref": "indicator--c752331b-8529-4112-a590-3153898f415a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9978b40-7596-4b5e-9877-97e8c38807da", "sighting_of_ref": "indicator--d69cc4e7-76b9-43b4-b996-6b19db6d60a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4f8afdc-3212-4dc5-9ed9-4e8cb7e964a7", "sighting_of_ref": "indicator--d69cc4e7-76b9-43b4-b996-6b19db6d60a5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16321d4d-cc29-464a-9166-227ed6aa5281", "sighting_of_ref": "indicator--7174ac05-ca59-4824-a9b2-2adcb3e44d81", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a26105d-2b29-4406-86bd-2d20d1691b91", "sighting_of_ref": "indicator--9afcb452-1b0f-466f-ace6-c516bde4a288", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a861413-f273-48a7-8462-d1d212986624", "sighting_of_ref": "indicator--20ed8428-25ba-4f51-b620-9ae93c300c6d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba3a6c34-bc3d-4421-8afb-60a86fcd0906", "sighting_of_ref": "indicator--5a8ea976-2a83-4eaf-ac71-b64b9f1b70df", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80c0fdda-0c39-4405-8349-a58101caecf7", "sighting_of_ref": "indicator--5a8ea976-2a83-4eaf-ac71-b64b9f1b70df", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edfa55dc-9acd-4412-8ad7-87c2f7b52d53", "sighting_of_ref": "indicator--bcdc89d7-6623-43a0-9680-0b3c2868f53c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc3dd87f-fe66-4b8d-a09c-01b75114a173", "sighting_of_ref": "indicator--bcdc89d7-6623-43a0-9680-0b3c2868f53c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c6325db-2df3-4721-889f-7f45553b8b5e", "sighting_of_ref": "indicator--1a1f174f-4479-4cf0-80c2-ab213ffe6014", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc76e930-625c-421f-9e46-e8cc64b6e266", "sighting_of_ref": "indicator--2085c2ac-d815-46d5-adae-53785852318a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cb09a3d-cb58-4369-92b8-e2919f983cf7", "sighting_of_ref": "indicator--21cda204-57a0-40b3-8e0e-00233bfcc4f0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b53b46d7-62e2-4a75-9df4-f7860eb2daa9", "sighting_of_ref": "indicator--ae05040e-2982-4146-a9c7-e435001f2d60", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95bb194b-3176-41f7-b5d8-8cfe206b7b7d", "sighting_of_ref": "indicator--2cb18525-d7fd-4029-a018-cf9e34658ff5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cac509e-377b-4bba-8ed4-5458147a767d", "sighting_of_ref": "indicator--da855aa1-0683-4a4e-bce8-4aa2153c957c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--603b5691-0b2f-4d6c-a41f-33514adcecdc", "sighting_of_ref": "indicator--6176dae1-3da2-4e49-b8c4-7c7783f846c5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45ff8172-4a04-4e3b-a5a9-4b7046d955fe", "sighting_of_ref": "indicator--6176dae1-3da2-4e49-b8c4-7c7783f846c5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e62f3e2-b3fe-40c2-a5a5-b99742679717", "sighting_of_ref": "indicator--4bb9f3aa-b849-4fa2-ba95-180fa7160382", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7caf7b8-3e07-4484-88e1-8510fa647c38", "sighting_of_ref": "indicator--5a6c82f1-6cbb-44fd-af9e-ad005ddf3737", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7659fa6-fca7-48ca-9537-1da08d274166", "sighting_of_ref": "indicator--bb4f2de6-871f-41fd-8feb-e1634329effd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b02f8c1d-0c16-4630-9663-7931352ac5e6", "sighting_of_ref": "indicator--f9a65e9c-ca8d-41cc-ac11-3c050f444bc8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65591cc7-3fc4-42c4-aba1-966301ccbffa", "sighting_of_ref": "indicator--471448ab-5555-45b8-a4d4-4406e39ee9a1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5dfa72d-db9a-4d3b-9d83-e13f65b46ea9", "sighting_of_ref": "indicator--53df2494-eb3a-4fef-8943-e8e22c1ca213", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e121f1c-07a3-428d-9f18-f90621188617", "sighting_of_ref": "indicator--6a496245-5209-4514-aac7-1e6d372e0f4e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd6f579b-6726-4cd5-b62f-6195afef1b29", "sighting_of_ref": "indicator--0e8433e8-9459-42cf-a959-dd09d38e659d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b3cbb4d-4eed-4c70-921f-ca675182c699", "sighting_of_ref": "indicator--bcfab6d9-b27a-46ea-9c8b-2d359249c644", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18952765-b1f5-412c-aaf4-3d6d77667949", "sighting_of_ref": "indicator--4b8589a5-950c-4fdf-bbd8-a9b03d7b0ebe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89bdf09a-6558-42e1-b451-5089f3caf48f", "sighting_of_ref": "indicator--25dadf30-7f10-4c68-9a7a-824028b7e890", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57330958-0fbd-4e08-9b00-30dd09e44324", "sighting_of_ref": "indicator--25dadf30-7f10-4c68-9a7a-824028b7e890", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d69feabe-2255-44d9-ae1c-4c1e4b0f0d1e", "sighting_of_ref": "indicator--51a72634-860f-4bc1-8d0d-f6a597595424", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01e8de47-72b3-435c-91ae-d25a4cf0a1f8", "sighting_of_ref": "indicator--c1268ebe-725a-4935-88ed-819d610f2f21", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cdcb976-a7f0-4691-8ef0-db4c38189a63", "sighting_of_ref": "indicator--dff61b4a-0a2b-41e4-a24f-ca35bbba25d8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97dc64aa-4f9f-4d1a-af1e-4b33be6ddd51", "sighting_of_ref": "indicator--0a94bd68-86d4-4fe9-9f02-c6a207995cac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa67f7f3-d313-4051-ad71-c0fe8ae247b1", "sighting_of_ref": "indicator--7449e53a-3dc4-408e-a7eb-a3a3fa07d16f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2242825-229b-409e-befc-0b1732a5db9e", "sighting_of_ref": "indicator--bdaba15b-a215-40d6-82d0-a82c651a4095", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45115311-3e2e-4eba-acb7-8a5ff620a9d9", "sighting_of_ref": "indicator--bdaba15b-a215-40d6-82d0-a82c651a4095", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e01e243-d0eb-4caf-b120-d85b53bb2d61", "sighting_of_ref": "indicator--98f6f53a-c1de-4d83-8aa0-1fa35d88870d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60f0203e-0e52-4529-9714-b390aa86e8fd", "sighting_of_ref": "indicator--98f6f53a-c1de-4d83-8aa0-1fa35d88870d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5cc1917-a34e-4b62-bedc-20e96aac3eaf", "sighting_of_ref": "indicator--cf0ac277-640f-45aa-b1ad-865bdad4bd41", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a54fac57-b899-43eb-a0fa-94cd581242aa", "sighting_of_ref": "indicator--dc5ff837-c422-48a4-b8f9-5d8c7dd72ce7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a8c7401-e6dc-4612-9005-478513ba5bb0", "sighting_of_ref": "indicator--796d1875-9a53-424f-9963-f09cfc479848", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69315d63-0d6a-4a1a-92f0-8075f50ebe3f", "sighting_of_ref": "indicator--d6f94738-b8bf-40ae-9b6e-a4f7a330bc4b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7c3febe-bb12-44e8-b6b3-dd2d5bbd6047", "sighting_of_ref": "indicator--5297d3c2-66a3-4932-b0b8-d92d2509626c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bab55d3c-e9f2-483c-be7d-3208e84ce7d6", "sighting_of_ref": "indicator--e06ef958-6b0c-4cca-afb6-8e77176ca49e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8a17ea3-b5fb-47b9-820f-9b85f568e6e9", "sighting_of_ref": "indicator--56de1a4a-ad30-4c4f-882e-1d8ab6cb858a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d817d8e-4f37-4d1c-9f4a-d51416359123", "sighting_of_ref": "indicator--80a22c2a-75da-4998-bac7-56bd4972726e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83b5609b-045e-474d-847f-52a6d0a86d37", "sighting_of_ref": "indicator--8df4c8fb-a496-4d69-acc6-59bb9c8a8df7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c5b1314-e690-49aa-9740-69723f398c22", "sighting_of_ref": "indicator--521104d4-88f8-4a0d-bde1-1f7a7deae50b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dada775d-a1f1-4f20-a534-a3b6de4f7d3e", "sighting_of_ref": "indicator--a3a3c152-3975-4137-82c2-3bac0a4a4fa6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de9faa9a-33e1-4860-bc9d-2572b0658174", "sighting_of_ref": "indicator--7a9ea7a2-4f0c-4eb2-9a01-48e206b5b28c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cb1921d-c33d-4bad-bc9f-f671b9203cfe", "sighting_of_ref": "indicator--7a9ea7a2-4f0c-4eb2-9a01-48e206b5b28c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d78abd6b-2f5e-4111-92a9-c863360db80b", "sighting_of_ref": "indicator--bb8274c3-d646-4c48-9831-e0575b748916", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a435bc4-b69f-4d27-b73a-25bd63de2405", "sighting_of_ref": "indicator--79ed384a-95a6-4333-834d-8043953349f9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c308fa10-38cd-4adb-9ec3-952acdadef2f", "sighting_of_ref": "indicator--cc94f94f-1dc8-415e-b35e-8be13ef4fb3b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49fc5eaf-d776-47fd-b8ce-99702c1510e3", "sighting_of_ref": "indicator--a9a065a8-d8a4-46a3-ab9f-373522d14988", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfb6e5d5-a5e3-4481-94fe-a38b8de66ba7", "sighting_of_ref": "indicator--c7a53e4f-990c-4dcc-bdbf-3aebc8d78b41", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c453ec60-409f-43d3-9aa5-44e13da50ba8", "sighting_of_ref": "indicator--4f845176-c252-4a9f-a0c1-f10cf594ed00", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bafa303-d8b2-48ee-ae69-0fe10c26756c", "sighting_of_ref": "indicator--aebaab7a-3567-4d48-b371-10947a976b67", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a69b04fd-3524-4f60-a41e-6df2a529c7ee", "sighting_of_ref": "indicator--65a1ab21-15b0-4846-982c-f1534210efb7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c1131c4-5297-4544-b39d-063ccc198ba6", "sighting_of_ref": "indicator--022e0fb8-fef1-48aa-bdee-a1f069fd82d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3eaa12f7-e477-450d-a262-a9cc705f9a36", "sighting_of_ref": "indicator--7a538c7c-4159-43d3-ab09-94e04f9836ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d323ff0-e13e-486d-9130-b3320022d70d", "sighting_of_ref": "indicator--9d65d8b1-93c9-4587-8197-3084c2490b3a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d921172b-c1e5-4972-9ceb-259d796b5a78", "sighting_of_ref": "indicator--9d65d8b1-93c9-4587-8197-3084c2490b3a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29828070-7ad1-4381-900d-a4a8e2a04d5f", "sighting_of_ref": "indicator--43c6d3e7-2440-4b77-9265-2285a013c855", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e0459f1-cc32-4ccf-8153-fb7315aa6620", "sighting_of_ref": "indicator--43c6d3e7-2440-4b77-9265-2285a013c855", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a3de781-5b3f-4f3e-9f62-ef4b33d4fa62", "sighting_of_ref": "indicator--fda23777-749b-4675-89ee-a9b0adb7bbea", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af31106c-a1e5-43eb-8287-2d67137abaee", "sighting_of_ref": "indicator--6f84cddd-569b-4a9b-a8c7-555c5a9f43aa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d25cb81b-8140-47a3-91f5-675c8f7bb7f9", "sighting_of_ref": "indicator--8f7d37cb-334e-4159-8285-ab4a2af34e98", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d1e5c4b-8a5c-4fc9-8e0e-dc95d3570f0c", "sighting_of_ref": "indicator--4e1d9fd8-4f43-48d7-8f45-7f5b918fd965", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c12c13ae-716b-4dd4-89de-7e8bd97f2e2a", "sighting_of_ref": "indicator--17709bd9-cd92-4864-af09-43b9d9faf042", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e28ff936-b3c0-406f-b800-d0d5a823f403", "sighting_of_ref": "indicator--80bed91a-c231-49df-b23e-85f8c27bb8fd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cf3f6bb-7d93-425e-940a-add8dbe130ab", "sighting_of_ref": "indicator--b6b1e36e-9c78-4b3e-906d-0273c9ecfce9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9be79e98-056e-4ebf-8f40-ba24abd92738", "sighting_of_ref": "indicator--1018a6f3-3d7e-4545-a334-fb41b97a100b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e815c4b4-3781-40be-b8ff-14841ea4bcaf", "sighting_of_ref": "indicator--88150bdc-51e8-4436-a987-03d56489ed99", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c34b6c4-25e0-4720-b572-6c01a4bdef76", "sighting_of_ref": "indicator--e2005034-988f-4ed9-8a5c-8e2d8a876f49", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1eea82f4-98ab-4c8c-b596-2ab1aaf2ea57", "sighting_of_ref": "indicator--431558c9-c0ed-49ac-b340-30c96f32c450", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c097f9b4-c785-4830-b8ed-ee1461be0407", "sighting_of_ref": "indicator--12256ba5-e030-4c1a-84e5-98d017bae38c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e665ba7-0c7c-4541-ba2b-d5ccf0ca52a4", "sighting_of_ref": "indicator--a3302ece-6945-46a2-b40d-1af263e0d6e5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb56c370-9bdc-4f8f-913f-25676f0da624", "sighting_of_ref": "indicator--b072a833-452b-411a-9ea3-6ab3688fcf3f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a8477ce-2d3d-4c1f-aa90-6ff954839dd9", "sighting_of_ref": "indicator--c90d6f4e-61fb-4533-b1a9-8606caa09086", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2c8fcf2-60f9-4a76-8fca-2567bb6b66a4", "sighting_of_ref": "indicator--5c2cd883-c4a0-410d-92c0-c8f5a8b82f76", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4b18667-ffac-4990-b475-11e3d43809ac", "sighting_of_ref": "indicator--4d96beef-76bd-4c6b-b0c7-701c6a90ba9c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f4d3828-5ab2-4097-8c2c-6c0c6bfb22f1", "sighting_of_ref": "indicator--ed73a12a-924d-444a-b343-8417c4d31b8a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20f2774c-a0ad-4481-9c9d-1f6ef1f641f9", "sighting_of_ref": "indicator--5e61059a-4d5a-4783-8e31-dab68554cf2f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ac5182e-140c-4230-a324-ef0688dabf8c", "sighting_of_ref": "indicator--0a06f6f8-8dec-4143-a61d-05ffcf331a8c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c77f902-74d6-4ed2-a510-cf7d382c8b36", "sighting_of_ref": "indicator--d0cd274b-130c-4168-b741-f191d2fc16df", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2063474-04c9-43f8-b67d-1c1f050f91d8", "sighting_of_ref": "indicator--d0cd274b-130c-4168-b741-f191d2fc16df", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a75982d-9db0-4e2b-8ab0-bd3a1ce4e26a", "sighting_of_ref": "indicator--d3cbab31-1f37-4d3a-9fd4-2d0d5f39e5b9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8b7d69b-522b-43a8-b6d6-63522b3316b3", "sighting_of_ref": "indicator--d3cbab31-1f37-4d3a-9fd4-2d0d5f39e5b9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b53ad1a3-69ef-44c9-b7e1-604fa05ed42d", "sighting_of_ref": "indicator--243efc51-8c63-4cad-8d14-8f241eb6f097", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9db686b-5dd7-434a-890f-617a7124102a", "sighting_of_ref": "indicator--ede34486-d523-41af-a668-10bd89a90006", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84006b9b-ea5f-4734-9b4a-41a34760436e", "sighting_of_ref": "indicator--de90d0c9-d51d-4f08-b6be-9b4d4f5ba53c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c888db7-beb3-4403-a608-1933239acc3b", "sighting_of_ref": "indicator--e5ce979f-7260-4e6b-b3ea-6469a0797112", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--432321f8-37a0-4475-b7e5-6efc205703d3", "sighting_of_ref": "indicator--226097d7-6eed-409f-bee3-ffd1b5dd0a70", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--538c072d-8a87-437d-b37c-ebcc3856a15b", "sighting_of_ref": "indicator--15773550-b252-4cd7-898a-82300d731220", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c94e835-8c9b-4379-a09e-6757810e18d1", "sighting_of_ref": "indicator--e7b961d3-2e06-4a8d-addf-b1445d905223", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b7978e5-1595-4c9f-a35f-83e8cd919bda", "sighting_of_ref": "indicator--64f51497-9627-43de-a03f-0d688fe110f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c2c034a-7505-4351-ba14-1c248a2844d9", "sighting_of_ref": "indicator--94d92d1b-a7f5-4127-9a8a-9181924862c3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fec3ef01-5804-41af-9971-835e0f488125", "sighting_of_ref": "indicator--b92ed5a4-a456-4508-8d39-e35b70f53ec8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bb0201e-2f9d-405c-a76e-380fa694b172", "sighting_of_ref": "indicator--227cfc4b-41ca-41e1-b647-72648de3d5c8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d964231d-6126-42ab-952c-8309f2e7baee", "sighting_of_ref": "indicator--a1599739-c65a-4f2a-a439-5e8a6157dee2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--749769fc-d47e-46ab-b70a-49fd6af81b25", "sighting_of_ref": "indicator--275952fe-e375-4b7e-8b7c-5cd37e90a9c7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6033aa05-c403-4767-a669-d2bcdd98e279", "sighting_of_ref": "indicator--68bbc23a-5858-4133-8030-f145bd6bf687", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d92b22e3-9191-404c-9dc0-b3164d8a0c9f", "sighting_of_ref": "indicator--12f6bdf5-4269-4b6d-ad91-7d3735125d0b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99083785-559a-46cd-8471-fc3861de4282", "sighting_of_ref": "indicator--12f6bdf5-4269-4b6d-ad91-7d3735125d0b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ea2aa9b-dd39-4788-9f76-b5be45956a4b", "sighting_of_ref": "indicator--895b55a1-4ca3-4f63-b8d5-47b107072a1c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--562fb310-53c0-46fb-86ad-3dad4755ae46", "sighting_of_ref": "indicator--895b55a1-4ca3-4f63-b8d5-47b107072a1c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f16361f6-958e-4af8-8a76-c5e9445f7cb5", "sighting_of_ref": "indicator--14394a1e-fadd-42af-9931-d9f973458367", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b74d90e2-360f-4cd8-94d2-7ef728987f29", "sighting_of_ref": "indicator--3590b67b-2072-408c-8d29-081ad8d0c220", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf617593-2729-4f6f-81ae-10f811277282", "sighting_of_ref": "indicator--71964c82-de32-4839-97cb-277bbbb248b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1063a85-4161-4f7d-9bb5-1d93517c2b59", "sighting_of_ref": "indicator--8efc3bfe-eb70-4eb4-977b-0c15ebe3d0d1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4e71e12-c185-4666-baa0-9346f86b880d", "sighting_of_ref": "indicator--2b61f927-deff-41f2-8982-cebad9c45fb3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b8a9cb5-c601-454a-a70b-cb2c391bd606", "sighting_of_ref": "indicator--275b491d-643c-40b1-8ede-ab3018af8397", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc9cde6d-eb6e-4849-9be1-b24bd74d3d6d", "sighting_of_ref": "indicator--5692cd73-583a-42b5-ab89-333caa1a3268", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b508059c-7f6f-4f68-96c0-347662651dec", "sighting_of_ref": "indicator--77de6173-c3b5-4780-90d0-06dc1d5a3996", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87030df2-fe20-49bc-91f0-29864cc52bb5", "sighting_of_ref": "indicator--1cbb18b5-a28a-4d6a-b6be-d641da914133", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee3e4043-5183-4ded-938d-2ec520665240", "sighting_of_ref": "indicator--cddb4dfb-1189-4776-94e0-6b09d1e1b288", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c55807d9-f31f-49de-867b-3f32cba6a11f", "sighting_of_ref": "indicator--76dfa204-e584-4829-8f16-c889b393e694", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f27b151e-2cbf-4b59-8747-93d341f9cd8f", "sighting_of_ref": "indicator--405d0d95-bc01-4efe-bc63-1e42539d6f09", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cfacd05-8295-4fdd-813f-b4f45adaffa1", "sighting_of_ref": "indicator--86e27fd3-c172-42d4-9125-90cb7bfbccaf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9795b2b0-b01c-40a8-9dd2-2927358386db", "sighting_of_ref": "indicator--0d074dae-fce0-4478-acba-5a649cc6cb60", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50ab4a54-8db3-4e18-9614-dc3166f66c09", "sighting_of_ref": "indicator--ef94cd51-f2af-4772-b301-acacfa84ff63", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4a40953-7ff5-497d-9e26-c7495ee0e2ec", "sighting_of_ref": "indicator--ef94cd51-f2af-4772-b301-acacfa84ff63", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6305580-170c-47a9-a54a-a054819aa102", "sighting_of_ref": "indicator--19b6c5a8-fc82-4f69-89d2-e309f5f9fcdd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f85cfb4-82a5-4dbf-a591-d459d9921d87", "sighting_of_ref": "indicator--340a79cb-48fd-409e-acf3-d312cde2bc94", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79f0ac2d-cd1d-4ef1-928f-337d2404307f", "sighting_of_ref": "indicator--8c7ba5c6-2514-4781-aca2-16c5510eef44", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e3112ec-eb81-48d7-9fb2-9d51741f6b36", "sighting_of_ref": "indicator--f5db234a-9927-4137-9346-1c9f34707259", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52466509-ac43-4b6f-a13f-369479269dd3", "sighting_of_ref": "indicator--f5db234a-9927-4137-9346-1c9f34707259", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c148e8a-c496-4836-9fe5-b9c1459e6ee2", "sighting_of_ref": "indicator--7f2fb946-1551-42cd-8ae4-81183ec9c805", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77b4799d-2ede-446a-9917-17801a91d783", "sighting_of_ref": "indicator--d476f214-027f-400f-9344-f5de2c30fcce", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc6d090d-046b-45d7-8c39-831cf6329e6b", "sighting_of_ref": "indicator--09f9d28d-42dc-439c-9d9d-121445bf87a9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43a2e0fb-db9e-40dc-9d57-249797268ae4", "sighting_of_ref": "indicator--4076750d-cbf5-442f-9a93-081c41a76f72", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7cc48be-9569-4e54-917c-e0b62057ee86", "sighting_of_ref": "indicator--e1fa7067-1b21-4c21-9b21-c4fb98c9cfe6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e64251c6-428c-4dda-ae58-b0e4fdae96a7", "sighting_of_ref": "indicator--aa966f10-39ff-43f8-86bc-407430913756", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e7086f2-66fe-4c6d-8c76-6a7ac9dee3ca", "sighting_of_ref": "indicator--13aff8dd-06e3-4e02-956e-3f79629d7c95", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7004adb1-a558-4587-bce2-4bd11f009d20", "sighting_of_ref": "indicator--a5f03280-e00a-41f4-9e80-7d4f0eca8db8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4de99ca3-ad57-44c4-9031-d5f25276312b", "sighting_of_ref": "indicator--80f7ba70-d458-4cfd-9ab3-36df19380e30", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e1ccba4-2bb9-4c7f-8431-167d5c35caff", "sighting_of_ref": "indicator--1bad2697-6269-4a39-84e2-9fa564750700", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55480490-0d08-488d-92bd-40b44d898109", "sighting_of_ref": "indicator--b5c790ca-9d78-481a-9c0a-e8e15437706a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f925e1ab-df7b-4e1b-94c0-c693e3361045", "sighting_of_ref": "indicator--61d31077-121f-45cb-93a9-ed7d8bbe0fac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f2750f7-ee43-4e4e-bc8e-09b21372d609", "sighting_of_ref": "indicator--1227b27f-f4e3-415e-901e-c394589ff132", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d12297e-14a3-4289-8f7e-ae35eccd4ea4", "sighting_of_ref": "indicator--1227b27f-f4e3-415e-901e-c394589ff132", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b0b1f76-7522-4fec-a4ae-bd54a53b1af8", "sighting_of_ref": "indicator--76c918e1-e4db-4954-b917-910c9efb2a74", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5e7911e-6d15-442a-8d60-e5e500c1d9b9", "sighting_of_ref": "indicator--d1cce385-2440-416f-9c13-9b924eb6e284", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--988d1a83-836e-4c72-b18d-530619778a9b", "sighting_of_ref": "indicator--d1cce385-2440-416f-9c13-9b924eb6e284", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5b0f6d9-4036-42a7-83ad-ca9e58a2fa5b", "sighting_of_ref": "indicator--0ec82e00-ec6a-45e9-a175-f40fcec7520e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3297181-af39-433e-b2a6-10a5e1941df9", "sighting_of_ref": "indicator--e337c870-9d0f-4b5d-a3f0-9ea259feef0e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96abdb6c-3b26-4c01-9152-c56a7540e5f4", "sighting_of_ref": "indicator--037a6c2c-d86e-4bb2-9535-870145933ea1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63d837b5-6c83-4318-bdba-b0f0c9dc4880", "sighting_of_ref": "indicator--037a6c2c-d86e-4bb2-9535-870145933ea1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d385d6fe-f6af-4061-94b0-6d6b5d2bd7b5", "sighting_of_ref": "indicator--c5cb70ac-fdeb-4a80-b09d-0495d166eb47", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eda126f1-881c-4bba-a331-f575c8bff89c", "sighting_of_ref": "indicator--1630cba4-ae2d-4be2-916d-22a0aed43817", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d1e80e5-8030-4369-adf2-ec4a83f959f9", "sighting_of_ref": "indicator--1630cba4-ae2d-4be2-916d-22a0aed43817", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76c4e7fd-bad3-4821-a225-7a4fe950b9f5", "sighting_of_ref": "indicator--74d3e680-ad2a-4abb-a5f0-1541adcc739d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--101cc3d9-cf6d-4dc9-b991-7ad0d6d48042", "sighting_of_ref": "indicator--ad7079b3-0f38-46c8-8936-fb4dd5cce9ba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fd36dc7-213f-4ce3-9e0c-10ff10544fda", "sighting_of_ref": "indicator--a431079a-5a42-460e-b470-1dab3bb31f0b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb969158-6c6f-4a31-b944-6d82ec37a086", "sighting_of_ref": "indicator--62d32230-e708-4b35-8dbd-dc324806e83b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a741e22b-31f2-4abb-b639-55189ed090af", "sighting_of_ref": "indicator--b4fb20a1-22ec-4a2e-96e6-18271b54a7f3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22461a78-9728-4312-898a-173214ed451c", "sighting_of_ref": "indicator--3b52f166-7c66-4566-bee0-8d8784bcf5b1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa313217-661b-462a-aaba-f4178b794b0d", "sighting_of_ref": "indicator--99f42cce-40f3-4133-a739-031610007235", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdf4725d-564d-4287-8fd3-f31222c8e09f", "sighting_of_ref": "indicator--99f42cce-40f3-4133-a739-031610007235", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5456b40-2e39-4e11-a78b-73185f42824a", "sighting_of_ref": "indicator--969bd37a-23a0-4e7c-9b7c-4c81920e5c90", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3726fe91-44d4-43d1-af65-8da5e3a5fa78", "sighting_of_ref": "indicator--f7776ef8-b821-45fd-a163-5b0f33214ee7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5828149c-000d-4716-96e5-4d47a84aa299", "sighting_of_ref": "indicator--5deb0966-767a-419a-baba-f2763f9dab7b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--897581c0-c35a-4a2c-b056-bc3fdc093ef0", "sighting_of_ref": "indicator--50c51974-7f11-4892-90aa-b0a896c235f6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4207088d-dc41-4b85-bedc-435700bcca43", "sighting_of_ref": "indicator--50c51974-7f11-4892-90aa-b0a896c235f6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba51da4c-9603-4d99-8a7e-e0289a866afb", "sighting_of_ref": "indicator--e83d9bc9-ef94-42f7-af4b-9eaa5ffb94bf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--184bf11a-93fa-4925-b08c-f555a32eaf8d", "sighting_of_ref": "indicator--7f5ed339-a48a-4cad-8c76-5efdff24078f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c76af92f-39c1-417a-8034-e28e007cb2a8", "sighting_of_ref": "indicator--bea13738-8270-4db0-80be-74c3491a1662", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6159f8e9-57f6-42b0-9b8a-e7fe7682b447", "sighting_of_ref": "indicator--7e35c9ec-b5a5-44e2-91e3-409d23b265a9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be18b072-f3f7-4eb4-b551-0a66870e1479", "sighting_of_ref": "indicator--7e35c9ec-b5a5-44e2-91e3-409d23b265a9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02b5c0a0-445e-4d3b-8c0c-638d39860555", "sighting_of_ref": "indicator--088defb6-0c43-4748-a892-18d9030d3eb0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5936194-dfd3-475c-95ef-d8fd36d6a5d4", "sighting_of_ref": "indicator--088defb6-0c43-4748-a892-18d9030d3eb0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d975c38-dcaf-4880-acf1-245b31c0e992", "sighting_of_ref": "indicator--eba5904b-f42f-48fe-bd73-81e47b8665f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9f88325-1a3a-40c1-9442-10f6c5698c14", "sighting_of_ref": "indicator--eba5904b-f42f-48fe-bd73-81e47b8665f7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f996ac16-2924-40bb-a7a5-a01713e6cd4c", "sighting_of_ref": "indicator--9482ceee-6b47-4c53-8f0e-ea30d3c1cbcd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18c494da-47fb-41b4-9be9-504faa5390ed", "sighting_of_ref": "indicator--4f54f756-d5ba-46e4-821e-9e4acc17e77e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6c62e75-dafd-4dac-9e17-027439f1f97a", "sighting_of_ref": "indicator--222c2425-328a-4f24-a1e3-52767a16850e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89c02930-38f5-46c3-9f7a-3e36c7186c57", "sighting_of_ref": "indicator--4b052ccc-8962-4f31-876a-a1adbd88631c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e91ae6d-8127-4f80-81bf-9f3fb9c37796", "sighting_of_ref": "indicator--15540df1-c6f6-41c4-bbed-a2a588c36720", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4db274a4-9b71-4a9c-a5d1-88a17118977f", "sighting_of_ref": "indicator--cf570b7a-63c0-4a60-8d2b-1f31cab4a317", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d13a0cdb-d956-414c-b8e3-d92acf776827", "sighting_of_ref": "indicator--1374e76b-6ad6-4b67-a195-e669092830b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6f9cabc-a3eb-484a-950b-14107ee09437", "sighting_of_ref": "indicator--b9cac40a-a799-4ed0-8fb1-f6358896fbef", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb3cd082-908f-45a9-82d4-e75831895ddc", "sighting_of_ref": "indicator--5d47091f-d286-4bec-aee2-621dbb8c6a6e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79e793cd-2541-45b7-ae6d-7a6d0d9c432f", "sighting_of_ref": "indicator--e0f4dff4-5b5c-4e28-94e6-7d7b9cd835ba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1ae3f2e-c19f-47ec-a08a-370daa8b113a", "sighting_of_ref": "indicator--e0f4dff4-5b5c-4e28-94e6-7d7b9cd835ba", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9995b0ab-0417-4e84-90b4-600065127810", "sighting_of_ref": "indicator--10a6232f-047b-488a-b68f-1d9ff26da7d3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0ad1327-7fc4-4e31-96ce-29b7aa530f49", "sighting_of_ref": "indicator--f369a04e-1caa-4dd8-a3db-9aedb8f26427", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74395072-c2a7-403c-9e3c-673238f88526", "sighting_of_ref": "indicator--4187e59d-c9f3-4cb2-8afd-0440207193d5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29fa5527-c601-4ba9-b012-ff0c69d96ac2", "sighting_of_ref": "indicator--096c5164-65e1-4a21-bfd1-a2842cb501ea", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bb91a73-7310-447d-8adf-a8b48dadd1ea", "sighting_of_ref": "indicator--d3c91874-86ad-4cae-80f8-838f15a10307", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2555bfb5-f505-4cc8-88db-959408a41c47", "sighting_of_ref": "indicator--44c73da3-85b9-4e0e-9427-1c8457dcd92b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e883db2-c453-4851-a618-fd69aa368322", "sighting_of_ref": "indicator--5ec3886a-b9b7-4a5f-858f-3957744384c7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a10ead05-3e58-4146-8e0d-44f309036729", "sighting_of_ref": "indicator--1fac6575-062c-411e-a544-d35ef8e02343", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf6d01a1-a196-41ec-a2b9-fe0141b893aa", "sighting_of_ref": "indicator--1d7308a7-11e8-41a8-8014-5b2e566629dc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e23cc51-f37c-47d1-9dc0-f80de95d6cb2", "sighting_of_ref": "indicator--83332f6d-75c2-4069-9a76-3f3768b36f81", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37951a98-a9be-445a-8d7d-9739e8ed0ad3", "sighting_of_ref": "indicator--83332f6d-75c2-4069-9a76-3f3768b36f81", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc3522be-ed61-4548-8943-722e6be3bb9d", "sighting_of_ref": "indicator--1daac13e-6f26-4967-befe-34bac2ce5086", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e23c9a6-6ff5-47b1-9c2b-47d57df4e075", "sighting_of_ref": "indicator--642620b1-4ecd-40e3-9fad-f8db4ad51bee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e60ffa27-7855-43e3-a48d-6a775a2302bb", "sighting_of_ref": "indicator--9c565c2c-b705-44a8-bea8-436e9d7a1ed9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9351636-ac8c-497e-87ea-06775926d2bf", "sighting_of_ref": "indicator--84e51216-ab4f-4117-a672-f2be5b36b03c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a7bb26c-bddc-43c2-86e6-88c806c7f101", "sighting_of_ref": "indicator--96129340-276e-48b2-9c40-957a0a6607bb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b8710e8-a6ec-4304-a1ff-b7c05baa1260", "sighting_of_ref": "indicator--c0eb2252-2c6a-4dbd-9186-e5f0ad769a5b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fccb7775-3ede-4a2c-b3f3-c96c913a4aa9", "sighting_of_ref": "indicator--0ecbf9a9-cb97-49f2-a858-c4b46e855394", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa4c6269-3e8e-4546-bc93-f7e95c9e4b68", "sighting_of_ref": "indicator--534508d1-388c-4167-99b3-984283b7d928", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cd32527-3526-4eb9-ac1d-c5187b289b2c", "sighting_of_ref": "indicator--534508d1-388c-4167-99b3-984283b7d928", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af4b6a03-f7fd-4501-99f6-c61110e96e56", "sighting_of_ref": "indicator--2734df3b-4628-4587-a7b5-96565804b5ca", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aa109a7-5ad0-4198-8220-c9b9917fe6bf", "sighting_of_ref": "indicator--8b3c86f7-bd51-45c2-984b-f7210cf3e82a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42afc596-bd55-49df-b270-775659d0b39a", "sighting_of_ref": "indicator--6f4f4525-a845-4849-ba1f-b766cf219665", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70926b47-0ab1-440b-9012-16a004b98f82", "sighting_of_ref": "indicator--d0258449-aac6-4313-b8b9-3115307dcea3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66e2ebdf-db86-4ee4-8630-a5cdebfcc92c", "sighting_of_ref": "indicator--1c7d05b0-df21-4697-b5ad-742673565186", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bee56ae3-616f-4a5b-aa90-3cca9167a7e1", "sighting_of_ref": "indicator--1c7d05b0-df21-4697-b5ad-742673565186", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--427f037c-29cf-433b-b13a-e7658f2c7485", "sighting_of_ref": "indicator--d8c91456-4e64-4411-9376-da8d4ca3b618", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d0bf0e5-0ac8-41e6-8bb1-95c1af7ecac2", "sighting_of_ref": "indicator--d8c91456-4e64-4411-9376-da8d4ca3b618", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--683574c8-8cc6-48a2-b1bf-80a965ad7ee1", "sighting_of_ref": "indicator--bfec2464-5f04-4291-a65a-eb2dd9d479e7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a89e919-d195-424b-bd8c-316275abbf4f", "sighting_of_ref": "indicator--41c617cb-05a7-436a-92f5-9db42b720647", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b64b849d-2d63-4068-a6e3-87766d2ab8c8", "sighting_of_ref": "indicator--0230ff87-5a6f-4f14-9eb0-95d78c622493", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b77e713-ca6c-4d13-ac10-d41669c90062", "sighting_of_ref": "indicator--15d102ff-6bfc-4b97-ad05-341f8d3595aa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7951e41a-cbe9-49c4-b721-4f8608bd2089", "sighting_of_ref": "indicator--40e52e4c-765d-42b2-952e-c3ed46153ff9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9322bcea-e92c-4d9b-9d20-12d17b2a7e3f", "sighting_of_ref": "indicator--e46cbe4d-0222-4b78-a4b3-ca75bcdbf5b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f02715b-bb21-4ad8-9fb7-6ce408db9633", "sighting_of_ref": "indicator--04e1eca2-9d30-4c94-b24e-c5467e42c1ae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85b2517f-624a-4e77-868e-9f7afa655325", "sighting_of_ref": "indicator--04e1eca2-9d30-4c94-b24e-c5467e42c1ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00dd8614-8511-4fbe-a7c8-f6ff4c43e5b3", "sighting_of_ref": "indicator--a45c0f00-1d9c-4d5b-b5c4-3d5d6d57da04", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a1e8045-fecc-4aa4-a591-fde903d3c58a", "sighting_of_ref": "indicator--1f2b9240-9d3f-4b9f-a47c-c14bcc61a4c5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c7e2059-8840-4bde-b4cd-016be8a20ab3", "sighting_of_ref": "indicator--fc7a3a2a-c50f-4abf-9998-823f2638054f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cccf8952-f314-4946-8b73-dc10c127dd79", "sighting_of_ref": "indicator--009500ac-78be-47ed-ad73-d0974211c40e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b677f58-06c4-4e91-920a-7bc11fdf1e65", "sighting_of_ref": "indicator--3cff27df-de2b-4032-a154-90d910877f5b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b38fa7f-2432-488f-948e-82cccbefaac8", "sighting_of_ref": "indicator--5960f34c-f94a-40d7-ac7a-67ab83a616b4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--395cd0df-d7a1-4c5c-b5d6-a5377e9b421f", "sighting_of_ref": "indicator--9094f308-b91d-4564-a9e5-027a640b3095", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b294b26-34cd-475d-86c3-e8ab3b5acc65", "sighting_of_ref": "indicator--c3bef2f8-d7b1-43f1-9292-0cb550ef5d3e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61384a00-01a8-43b0-b948-12c3c1b26254", "sighting_of_ref": "indicator--25c3560c-2fa7-4889-8060-e5b5de8a429a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de9cc680-32bc-443e-bfa1-7f06b65d4af4", "sighting_of_ref": "indicator--0383f967-e79f-41d3-a231-a2a537f98222", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca6ae521-7e39-4c85-959c-928b1f7b32d7", "sighting_of_ref": "indicator--aeb26622-736e-4390-9d10-669a79ff228e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e023f3d7-b5ab-44d6-a4e4-4d8f2bf94009", "sighting_of_ref": "indicator--aeb26622-736e-4390-9d10-669a79ff228e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60a251e1-4cbd-453f-8177-5529a2db80c0", "sighting_of_ref": "indicator--c5b10c84-5389-4678-8ffd-943e2b6e1fdb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8047ea9-a001-4990-ba70-553312cd5b51", "sighting_of_ref": "indicator--52422ecb-8301-4ff1-b80c-fa80654dbeb0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e807c41-993d-4c26-b9ba-98b8202127e1", "sighting_of_ref": "indicator--32825a4f-0447-4a74-8cef-c7b82c943996", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6896fdb-b0f9-429e-a1a7-3aaa3e72f2d3", "sighting_of_ref": "indicator--41cacbd6-46b1-402f-9b98-be80e7d37ab4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47ed2402-4d0b-489a-91f9-e7abb8c9bc91", "sighting_of_ref": "indicator--7ce22869-46b8-48fb-94c2-039010e32575", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--699b1d0b-7fc1-48f4-9f3e-473472d07008", "sighting_of_ref": "indicator--056d659d-8543-4993-bd56-ce49a88ee338", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2207f922-ae58-41d9-876d-4b13df08c942", "sighting_of_ref": "indicator--a4a03059-3e7a-46d2-8a53-295fb4e74508", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09c510c4-5311-4424-bdf6-56966530532c", "sighting_of_ref": "indicator--a4a03059-3e7a-46d2-8a53-295fb4e74508", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6b7fd1b-7c3e-4017-86b5-715b6649e7d1", "sighting_of_ref": "indicator--c9eb4892-b392-4750-908b-76be34a17903", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96bb5416-681e-4377-9ae1-73aba6823f71", "sighting_of_ref": "indicator--3fb2510f-b8a8-4c56-ae0f-fdd52192475b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9d8dd43-75d9-4885-b507-08963c6cfa79", "sighting_of_ref": "indicator--6a8a36b6-5a1c-4738-85a2-5199a9f4f40f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08fbc389-9a9a-45f2-b3d6-a6ee1f93fa7b", "sighting_of_ref": "indicator--7a3b68f2-0e92-46df-8045-0967891c7861", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e6500fe-35c9-4d8e-a4a5-14142222cbfb", "sighting_of_ref": "indicator--7a3b68f2-0e92-46df-8045-0967891c7861", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04208920-1fc3-4ae9-8723-127185a7ce59", "sighting_of_ref": "indicator--b446af34-df1c-425b-b39f-3c212576400d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08200269-96f9-4ffd-8d8e-e36346a08e4a", "sighting_of_ref": "indicator--d49c01a6-9fe7-48f7-b65c-9e2b961e1cc4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac05f612-571a-40f4-9943-8f2c060c9589", "sighting_of_ref": "indicator--c1288ae7-b53c-44b1-8bc6-9ade73396668", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a81fec8-d072-448e-a268-fdff3b02c8be", "sighting_of_ref": "indicator--c0adbbc8-3bc7-4b6d-a921-215b13994343", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c179350-8c79-4e03-9438-f4bd60d6aa87", "sighting_of_ref": "indicator--c0adbbc8-3bc7-4b6d-a921-215b13994343", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--475a3b11-ac49-4db4-a44b-e1e7bbfd419c", "sighting_of_ref": "indicator--2c1206b0-1c4e-4da8-bc8c-7799b2645107", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c903ad8-5cb8-4350-bedf-7eafdb3692c6", "sighting_of_ref": "indicator--2c1206b0-1c4e-4da8-bc8c-7799b2645107", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65e93641-ebf3-4ff5-8dea-0d6f79ff5813", "sighting_of_ref": "indicator--e7279239-a613-40f5-b08c-657353d9990b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3a30431-4c78-442e-9910-8e05d51d733a", "sighting_of_ref": "indicator--e7279239-a613-40f5-b08c-657353d9990b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b5dd183-81d6-4ea5-9484-a2b71c582486", "sighting_of_ref": "indicator--083e945c-37dc-4657-ad40-10385fda57a4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5444ca6-1f4d-46ef-a9c2-f65d38590b89", "sighting_of_ref": "indicator--56853dd6-835d-4150-bae1-0a18164cfc7c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc666991-e07f-4c4d-b49a-8ffa3827097d", "sighting_of_ref": "indicator--d2581cdd-cbf5-434a-acf2-7c8c7b6509ff", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41db0623-15fe-4894-8c2e-5b57a6b1bf84", "sighting_of_ref": "indicator--1f7bb9e6-49fc-40e3-afd5-42dd5df6c01b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccbb1145-f17e-4bfc-8a9d-2bddb7456ef4", "sighting_of_ref": "indicator--1f7bb9e6-49fc-40e3-afd5-42dd5df6c01b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f98d51ae-2d7d-48fa-9980-84b15680eb82", "sighting_of_ref": "indicator--dad05d51-78b5-4b43-a771-adcdb2949e8d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fabb6f0-60b9-467b-8cf6-0539f572ee9a", "sighting_of_ref": "indicator--f09ef046-fb1e-40b2-872d-29c13cddfb13", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2cde5df-6548-4213-ab65-f6acd7ebd85b", "sighting_of_ref": "indicator--2461d5ae-1c0b-42f3-a746-cda44d2aa247", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--813f4de9-0817-4a77-8753-2b5da94ffd2e", "sighting_of_ref": "indicator--5056fcc7-15fc-41ba-82d1-1f9908a3314d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ee5fead-c08b-4472-8bc7-a07a4156f8d5", "sighting_of_ref": "indicator--4329167c-4daf-4bda-a444-6e1aa591c557", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2c14553-481d-4694-b854-5855955ee967", "sighting_of_ref": "indicator--397effd8-4bb2-4285-8bd0-8d5e100c3aab", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4e0049c-67c9-464a-a38d-fedb1f025d65", "sighting_of_ref": "indicator--e3ffecd9-168b-42e9-8e14-03d33056e7da", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02b0e358-999b-499e-909d-b8a758219001", "sighting_of_ref": "indicator--4f3649cc-9da1-4098-99b3-33da1db54caa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea1bda36-28c8-4b69-85e8-7fa318a53bd6", "sighting_of_ref": "indicator--b5aa50f6-14d1-488e-b88d-b80fdb5c489c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--670981ef-145b-4cd9-bf63-8770ff99dd11", "sighting_of_ref": "indicator--b93bdd4f-88a4-4d42-b3b0-6d0f127110eb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0885f762-dc9d-49dc-a4b3-df9059b0d0f4", "sighting_of_ref": "indicator--58127fe1-73e0-417c-b591-1aefba51d9f2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f6af3ca-4f2a-4ce1-ae5c-c1ee7bb3be86", "sighting_of_ref": "indicator--f5e72856-01f3-4427-b79c-85444afe2d1b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e744479d-2118-486b-8324-de3a6f022ea5", "sighting_of_ref": "indicator--874ef453-08e4-4881-96d2-49b32acd5d06", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06b937e3-5a52-44f6-87a0-ce122cb217ac", "sighting_of_ref": "indicator--224c3ee3-ffd9-4774-bfed-c1423457ad19", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29d1dc08-7b62-4200-ad00-5dc878398c92", "sighting_of_ref": "indicator--7aac72d9-4356-488a-9b12-def9e5993f0d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99b2f36d-7b06-416e-8a9b-da3e3ae81e21", "sighting_of_ref": "indicator--1cfa81f4-60af-4198-81e5-16558ecf2ea9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73266943-a40e-4c2e-9a4f-00110f3e7f2c", "sighting_of_ref": "indicator--d45846ae-7040-4ef3-a757-243bfe2d37ce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83d52fcd-41de-4ca0-8eeb-4e71366f6273", "sighting_of_ref": "indicator--d45846ae-7040-4ef3-a757-243bfe2d37ce", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85264115-6867-493b-a692-1745c291e98d", "sighting_of_ref": "indicator--3bee20fc-354b-43cf-984a-036f90af5292", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5975d9f-2a1e-4aee-a179-a6e808806411", "sighting_of_ref": "indicator--63650f8d-395d-4348-82d3-74b0cbb5e3b9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0ba2b00-bce0-4a30-8df2-ba6da95b2dc9", "sighting_of_ref": "indicator--25bf5208-a3ce-4e9a-82cb-7a7b23018086", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6290caca-9140-4e5c-a834-403e9b8feead", "sighting_of_ref": "indicator--25bf5208-a3ce-4e9a-82cb-7a7b23018086", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75075066-cd69-402e-a9c7-aeff5e09644a", "sighting_of_ref": "indicator--8aed2def-6a8a-4bce-9adb-4a0a9723db63", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97c809f0-c7df-44ce-adc5-c077074b1e07", "sighting_of_ref": "indicator--8aed2def-6a8a-4bce-9adb-4a0a9723db63", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1247fe0d-71ea-47a4-afcf-7993e6634fd0", "sighting_of_ref": "indicator--65634180-857d-4d7f-9b3a-7f9d651fb135", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd905b00-c18c-408c-b51c-3b585abcaf5f", "sighting_of_ref": "indicator--f7a11423-de4a-487e-9d60-301538655728", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45da6cf6-0283-4d3b-94be-52385b38fd0e", "sighting_of_ref": "indicator--f7a11423-de4a-487e-9d60-301538655728", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--197b0c6b-5912-40d4-a4db-e5a9d6757924", "sighting_of_ref": "indicator--68d3d8b4-de35-4c5a-840e-78d7bfe1f155", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--977eae7a-9a0d-4131-904f-620f9a56b224", "sighting_of_ref": "indicator--4425365d-99cd-4035-b26f-b0711bea3a2f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6f4666c-5f8c-4802-a7fe-5e6238fd3604", "sighting_of_ref": "indicator--a30e2fc9-f41e-4fb3-b8ee-cf15271477eb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ba811e9-8afe-4857-b089-3aad2ac92255", "sighting_of_ref": "indicator--1a1c3f0e-a377-4f38-a07b-06b154e4ff5c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47454130-23e6-4635-a3c0-c8662a2250f1", "sighting_of_ref": "indicator--d721ab45-dd86-489f-bea5-9855c36dcbc4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93d57386-07d8-420a-92c4-c589bd9b8671", "sighting_of_ref": "indicator--c7b0c9e2-48bd-4f14-a478-aaf8b4fc2c73", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d45868ad-db74-4faa-b1f4-ac32b06e738f", "sighting_of_ref": "indicator--2a036b10-229f-4f9a-abd1-b5ff5937ae83", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84cd9411-6be5-4733-ada0-d206c9a533fd", "sighting_of_ref": "indicator--1458e26c-e93b-4932-98d2-0dd794f5021e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a41fac06-a846-4126-b5a0-02d94027759e", "sighting_of_ref": "indicator--26db0d8a-f435-4ae3-876c-59e67262c61b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce37d3a9-9985-4f77-aef1-27e19d354461", "sighting_of_ref": "indicator--ed4d9675-42de-4ef8-b9b4-ab6b2a30a778", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3e80a63-c097-44a7-a2b6-f77a5457cc7a", "sighting_of_ref": "indicator--49e003f0-6375-426d-ae1a-9002d1aa0450", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b568e84-0144-41bc-9b0b-1c77ad363419", "sighting_of_ref": "indicator--4bfb002f-c1be-494a-927c-06cef7da920a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c987eda-22c0-4205-ae6d-52c295190336", "sighting_of_ref": "indicator--4bfb002f-c1be-494a-927c-06cef7da920a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd232a21-7d97-4d0c-994e-e50e483cf855", "sighting_of_ref": "indicator--898c5d16-69a6-4499-865d-d574c1b5447d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a54c92da-24aa-460f-8b88-b3b9cc8ac7f0", "sighting_of_ref": "indicator--3226fbe1-4199-4475-b1cc-8bf1edb76934", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--813dfd0a-bb5b-412b-ac17-77cb2a1e00cb", "sighting_of_ref": "indicator--3226fbe1-4199-4475-b1cc-8bf1edb76934", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9bc7289-8648-41e5-b355-04bd1dcbf687", "sighting_of_ref": "indicator--c0f09533-0865-406a-8ead-0660255ccb69", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ff1da63-8ee0-4453-bbb5-b02389178c6d", "sighting_of_ref": "indicator--f41edb3f-a491-41ed-8442-95d29b281972", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fefb21c-d5c9-44d3-8547-ba848e4ddcc6", "sighting_of_ref": "indicator--16c40a4a-a1f1-453b-9329-ac4e5899877e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45c577dc-13d1-4148-8e51-4df7ca2d9faa", "sighting_of_ref": "indicator--c007e442-7691-4a21-9967-81b760a728fc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a953d01-4a7e-4a54-8d90-151ce2b2512c", "sighting_of_ref": "indicator--c007e442-7691-4a21-9967-81b760a728fc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d050665-26fb-415b-9144-be7442229021", "sighting_of_ref": "indicator--261ebf77-910f-4981-a933-295dce2d86ab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b56d971c-22d9-46e4-893f-b040b6116c03", "sighting_of_ref": "indicator--f268bcf1-acda-4cec-bd55-cb8e404d87ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acd88dbb-c66c-4ea1-8f91-46ebd2f891e3", "sighting_of_ref": "indicator--3b20261f-b5c9-4960-9f3f-65933a54d6cc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8b614f0-232b-4eba-a0db-66e960244f0c", "sighting_of_ref": "indicator--3b20261f-b5c9-4960-9f3f-65933a54d6cc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1027146b-2ebf-47c4-815a-6e8a6561bf42", "sighting_of_ref": "indicator--51c4b178-8127-4f0c-9e37-d6c1bd21199d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3348a0a-4ad1-4dff-ba0d-3bd321632bd6", "sighting_of_ref": "indicator--40b36f57-19ce-495b-9836-55189819631a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ffbeaae-c5de-48bd-b6ac-3b409facfbb7", "sighting_of_ref": "indicator--632e3f4b-9178-487d-920b-cbfa06937145", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d511d48-3e81-4a67-b62c-886dd05dc74e", "sighting_of_ref": "indicator--c56155ba-1e02-44c5-b61c-a6f8981937e9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2a4056d-500f-48d1-a5ab-285a78670583", "sighting_of_ref": "indicator--ed550a38-3815-421a-b3cc-7a472c8018b3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa245525-d2d3-4552-9f25-c4271b264223", "sighting_of_ref": "indicator--947a3c00-86eb-4bf5-88ec-42a43a8deac3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59c9509f-6c91-47a2-ba97-82ee1e4e7d16", "sighting_of_ref": "indicator--d56a5132-8c75-4fd8-a1ce-1a892f1f2db8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08d6530e-56d8-418e-b00e-aea2470c9236", "sighting_of_ref": "indicator--588fc6d2-940d-445e-b602-19aff4ef158d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b468710a-9f8e-41d7-91f4-5b9abacc888c", "sighting_of_ref": "indicator--f8fa6b46-9e4a-494a-ad26-854690993dd5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51c80b15-fa17-498f-b066-55d72f41e15a", "sighting_of_ref": "indicator--48002e97-93fa-4f23-8aee-83b7052ff269", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3712fd37-4162-420a-87c6-232915c49e79", "sighting_of_ref": "indicator--49cddc0e-8560-4901-bebb-3d60d2b148a4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e111d9ef-1422-49e7-b019-1742e3b65a9c", "sighting_of_ref": "indicator--aa04705c-90c0-4506-b78c-3474c2a28861", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89a10c18-ac11-4183-ad02-8fbb67f3bd5d", "sighting_of_ref": "indicator--95821586-5785-44f3-ade6-477bdd74e8ab", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fdeaa6f-5a1e-4a1a-875c-ec904deecd1d", "sighting_of_ref": "indicator--09de7537-3625-4834-b1fe-e49bed7399ae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72f6e249-6a8c-41bd-9ca8-a72971c324c8", "sighting_of_ref": "indicator--6baf603f-2ab6-47a6-bedc-ab71507fb03f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2adf2450-db38-4c75-9f28-feb5d3a93999", "sighting_of_ref": "indicator--2e42336f-756f-4ff1-ad55-d571d48aa184", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d61f40f3-4e16-4c4b-9029-3c9e93fec04e", "sighting_of_ref": "indicator--2234d5f1-d6c0-43ea-a20d-cf87a8954c78", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8f4f75b-104c-44b1-b8ef-8f8d6cf270e7", "sighting_of_ref": "indicator--d11d6226-afb5-44cb-8fb8-26d9fd7df6d3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac98c5fa-9089-44ba-bbdf-01cf43461dfc", "sighting_of_ref": "indicator--181951b6-9637-405e-b9ea-a38189ab4263", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d9f1838-0aa3-4386-b238-f1a48fe11c3f", "sighting_of_ref": "indicator--181951b6-9637-405e-b9ea-a38189ab4263", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--581c46f4-a480-4607-ad20-177b943aca88", "sighting_of_ref": "indicator--aee351a0-0071-4b2f-ac79-17ba65a19e5c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5abd7ca-7a0a-4706-84bc-3ebf19b952b0", "sighting_of_ref": "indicator--f8b85619-a3dc-44d5-889b-bb547e51fb38", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cc87c22-5271-4ebc-994e-bfe521a84cc3", "sighting_of_ref": "indicator--79e6d8b2-ce51-442a-a919-c7e1c5de7390", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cf7b8eb-7d4a-4fb0-a561-7c17fa779f56", "sighting_of_ref": "indicator--48b0bf9c-3c8a-42a1-ac13-9bb20944edc5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--012ebee9-dd56-4e61-83d9-8b989efc3cde", "sighting_of_ref": "indicator--316c376b-515a-476a-858f-29781c96ccb3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--539a540e-610f-49c4-a75e-2b3e5ea66c00", "sighting_of_ref": "indicator--316c376b-515a-476a-858f-29781c96ccb3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--465db930-31f4-461d-8fe9-80afdb1cef94", "sighting_of_ref": "indicator--28a54dff-90d8-47c2-babb-34c20b027c2e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca04f85e-068d-4a87-bfaf-6dee6f8460fd", "sighting_of_ref": "indicator--dce3e294-a1c1-41ff-a078-55c432a80407", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--328d751f-e395-499b-a4fc-804274c1b347", "sighting_of_ref": "indicator--f7c84f68-f2c5-4b1d-9ad0-8792a949cedf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed96b41b-7f00-4c49-aa21-112e3984714f", "sighting_of_ref": "indicator--b12eff3f-2a50-4c1c-a3a9-8a27cc479fda", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07db5783-ae3f-4566-8926-2d5f0da79a0e", "sighting_of_ref": "indicator--5a7fcd21-556a-40df-bc6d-038bc0445de3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd695c01-0b7e-4af1-a718-af413551ac65", "sighting_of_ref": "indicator--47259a2f-0ea0-4ba9-90b7-2403c6b224bf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64e2b8d8-b94c-43e4-b38e-1e1538642209", "sighting_of_ref": "indicator--219d9f1f-5ce5-471e-b896-0f11ec8af9e4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05c78a99-b214-44ba-a2f0-d977c0d31b0c", "sighting_of_ref": "indicator--49c6b041-55a4-491d-9b0f-478108da0d3a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--228a2bbd-2c4b-4d07-919f-847193f70b6e", "sighting_of_ref": "indicator--1b8f3fb5-2744-46e9-b61f-abfebcfb1a8d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--645fd94f-9642-461a-82b5-86c0c2ec2f32", "sighting_of_ref": "indicator--480f06f8-890b-4894-92bb-fca8e7d78686", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efee7b3a-8564-4bc7-92ea-fbb830d2f655", "sighting_of_ref": "indicator--534334c4-8d06-4e50-8084-548cfb761017", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f6f8f4b-e760-463c-9f88-a2f574babb34", "sighting_of_ref": "indicator--a7d66e7b-38cd-4fc6-866d-2193d2451b36", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ce22a7d-2f2e-423d-8562-7744f9cb576a", "sighting_of_ref": "indicator--3885955d-998b-48fd-835f-98992625f24e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9eeab17-6abc-48b0-b55d-e51b5721a0b2", "sighting_of_ref": "indicator--035c26d0-401b-44d4-a6be-441cef11033e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfddcd41-a3e8-4f5f-b58c-5ae3dfd7ddbb", "sighting_of_ref": "indicator--a68e38c8-35bd-415a-8c59-8b87ac324680", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fed7486c-a018-44e9-bf6a-07d5d93f67cb", "sighting_of_ref": "indicator--acc12193-f6ca-4985-a70c-27e9ab4c3870", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e6565aa-6cb1-497e-8d9e-a0887db044c8", "sighting_of_ref": "indicator--40f29435-40e3-47c3-bd4b-f3651a5c194b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d0aa08f-69a9-4a3a-bb10-f184ae0148b3", "sighting_of_ref": "indicator--2f5cd1b0-aab1-4a27-a20f-678f5545d712", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8fb31ae-802e-492f-9a57-60f8809f4522", "sighting_of_ref": "indicator--88f96203-c64d-4bed-a6b2-d6f8dda9a38d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91a9a1da-a8d2-4ae2-afdf-d2f5020cf806", "sighting_of_ref": "indicator--5a2c1afe-d1eb-4311-a1d2-aea794bd43d9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eb60058-0d00-4cd3-ade4-00e4c8dc6add", "sighting_of_ref": "indicator--fb140e71-6cde-4d9e-99b8-0f803adee57f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e5a31ba-1822-42d6-becc-290110e13ae2", "sighting_of_ref": "indicator--ef8a4a10-c1ed-4315-b1f3-6333ab15954e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3315f3c2-4777-4dd4-955f-02484dd467a1", "sighting_of_ref": "indicator--2ba19f73-f5c5-4e85-a652-919768d31616", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec6ac16a-2271-4b03-a0ba-9eab13c05f82", "sighting_of_ref": "indicator--f08bdb54-94d6-452d-9eb8-15f0562ca682", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13146bbc-a823-451b-8412-c2de04deb8c9", "sighting_of_ref": "indicator--8fe1b9da-3b30-4b92-b06a-f64ef15229d2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0baebbe2-f4c5-4893-806a-1ee60fab3708", "sighting_of_ref": "indicator--4714215f-afa6-4bf9-af12-baf07cddf3c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1fcf827-2af8-48ef-8f57-32be57bbfe7d", "sighting_of_ref": "indicator--dd2b30c0-b673-44f0-88f9-aa0e5150754b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--942f237d-2f6d-4bb7-9ab8-7ff270bf17d6", "sighting_of_ref": "indicator--26ba232d-1151-4fd6-9c94-5b4dbf9a0a2a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7efb3c5f-4e27-4141-b2d5-ae1a2a19ea1e", "sighting_of_ref": "indicator--47542150-7a7b-4085-9a8a-7f7fabcdd502", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ebd3211-41d4-4f03-8706-db17ec3b7d5a", "sighting_of_ref": "indicator--bf4a62a6-6a4f-4ec3-9a36-c2dd4520d3b8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5830aedd-db14-449d-a4cd-296b3c6e49c2", "sighting_of_ref": "indicator--a59084b1-7741-457c-9cd0-6505e9d11795", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dce8b89-8b95-4419-907a-44c31b057c78", "sighting_of_ref": "indicator--81a9d109-fc05-4069-8b2d-c3c1bab808fc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a400773-3215-4808-be9b-524633bc6259", "sighting_of_ref": "indicator--4b6b6b6b-d64c-4ce8-86f5-dd96be7daa9c", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a16b563-f606-4a20-b388-30ec6734e6d8", "sighting_of_ref": "indicator--79feec42-46f6-4c2d-afce-17f0ed07937e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a62c4814-d93f-4b01-b078-d661a2057f1a", "sighting_of_ref": "indicator--ee547e7f-03fa-45a3-aef0-56646996898b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dac0e573-e86a-4c04-9777-025dc8f8d322", "sighting_of_ref": "indicator--8ad01898-7cc3-4748-83af-14cb228bb301", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aefd0e31-f03d-4a13-adc0-49ceeeea75e1", "sighting_of_ref": "indicator--4370af1f-3c99-4065-a688-432df3518e4a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f79645d-f864-40c6-9cdf-f8ad66864245", "sighting_of_ref": "indicator--59223d13-2bbe-4e1d-86e4-fb105406ddc7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--354a67b4-4756-40da-a912-3c8b62561a6b", "sighting_of_ref": "indicator--6752fdcd-5885-4ee3-93de-ef35e17fb212", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--087e26ab-832d-40e3-8ddd-49cdcf199e39", "sighting_of_ref": "indicator--04db8469-4fce-4b2e-9563-c20e634eef78", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baa226d5-9ab1-44ea-94d1-b17ff484db84", "sighting_of_ref": "indicator--f1ac4fb7-dd08-433d-8cad-571cbad35aa4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66f7f929-5951-4b7c-8c44-38dd54505705", "sighting_of_ref": "indicator--7648dfe5-90e3-4449-85b2-346b1e06b7bb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b3c4efe-ee7c-417c-8367-74fa65943855", "sighting_of_ref": "indicator--25f6b61d-6f9b-462a-8f93-22228fe7dfb6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a42eb5f-ca3c-4b37-a383-a64c2b3ec7e9", "sighting_of_ref": "indicator--54fa4027-59e3-435d-b743-a4bf6fe030f2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46d4b0e7-2f30-4b99-8a6e-3c6207f5efb8", "sighting_of_ref": "indicator--015c1137-77b3-451d-963c-8ed715eb8321", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8838571f-027f-48fb-909f-b4c5980506f2", "sighting_of_ref": "indicator--f2ab6cfe-ac6e-446c-bbeb-fb652e304f85", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--039475b5-be50-426e-9f41-3bf26c84a77f", "sighting_of_ref": "indicator--6b0a479b-f7a6-4044-bb27-5962064c4db2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7e18db6-1d58-4c99-bcee-9ba3e633a667", "sighting_of_ref": "indicator--a2737b14-9f38-4ddc-bf1c-1b3c55455282", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8ca74c4-0a57-4fd2-8147-a12527868184", "sighting_of_ref": "indicator--a2737b14-9f38-4ddc-bf1c-1b3c55455282", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a621101-fb86-462f-a468-b73d46521589", "sighting_of_ref": "indicator--b65f0584-c94a-4b0d-91eb-7ff2e3555a53", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53debbbf-3c31-4593-bdae-2ad6860b108d", "sighting_of_ref": "indicator--e82f88b2-cc7f-445f-ba7b-bca1b46ab295", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8e926c3-8abb-485e-884a-8e873e2105ca", "sighting_of_ref": "indicator--5c780f42-9a20-4963-98d7-e7629e4c0e5c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79e252b7-27a7-4623-ba2f-a42f93e8b9b8", "sighting_of_ref": "indicator--7e7bf45e-a58a-4586-91cb-af9aaefdcf69", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e883223-4f15-4bb7-94d5-164c75d9c031", "sighting_of_ref": "indicator--cce4daa9-7803-4830-96cf-ceee2289375b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e3582f9-62d6-478c-9e37-65b8b8cd562f", "sighting_of_ref": "indicator--1afb4632-73c6-4f24-ab40-f8a7130f748b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb2bbeb4-065c-475c-8d67-89cc30274033", "sighting_of_ref": "indicator--86e601b3-a69e-49ea-9ca7-aaf1bf4707c6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e308c041-9db7-452b-ada2-75ed01b5085c", "sighting_of_ref": "indicator--3846edbd-4ec7-4ce5-93e8-6bd8ca666221", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--880da2a4-0efc-4ee0-8823-56240dd34bba", "sighting_of_ref": "indicator--0a313795-162f-45a6-92c4-4379eee41fed", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb0bf234-87bc-4bbd-a060-4ef8013770d2", "sighting_of_ref": "indicator--02a58d6b-c24d-4816-b46c-cc1de069a6fc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23de87a4-f667-40c9-bceb-8bb79f9399cb", "sighting_of_ref": "indicator--d4ad0f43-c841-496d-8620-8978e988639c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9b71f86-828f-4e66-bdb2-4f3c1a6564c6", "sighting_of_ref": "indicator--5e9dd5ca-f813-4162-8e21-6d397e028c3f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41846123-b1ca-4311-ad34-d45de2af7efb", "sighting_of_ref": "indicator--b6ca52f0-c753-4aa6-bea0-996459eea195", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0f8f9fe-4a0a-4070-b443-9684dfc2c04c", "sighting_of_ref": "indicator--02ceaaef-6815-42bf-8e6d-2f5b15b82810", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b53caf1-649e-4850-86e0-b5ab3d4924dd", "sighting_of_ref": "indicator--5f3d357f-8ee8-43b2-a81e-147192afde8f", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14959a62-98da-410c-ba67-765231a10978", "sighting_of_ref": "indicator--a99f7f6f-5e73-446e-9b7d-98a48025c214", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dae74016-f588-4276-8cd9-fbf393e7275f", "sighting_of_ref": "indicator--a99f7f6f-5e73-446e-9b7d-98a48025c214", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51b38669-a5b9-4ced-9382-90bc9db485da", "sighting_of_ref": "indicator--cf7776ae-3902-4cdd-bdfb-5cfed223110e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f4764f7-2fa9-45f1-8281-251f408bfd0e", "sighting_of_ref": "indicator--ebe116e1-d551-4860-9d01-5f368a741757", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e9d1927-2353-4597-890d-ba9bb8c2f3d2", "sighting_of_ref": "indicator--806815c4-3484-4d61-acb2-e948f052f4ff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3e41e39-536a-46ea-8aab-51c3b85ffdea", "sighting_of_ref": "indicator--dc78ca56-92f7-477e-834e-7f8665d4f37c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64752590-4c04-4c61-89d8-fb388397166e", "sighting_of_ref": "indicator--cc0baeea-c6e3-4b4b-bf99-8a27c0478f49", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2aaabc6-b0d8-46d2-a00f-eca3ea5cb773", "sighting_of_ref": "indicator--6bd2bd63-7f9c-4ae5-bf8b-d5a1934e1c9b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39f71d58-523b-486a-9114-3243ed92f18b", "sighting_of_ref": "indicator--867bb80f-ae67-4fc9-88ee-aca625c3537b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bca1a22-a08a-4c43-bcb7-9892afbac789", "sighting_of_ref": "indicator--7e70bbef-9b9a-43cb-90f2-1fb42a0e5b05", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62b47815-6730-46d0-8c77-b2068bfcf3fd", "sighting_of_ref": "indicator--b5b57f26-ea20-406d-9f6b-cccf364ef215", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b874d3e8-b5eb-4269-97a3-7d868ad0ad14", "sighting_of_ref": "indicator--c78240c5-c79f-4182-97fd-c3b6eba36fa2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4033c7fb-abe8-41da-80c4-16cf780c39c0", "sighting_of_ref": "indicator--9e0b0c10-8715-4737-a3a3-df9925ebdc4b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1af5afb3-208d-42ee-9229-12358655214b", "sighting_of_ref": "indicator--99ca6a7d-78b6-4872-8e47-7240da55b0fb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dd850e4-f9ec-4235-b649-8e98a25c4232", "sighting_of_ref": "indicator--ecb30146-fb8b-4ead-b2dd-63bad1eea6db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8c7bfe8-c961-4dd1-afda-bc2cbd3a1fbe", "sighting_of_ref": "indicator--f16fe1bd-c8c7-416c-a1ae-761d88ab5cec", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cf31bf4-9cc7-4827-a660-441ba5e94cda", "sighting_of_ref": "indicator--d0aadfda-0681-4d10-8542-4e587d3151ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b26f7b48-717e-4f6d-822c-9f8a39d0f7bc", "sighting_of_ref": "indicator--54163131-0b06-4622-8692-fa4ec215ec60", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e49a1a9-efec-4190-b010-697a223e9835", "sighting_of_ref": "indicator--de6168b8-3168-4f1d-93f7-f72c91903e35", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2aca5ee-fc99-4cda-bbf0-fa12630e9fae", "sighting_of_ref": "indicator--07a6e8ef-cef3-4267-bfec-9955953a26b8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--534406cf-8783-49af-8ea8-05b088fffa09", "sighting_of_ref": "indicator--745ff4da-9584-48bf-b5ff-cf85072d7744", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf7f9e2e-21c8-49f8-bcf9-38d5d851ff08", "sighting_of_ref": "indicator--745ff4da-9584-48bf-b5ff-cf85072d7744", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2785ecf-830e-4957-bdfb-1db986c5ae51", "sighting_of_ref": "indicator--893b2ee2-a7cb-41db-97a1-2e10fbc3f8be", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc58983b-c6bf-4887-853e-164ed6c43e95", "sighting_of_ref": "indicator--a3963bed-fddd-4fd7-a7aa-5698181db7b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6551be5d-2f4a-4e18-9d24-9e8b523b612f", "sighting_of_ref": "indicator--2c949a5b-f59e-4f23-984e-062f72f28110", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65dfa857-bed2-4936-86ba-78dbf45fff32", "sighting_of_ref": "indicator--05a29a5f-3750-4324-a83c-a5ac51137d49", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5b93043-ad01-4321-bf26-b2c7ec3f775a", "sighting_of_ref": "indicator--75631093-e25f-4aec-b66f-3ff58c2b61fc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d19c9391-7507-4fac-a7a5-e23cc9b8ea2c", "sighting_of_ref": "indicator--75631093-e25f-4aec-b66f-3ff58c2b61fc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc0f9b67-df8d-4385-a2ab-07002aa4bfb6", "sighting_of_ref": "indicator--2a7ecbcb-387f-4488-a0e3-e83da52edb10", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a98697be-eeed-4598-ac2b-56d331115e13", "sighting_of_ref": "indicator--ae381806-3a28-4477-9cfd-51e0e723db3e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc6891af-0bf7-4607-ba1d-c21509372862", "sighting_of_ref": "indicator--ba753104-7747-4726-88e2-5f9422662965", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db6488ca-bfc2-4dd5-adbe-8b952948bd2c", "sighting_of_ref": "indicator--4451a46e-74c0-430d-b609-7e416117638f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47f99157-6f02-4409-b81f-739f60361e2f", "sighting_of_ref": "indicator--e54f791b-0e9a-49ba-9087-9cd4d0d8da23", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5c9a820-c5a3-4bfa-b08e-180a82c8fc09", "sighting_of_ref": "indicator--b310605c-244b-46aa-a238-4d15a13378b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93c9fc4e-9ffa-49b5-bb1f-c4a938ef4ef9", "sighting_of_ref": "indicator--450034a0-4a3d-40f7-bac0-ce751d254de5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e42cb609-79a3-44ec-98ee-ed9bf40a1ecf", "sighting_of_ref": "indicator--d44efbb2-018f-416f-9d41-23ecfaa6a0bc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--042f1474-00c8-415b-a11b-0ba7907e02f1", "sighting_of_ref": "indicator--31d5a240-b188-4347-a9a1-e867c9579fa0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ec6529d-b0be-4068-8bf1-41fbbfd8b366", "sighting_of_ref": "indicator--dde6c294-bd0a-428c-b8e6-4ea83497a9e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--976e5897-342a-4221-8ee5-6ece086c8d97", "sighting_of_ref": "indicator--0c1480be-a7b8-44b6-a80c-04391c70a596", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af07c9b6-137d-451a-a831-1c2cdd09f26f", "sighting_of_ref": "indicator--e38d809f-8f29-48cb-ae5f-310511406896", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08f055d7-df25-4329-8527-0b7f2fcb1ed3", "sighting_of_ref": "indicator--09611f9b-e82c-4551-9584-986185e884a1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f865f713-3d81-4de8-89a5-5cfb05d8edce", "sighting_of_ref": "indicator--5ef22e81-b7de-4861-91bc-c855e1985f58", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--703d73e7-2d23-4c07-9639-88dcf8dde01d", "sighting_of_ref": "indicator--7763008b-a7a7-4e10-a9df-61121da6f66d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--618a2452-3932-4e26-b9aa-c0b70b478c54", "sighting_of_ref": "indicator--646a4883-5cd5-4016-a43e-55ee3e3acacf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34ab4ff1-3bf6-46ab-b819-051f72aa58d4", "sighting_of_ref": "indicator--ff6bfe4c-e8cb-4f4b-8ad9-67899165c272", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97ffb000-bb4d-49d3-a3c5-041ce7241e97", "sighting_of_ref": "indicator--a8623b54-d0a6-418b-bbdd-adf1aed5a911", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a4a695b-bddf-4168-ac99-6b42baa40fab", "sighting_of_ref": "indicator--31f7298c-f837-40c5-96ff-b6982092ff46", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d408321d-41c9-4d32-a411-460d83ab4a40", "sighting_of_ref": "indicator--e25754e7-c02f-4df1-bd2e-1b964ad0f100", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--184566b7-92d1-4363-a0ef-1c0b89910230", "sighting_of_ref": "indicator--5a1ed725-d7f4-41c8-bbfc-ef03d71a7ba1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f20c5a61-963f-4374-9442-0e378568dd58", "sighting_of_ref": "indicator--4803e44e-a892-4793-bd9f-5bdec4ebc74e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6e2d194-98c6-4aac-89b6-83fb569f78b0", "sighting_of_ref": "indicator--b3cce005-5a83-4b1d-97d2-b45b459984da", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48c6112e-2d87-44f0-8e4f-cb2e94ab44ad", "sighting_of_ref": "indicator--83f54295-1e59-4473-84be-58fc295d8b9d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--615d5a12-b929-4ad2-a49f-72b29ff34635", "sighting_of_ref": "indicator--0afbfae0-92b6-407c-9265-95c3c9072211", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0afda06-07ba-4949-8f55-24cf808c135a", "sighting_of_ref": "indicator--6914b026-bc70-4597-804a-7b0b9ffee3da", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4175ef7-3d89-45da-9a4a-998e6dd8e93e", "sighting_of_ref": "indicator--5f6813f5-943c-40e5-a0bf-5c869d23d556", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c798c4d8-b6b1-499d-bad9-789b9c2376ea", "sighting_of_ref": "indicator--e4459788-db52-44a3-8b5c-cc17babccc73", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5183d66f-328a-4757-b4fb-7f4a3787c2e4", "sighting_of_ref": "indicator--34a4a8d4-7a2e-4dfa-8059-5e4f7442c82b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0ff8e93-63b9-4318-9d9a-fe4c1566d563", "sighting_of_ref": "indicator--5ad29fc0-d2fe-4c45-a5ed-6487f5dcc9b6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b4e44e8-68c6-426d-9405-17324192a93f", "sighting_of_ref": "indicator--8c9ba414-e099-4473-877f-b3a37b8112e2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6fb0644-076e-4d9b-b926-183097bec77c", "sighting_of_ref": "indicator--6a6b24cf-d71b-4c66-8766-fb43520a8f8d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59712942-8ada-419e-8416-317193478078", "sighting_of_ref": "indicator--bb26b4b8-a7d0-4307-9c8c-7e1550b91eff", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af64b45b-8bd7-4732-af1a-b0e9411f2ae7", "sighting_of_ref": "indicator--bb26b4b8-a7d0-4307-9c8c-7e1550b91eff", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eeac18ca-7d4c-4db4-b935-43850c034b2d", "sighting_of_ref": "indicator--f29e51e9-f96a-40ac-a386-50ae5e8dfab9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce373359-4d65-4d02-9963-17da35445855", "sighting_of_ref": "indicator--09a27cd8-ae58-4273-8ebc-8c9825233b2b", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21311412-36ae-4178-9009-ac23757f559c", "sighting_of_ref": "indicator--9d7ed037-6932-47d9-93e1-f827519c4b14", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--122f2030-7c49-4d60-83e7-7a4fd4373e46", "sighting_of_ref": "indicator--7f11c6da-4bef-4ce0-8cb5-c546e228980e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58db7d25-0e8f-437c-84ba-4d9073e45b30", "sighting_of_ref": "indicator--56480d92-2f5b-4417-aa75-4ec648b67091", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32dc30c6-4aab-43fe-aaa2-d6b2f201904e", "sighting_of_ref": "indicator--63e36571-c61a-4a6f-9db5-0391f4065072", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70d13eb3-547c-47ef-af0f-ecaf1f80ba7a", "sighting_of_ref": "indicator--2871de6c-d8cd-46d7-90a5-f05b98eda862", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--978b7d8e-8491-4da8-832d-9522f7a4dfd1", "sighting_of_ref": "indicator--1afc64ab-307d-4f4a-8629-f9603851cae5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c126f9-5190-4312-9244-28392445092c", "sighting_of_ref": "indicator--5c8fb3f9-add4-4db8-ad75-529374e5735c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e78619b-2a73-4f49-b579-c687e3831ec5", "sighting_of_ref": "indicator--3f2f55a1-7af9-416b-a2e7-10259a9e2618", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--506b4cba-fffa-41b1-8dc8-63839b17f25e", "sighting_of_ref": "indicator--89094d48-b6a4-43ac-b038-9398914236c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25e84ced-f803-4dd0-bf37-742da472c9db", "sighting_of_ref": "indicator--1198bb9a-abdf-47da-82be-6f0008f32adc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49388115-00ba-4d4f-86b3-b4600ad3a68d", "sighting_of_ref": "indicator--02f92268-f5e5-423d-a6d1-258139f558d9", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--588270af-2621-4747-bbf4-099ce6b15cb4", "sighting_of_ref": "indicator--44e4d624-9d65-4e5d-a44a-543241fb401b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd85c0f4-14b6-4814-b1d8-18a3add26971", "sighting_of_ref": "indicator--e0b16b9b-a382-448c-b2f6-b5a8e6ee1ace", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--616c43bb-7d57-4d13-a365-2e06bdfa9a4b", "sighting_of_ref": "indicator--56b51ab4-e464-4243-be5d-fa207d1a2987", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da71a5f2-8442-489c-aee9-f1276a099dc7", "sighting_of_ref": "indicator--5df7f4f4-a236-4550-878d-a1b04f1e4114", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6831f11b-dede-48e0-abac-73b746f0f75a", "sighting_of_ref": "indicator--ac4b308c-becb-408e-8f7f-ffa2bba86762", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a3bdf07-1a0c-4b72-88b8-4c6cfff8ad45", "sighting_of_ref": "indicator--cfb77a1b-3ffa-43e5-908a-78ae338e86c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fdab6d0-58b3-48a5-88b3-1feaac718276", "sighting_of_ref": "indicator--3142f843-3a16-4f19-aec0-b720571b2bac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f32d792f-5579-47b7-8ab5-d89ffd345326", "sighting_of_ref": "indicator--411bb5c9-dd1c-4140-8e85-99f8e05b3a60", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9cb4cf3-7396-4f58-bd17-78e65fe95ff9", "sighting_of_ref": "indicator--c67ab225-4237-4890-88b6-9c70e7ee82c3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dbdccbf-c8c7-47fe-a5a3-cde8ecdbd6f2", "sighting_of_ref": "indicator--78433a31-20c5-434c-aab5-a5db59bed220", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0413530-4335-48b6-bb94-a934f1321c4f", "sighting_of_ref": "indicator--506a3980-be6b-48c3-ba62-66d46d0da3e5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1717eaf5-c1ff-47e5-9d0b-87efd968f8ce", "sighting_of_ref": "indicator--f697129a-0d55-429c-8a38-e7ce067848b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--397562d7-9c35-4347-921d-005e94bf372d", "sighting_of_ref": "indicator--e122acd8-1624-48e0-b6cd-35818d31b644", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24d1e7e7-7ba5-4a12-8fba-ddadf2874457", "sighting_of_ref": "indicator--aa3190b4-9866-4194-95e3-2d031929f732", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a324167-f1f9-4e45-8092-2f4decf64539", "sighting_of_ref": "indicator--607445f1-c71d-4e5d-8f2d-c57955b51226", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0928f149-4b22-4b44-9b1a-e059de75c10f", "sighting_of_ref": "indicator--deb10dd4-6740-43d8-98a9-ec12ae6eb614", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9168fcae-baee-47c2-99e3-7be657ef78cb", "sighting_of_ref": "indicator--5e46b6d0-398a-4b4f-8ffc-0b2dbd278b21", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47f85361-9fc6-43da-8c95-1bf298299d4b", "sighting_of_ref": "indicator--fa165925-55cb-48d5-9db7-fbe8f25c66a4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11c42ce1-0ca3-4b4d-af9c-8a5455bf23a0", "sighting_of_ref": "indicator--fa165925-55cb-48d5-9db7-fbe8f25c66a4", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff12e85d-05d9-41a5-a658-ad52c9f99e65", "sighting_of_ref": "indicator--e1eaef13-385c-43be-89a2-202f92a1e01f", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ac19ac4-2799-4381-9426-80d0592eed61", "sighting_of_ref": "indicator--21be1101-3bb2-465b-9c7c-c0bf05b95149", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71605e01-b7bf-44bc-a2e3-2129c81106f4", "sighting_of_ref": "indicator--2e736517-0a4e-4bb6-bbd1-f1f31181aba9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5719f345-02ac-4de6-9f8a-29777720db0d", "sighting_of_ref": "indicator--a549c93b-e7c4-4c37-855a-541256700496", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33efceb4-4d2e-4379-bb77-fe0372dcfb71", "sighting_of_ref": "indicator--b60f64f2-6306-4bca-9498-a07ca1d9cd93", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae7edde6-36d4-4431-bd76-ef2c6c431b6f", "sighting_of_ref": "indicator--df3cc6d1-0d59-4537-a94e-707346f719ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--756bebed-b4c1-47d7-b993-325f414786da", "sighting_of_ref": "indicator--790a6121-e85d-49a6-8311-dfcb548018a6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b00750b-7ad8-4fc7-b35e-5a952f87d932", "sighting_of_ref": "indicator--1ad25842-9efe-4aa4-afca-15278f7fe13d", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7517eee6-a22d-4810-9687-3d2afb827383", "sighting_of_ref": "indicator--d385eff8-8563-4c0d-b603-05ea8da4c60c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0550475-0ce7-4a43-8c87-4b52baf28249", "sighting_of_ref": "indicator--7dce961d-c5d5-4028-92c3-48856b43ff2d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7dd98c3-c526-475c-baba-fe73aaec7a73", "sighting_of_ref": "indicator--3513328b-db62-46a4-8487-98a711dd1d22", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c6bf953-6b53-4e77-a786-7c818e9d4e53", "sighting_of_ref": "indicator--d2cb3ae4-2627-400e-8d49-5e31bd920c98", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c7fd886-98ef-44d8-af5b-f5dbb676b314", "sighting_of_ref": "indicator--14b037f2-5ebf-413f-979f-dd21d4599b44", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f492ccf1-111c-4db7-9cc7-af7b52df24d2", "sighting_of_ref": "indicator--c308a88d-9041-4950-86cb-264ca79517ae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6684f565-c636-48bf-b0dc-d10c0ecf8e73", "sighting_of_ref": "indicator--3e9ebfc1-bcdb-48d5-94a4-f5e531909bcc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0d3f8d9-eece-478c-bf07-c47a330e460c", "sighting_of_ref": "indicator--5678ca8a-1f79-449a-b419-e890054c013f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76bb2e83-2ed0-4016-8bef-6a7c06486e20", "sighting_of_ref": "indicator--0ba78cca-0252-41fa-9119-d484f597fa2a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46163d04-579b-4e16-ac0e-4449d2e5a694", "sighting_of_ref": "indicator--204aae90-7100-42cf-93fb-6508e50ac9e4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--791302e5-5a59-4489-8e44-e3facc925456", "sighting_of_ref": "indicator--ac5c7a46-3449-49f7-b523-2714b07e73bd", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7c38f32-a6d1-4618-bff3-921edf60112b", "sighting_of_ref": "indicator--8f3bf0ee-04f2-494f-be57-ebd92c7cc812", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ad77191-d084-4bf5-b06e-4854f9b11b1b", "sighting_of_ref": "indicator--967fdc4b-3172-4e2c-9248-057d42bb7704", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cf7c970-7ddd-46d1-895b-4165c5f8e84e", "sighting_of_ref": "indicator--36889021-6273-450f-87a6-2cde71fb9937", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36779ea2-37a4-414c-98c9-ac11f3c3cbec", "sighting_of_ref": "indicator--7793f399-fd34-4fd1-bca5-02a287f200d9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90f282e7-f19a-43a2-9c4f-ccbd0d8d7089", "sighting_of_ref": "indicator--bd6a2b6c-797f-40e1-ae3b-6cf4d23b2f37", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c04c3ac2-d4d6-4748-93a0-c1e3fbd59d6e", "sighting_of_ref": "indicator--0fb01a3a-7f4d-43cb-84fd-f2fa2b9f89b6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eccf6331-006a-4bc7-b358-1c5affa85bda", "sighting_of_ref": "indicator--e68ec8f7-e3c4-492d-8e25-0ae1ed8fdaf8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69d53bb4-c9c0-41e3-988f-b7cd4901cd99", "sighting_of_ref": "indicator--67b2e2f2-dde8-4146-8a86-b77266a64b63", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f66ac7b-8768-477e-9461-78ff4b16ec91", "sighting_of_ref": "indicator--44f7e463-72be-443a-a19b-84be051ec684", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37713377-a7e9-4b29-a63d-9decb0654ded", "sighting_of_ref": "indicator--746181ee-8b39-4782-a030-a9943ab82da6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46efb57f-1b7d-474d-999d-1d928a29aeab", "sighting_of_ref": "indicator--000113d3-fd76-4d0e-9c6d-70756263ff46", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20f72e37-9102-40d5-95a5-1651cb21c08e", "sighting_of_ref": "indicator--dcc72612-cfad-4ad9-8065-aa1036609098", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6d26d71-20ec-4c9c-92db-6ce5af969589", "sighting_of_ref": "indicator--f2538fe5-e8cd-4870-965f-3f6182720cfe", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e46073c2-f034-49cb-ae35-2d68873ca55f", "sighting_of_ref": "indicator--40deb03a-c1e7-48cb-9168-165b5a40146f", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e04cb7d-a1c7-4db8-8ee3-44883ae1c88e", "sighting_of_ref": "indicator--a5450c4f-8521-43f8-a63c-76e04dc551fe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c552c32f-ed27-494a-bf6e-a46bd43df991", "sighting_of_ref": "indicator--a5450c4f-8521-43f8-a63c-76e04dc551fe", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5754811c-f1ff-4896-91f5-f3096eb99af6", "sighting_of_ref": "indicator--e44782b2-4b4b-446f-9d39-d2b99e0d6e29", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ca3702c-2956-47b4-8dd4-76dc130b9f7a", "sighting_of_ref": "indicator--86bb7b52-b620-4a62-8785-916525fbf55f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f5287a1-ab72-4e10-a00e-99ccbdd731f3", "sighting_of_ref": "indicator--7a34395a-23ea-405a-b68d-137745772467", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e42b3e1-5f66-4f06-ae76-3f02940c2dab", "sighting_of_ref": "indicator--6be5e8d4-5e84-4ea5-8393-6f46ef70e066", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1f7587b-0dcb-47c4-9c98-7afa4db0d3e9", "sighting_of_ref": "indicator--2c3a9931-3d84-4525-8723-59529595d20e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7d4f485-edce-4e39-948b-f293ab153dc3", "sighting_of_ref": "indicator--2c3a9931-3d84-4525-8723-59529595d20e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--829bcf37-c079-4dac-ba72-968ef9faacda", "sighting_of_ref": "indicator--dee1adc9-6f35-4894-98c0-01a69f628bf2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--291526ed-00e0-4787-a351-dbd6fc64b9bc", "sighting_of_ref": "indicator--0ba51d36-6279-4384-9fa4-eac5725b9e88", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--460e29c7-c2b0-4ade-a8ff-1e8bed89da57", "sighting_of_ref": "indicator--0ba51d36-6279-4384-9fa4-eac5725b9e88", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8751a621-9a1b-4d40-8932-efcfdfa71862", "sighting_of_ref": "indicator--ce844da0-e7a4-417a-a26b-2aa5ae8b2c98", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d833b782-706c-4439-a200-56f53c182356", "sighting_of_ref": "indicator--7d71ad53-b68b-4583-9d8d-15969dea16ff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d30d9648-20ec-4861-a8c4-820fe01572b0", "sighting_of_ref": "indicator--bb000f53-5833-4400-95ef-92bc284300d9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f807c4d-3015-4ada-a5ca-8946035b1713", "sighting_of_ref": "indicator--73350137-aa91-411c-8343-553527a70d40", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51d50c70-5124-40b8-b763-0fc2a54296a3", "sighting_of_ref": "indicator--36e1853d-0f90-4f85-93d9-5a45b38df208", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5637cf29-ee68-4a82-9e04-4721e07b477f", "sighting_of_ref": "indicator--a5ed2345-135a-4690-bf7a-8b81f7486f97", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64cc3c06-bf87-406a-9a04-6611c2ebb930", "sighting_of_ref": "indicator--a5ed2345-135a-4690-bf7a-8b81f7486f97", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcb31bae-4195-4676-a537-170c53a4dfd1", "sighting_of_ref": "indicator--7fbe64e0-96a1-4408-9e58-570ffc7ee276", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9682d699-90a4-4b9a-84fd-efbb1f7e85e0", "sighting_of_ref": "indicator--3469a29e-3d0c-4b47-a818-ad4090f0be97", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a9243d2-b2c3-4d92-9bca-9979524a9ba8", "sighting_of_ref": "indicator--8ca49304-202e-4bb4-94a5-7acd6b912d92", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7497e5a3-87fc-4e36-8cf6-28530d408aff", "sighting_of_ref": "indicator--8ca49304-202e-4bb4-94a5-7acd6b912d92", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02f2013e-abd2-4575-9548-f345b7b4277f", "sighting_of_ref": "indicator--aa072f94-20b2-41d1-9554-e67c4e59618b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bd0ad44-2a9d-4c5e-9379-8b127bff9c73", "sighting_of_ref": "indicator--f2e65cb8-c7cf-4ab5-8b9f-ac98a1f7b586", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25bf53d9-f71b-4db7-a0cf-69ca5c639ca0", "sighting_of_ref": "indicator--99eeccd4-b373-42f9-a8e0-b484db3f8b4f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48e0fbab-0cc9-4e5d-8c0b-b78685501830", "sighting_of_ref": "indicator--4cbe8d6c-d4ba-4daf-90a3-dc833fa7631e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad3caf9b-b429-4a18-8205-f063a687a622", "sighting_of_ref": "indicator--4cbe8d6c-d4ba-4daf-90a3-dc833fa7631e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6ebb6f6-fc27-4be8-b287-369f35b2a5bf", "sighting_of_ref": "indicator--ac0ad7b6-6769-4f76-8a86-c8be392107f3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9a9860d-f964-48d6-89e3-d9df8d119597", "sighting_of_ref": "indicator--06b5d168-c543-4ebe-87db-c66210613c71", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3a89624-6213-4599-99b1-b4746ee49f75", "sighting_of_ref": "indicator--a084bdb6-4c69-4b83-a149-b8658e80e92f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5df5934-07d6-4f1c-839b-a0e1160ca5f3", "sighting_of_ref": "indicator--5bb6a12a-1026-4bfa-90cf-3a5b6eb47833", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdab3ff7-a26c-4b13-8530-ba14b90d6304", "sighting_of_ref": "indicator--6d281000-7a49-4798-917e-7ed48adbe535", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69515b27-1559-40a1-bf60-de99ac896425", "sighting_of_ref": "indicator--bdaff357-f20f-4cd4-9605-942dc29ab55e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80baf938-5523-4f89-b8d2-f76f7a03cf97", "sighting_of_ref": "indicator--028074d5-c552-4a5e-bcc0-ccbc6fc77ece", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c88d6424-373d-4369-bae6-314772fdd5ce", "sighting_of_ref": "indicator--028074d5-c552-4a5e-bcc0-ccbc6fc77ece", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d24df841-8ecd-486d-a503-4fdba63b35e1", "sighting_of_ref": "indicator--fba8d07e-c369-4c97-aed2-18da365a6ed7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbf7415f-8f32-4200-a63a-4405471c1f94", "sighting_of_ref": "indicator--25943499-ed40-45bd-a1ed-3d33e5f9e3dd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6428f2d-9c86-4e68-baaf-15aa62fa4149", "sighting_of_ref": "indicator--cc8ecff5-8aad-4a3e-9525-14500d35b4ee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e29989f-db09-4522-928a-4d3d3bb48027", "sighting_of_ref": "indicator--5f3ac927-7683-4653-881a-af00ff80fbab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e80c0fe4-51d2-4562-92db-951fdf9fea0a", "sighting_of_ref": "indicator--5f3ac927-7683-4653-881a-af00ff80fbab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7cfd25a-02e0-4017-9dbb-cb11a0436d37", "sighting_of_ref": "indicator--cc6ee92c-54f0-4238-af3d-5ed4d9495ec8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a07582a1-3527-4117-be05-622d09695df5", "sighting_of_ref": "indicator--cc6ee92c-54f0-4238-af3d-5ed4d9495ec8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--330a7158-55fc-4a6b-aa80-14de80384d38", "sighting_of_ref": "indicator--f9af7193-e4c7-4a36-9bff-f626335a1d16", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b1edee-edf4-4473-84b3-e4254fc8da65", "sighting_of_ref": "indicator--f9af7193-e4c7-4a36-9bff-f626335a1d16", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b39408-027f-47bc-b930-05a172ada10a", "sighting_of_ref": "indicator--f1d53912-9a9b-44df-8ac3-9ff1cb304670", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efbe6f21-fbb0-44bd-be7e-25460209425f", "sighting_of_ref": "indicator--f1d53912-9a9b-44df-8ac3-9ff1cb304670", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87b6e714-b19f-4d98-b4dd-e39587ad6100", "sighting_of_ref": "indicator--8148ec0e-e58e-413f-850e-eaa499ca37a1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--185faa1d-4a21-4cc7-bd64-3560a9d966b1", "sighting_of_ref": "indicator--a5961c3e-5622-4e26-a4cf-5eee0fff939f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f97a9e3-0d81-4d1f-beb0-4905baac073f", "sighting_of_ref": "indicator--a5961c3e-5622-4e26-a4cf-5eee0fff939f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--750a1afe-d329-44ab-bcd6-b087a29975c1", "sighting_of_ref": "indicator--922ac969-9211-4aaf-a589-16f5074332fa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a299af2d-a1df-432b-bd62-e67a0fb29c56", "sighting_of_ref": "indicator--75dbd7dc-dbb1-4b8d-a71e-9f407345cc16", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db89ffa1-4a07-4968-a390-cd34b70a404b", "sighting_of_ref": "indicator--f900b849-694b-401f-b887-7cd503c5b2e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24b3f4c2-3ab5-4203-ae77-b82b84e39d93", "sighting_of_ref": "indicator--5f49332c-2579-4aed-b1d6-9cb4bae8ea79", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8c34c08-5168-484e-ba6b-d018db7a3da6", "sighting_of_ref": "indicator--446ea14b-b60b-4efa-b4a6-e41d32d69f88", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ec7d5b0-3fff-4022-b310-3f1bd0b72ee8", "sighting_of_ref": "indicator--541c5f20-d18d-4629-9346-7d38718fbed6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbfea543-4dda-4bfb-888b-fd020ee711bd", "sighting_of_ref": "indicator--4437b1cd-c428-4222-b5b6-fbae558c0579", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cfd80a2-a2d9-417e-a79c-793363068c6d", "sighting_of_ref": "indicator--a18f59a0-b41e-4ba7-817d-04b9c062c80a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--948a57e0-1a32-4dc5-9942-a016fc588be8", "sighting_of_ref": "indicator--a18f59a0-b41e-4ba7-817d-04b9c062c80a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--554d22e3-4da9-47fd-840a-559a92764e20", "sighting_of_ref": "indicator--c059f769-094e-4fc9-8dcf-b722def438f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18f757a1-abd7-48ac-a7d1-8851c86df11d", "sighting_of_ref": "indicator--14f299c4-74b2-4f60-b45c-a7eafef7ca7f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3a5cb9c-1875-4bbd-8525-87dc347dcb57", "sighting_of_ref": "indicator--08ef9dfc-414d-4179-a653-643c1664b847", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54440ee5-090a-4533-a6a4-a0d47b19e398", "sighting_of_ref": "indicator--08ef9dfc-414d-4179-a653-643c1664b847", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--726f5571-1790-41fe-bd18-135a7cf98841", "sighting_of_ref": "indicator--78460bc9-d5f5-40c3-b066-7ee32b316ea4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f973ff47-30b9-48c3-81a8-b6046cac2606", "sighting_of_ref": "indicator--78460bc9-d5f5-40c3-b066-7ee32b316ea4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa66c566-066e-41cf-a443-09275f37632a", "sighting_of_ref": "indicator--aabddb69-3118-4612-bb95-ddbe8a41be37", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85b3c4b3-3ba3-49f9-a306-47729d8ddae3", "sighting_of_ref": "indicator--c7f72448-58e2-43f4-9756-5df3531e7f50", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dee4643-a49b-4c8a-9eee-599ed94a1f31", "sighting_of_ref": "indicator--c7f72448-58e2-43f4-9756-5df3531e7f50", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ef5ba9d-b305-4572-8a62-670a44da62c8", "sighting_of_ref": "indicator--42e7d06f-4ff0-40df-bcf4-49d0765506f3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69ba06f2-8e8f-4d47-b0a6-aac874c77884", "sighting_of_ref": "indicator--42e7d06f-4ff0-40df-bcf4-49d0765506f3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b01bbfdf-b4a3-4936-a429-30ddee4467e4", "sighting_of_ref": "indicator--b56234d4-f0af-4160-a428-a127b3ae041e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b19b3f1-05dc-4543-b8e6-c98ad346b3b8", "sighting_of_ref": "indicator--381f427a-5ed5-42f7-838b-55ccd329ee78", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2194935b-4cf0-4aa9-b218-81213963725d", "sighting_of_ref": "indicator--f3a449eb-15f6-421c-9328-219119253d87", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e250cde3-f7b3-4836-9397-790c976aa327", "sighting_of_ref": "indicator--f3a449eb-15f6-421c-9328-219119253d87", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a699372-37f9-461a-b482-cb2b4aa14576", "sighting_of_ref": "indicator--5862595a-a764-4203-9ae0-8f30aefd98fe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9ee43fa-88f6-4b1e-82e9-7359f6f10ed4", "sighting_of_ref": "indicator--aa4bb615-a71e-4e50-bfe0-1c7e58a6b0f9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cab1fab0-4c59-4ef3-90ba-153f823596d5", "sighting_of_ref": "indicator--aa4bb615-a71e-4e50-bfe0-1c7e58a6b0f9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f160ec4-d509-49f2-8df2-23738b375e54", "sighting_of_ref": "indicator--20ae387c-ffd8-45b1-b1e0-6299dc6b522d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a31559a5-fa94-4111-87fb-32cde7f37d60", "sighting_of_ref": "indicator--e4959803-ce75-4ce4-868d-1fd202d7e988", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84b793dd-8245-4c5c-afcd-d69fd6664a94", "sighting_of_ref": "indicator--7dcb37ce-dd46-4f0a-aaae-c5378324c955", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b74a0275-7437-4319-b0de-87d609a36c18", "sighting_of_ref": "indicator--7dcb37ce-dd46-4f0a-aaae-c5378324c955", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34e88236-58de-4493-9de2-c0ce110432e5", "sighting_of_ref": "indicator--7799d458-9490-4245-a8d2-58ba357fc7f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b73f5ab-f6a9-429f-8d36-0c1c5b56a3e7", "sighting_of_ref": "indicator--95136358-6b6f-4aae-86ac-6b1151f672eb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f6d9dee-d1a5-46e6-aff7-7161cfb2d5b7", "sighting_of_ref": "indicator--a3819678-8dfc-4bc8-996e-de2141302635", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--300dc987-f64f-45b2-a56c-0491e6aedffd", "sighting_of_ref": "indicator--2907c24f-1044-427b-9830-bc3a6c7a3fde", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e6e973f-0231-4750-839a-99b50731a832", "sighting_of_ref": "indicator--ad42beb9-6f3b-439b-a4ab-753805ef5c08", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--809ae9ca-e6fc-4a7a-b382-24b1a68b65d9", "sighting_of_ref": "indicator--41049c23-3671-46b5-ac2e-0b33880cbde3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edc8ca2e-5ee6-4759-9693-b1b2c5a03c22", "sighting_of_ref": "indicator--346b6592-ed5c-4ca8-ae13-23c5d6e52b35", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d39d201-a3be-4b43-9ff5-6edc0a870337", "sighting_of_ref": "indicator--346b6592-ed5c-4ca8-ae13-23c5d6e52b35", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf73b648-c082-422a-a4ee-7f8ebe66c313", "sighting_of_ref": "indicator--f4560234-edd7-4df0-a14b-8d55dbecec8c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--583df654-8eab-4eb2-a8c9-7c2a2fd75aec", "sighting_of_ref": "indicator--f4560234-edd7-4df0-a14b-8d55dbecec8c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37d61a54-ccff-4126-8203-b79f0c29bb99", "sighting_of_ref": "indicator--668fec59-0476-432a-a83c-535f1bfdd65d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2423fc1c-7848-46c2-a9e2-9ebc2184bb85", "sighting_of_ref": "indicator--82187daa-fc9c-4864-92cd-3743b389d845", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--514be787-92db-481d-8a79-eaad0c946506", "sighting_of_ref": "indicator--82187daa-fc9c-4864-92cd-3743b389d845", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06359ad5-d584-4d9b-a0a5-42d455689bcc", "sighting_of_ref": "indicator--654090db-e634-46b1-92a7-43af2405a188", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--862fa99f-21e9-4682-adc0-3ba6b9558ea3", "sighting_of_ref": "indicator--92b4994c-dd91-4f9b-8cf2-f1b11fb3e888", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75adfdf8-b810-4d15-8003-2c2653256f6d", "sighting_of_ref": "indicator--44bc411d-1477-430a-baac-0edf84a98fdb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f94bdc74-71e2-4991-be88-4bbc54a902cf", "sighting_of_ref": "indicator--21da6bdc-b8ba-491b-a623-988733c538aa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--585889fe-7812-48a2-bbf8-584eb1e9888e", "sighting_of_ref": "indicator--5e408ce4-6642-4fad-82d8-8f667bf5fd96", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f296859-be26-4f91-bdef-a3eb880df6a9", "sighting_of_ref": "indicator--6139e006-5f45-402c-bd3f-c280b6b59172", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a84927d6-2095-4e7f-b46e-c0107036d6cc", "sighting_of_ref": "indicator--77d47f79-66e3-430f-9f3a-085812d0b27b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--819f052c-f2d0-4034-84db-6e5a31934c4e", "sighting_of_ref": "indicator--77d47f79-66e3-430f-9f3a-085812d0b27b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cea0135-f26b-44b6-aa25-546b62d058dd", "sighting_of_ref": "indicator--4eea1d22-af32-40aa-9ce0-4cfa6b2ff78c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9112972a-d812-40df-9f06-983abccdbf74", "sighting_of_ref": "indicator--0d1a3b7f-a9df-47c2-a8fc-53f16ac7510c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8072f904-c61e-45c3-b123-19a8c095136f", "sighting_of_ref": "indicator--0d1a3b7f-a9df-47c2-a8fc-53f16ac7510c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4350dc34-58fa-4db4-b2fd-4d0f589a9093", "sighting_of_ref": "indicator--fe22997d-8c39-46c5-b567-365fd7541be2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25f06b3d-ae80-40d0-aa36-197d10da9523", "sighting_of_ref": "indicator--b07e44cc-44c0-416a-b0f8-8a24402c39a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1c7caec-9024-4989-9ba3-e5fb9919535d", "sighting_of_ref": "indicator--f9a8bf42-49c1-42a9-93df-e07761407dba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51484225-73dc-4e1c-9b4f-f0b472acfa29", "sighting_of_ref": "indicator--f9a8bf42-49c1-42a9-93df-e07761407dba", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b2a4cce-120e-44fe-8abf-382f992a9d06", "sighting_of_ref": "indicator--79fe3641-575d-44d4-8e94-3dfa5efe9d4c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--957529d3-f0cd-45c0-8862-2bad9d882afb", "sighting_of_ref": "indicator--8063b3b0-3f3f-4a43-98fe-d72c793bfb8b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a43355f-9bde-4bb6-9e62-bb14adccdfca", "sighting_of_ref": "indicator--19392b5f-b355-4911-8451-16321030ea8e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--591c37ce-a3aa-494b-9e4e-4eb16ef84668", "sighting_of_ref": "indicator--a1d9163d-301c-4cf0-8acd-b6492f228c54", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a0f4cea-faca-4834-88c7-89241bd7e5d1", "sighting_of_ref": "indicator--a1d9163d-301c-4cf0-8acd-b6492f228c54", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--111efd1a-0e6b-435d-a498-a39a3e0060bc", "sighting_of_ref": "indicator--3b0ee646-c89e-4f1f-ba86-a0a0fa2ca7f4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d709951c-8ab1-40f9-a122-3554df3137d5", "sighting_of_ref": "indicator--e1698ffc-6adb-4ac1-9d9a-ebf2da051eda", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecb51c08-82d5-413d-aee7-10c99be7a674", "sighting_of_ref": "indicator--c28ce7c9-a272-49c7-bae5-a73b6c3056e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beabca2e-8c63-47bb-98b3-8847289b493c", "sighting_of_ref": "indicator--c28ce7c9-a272-49c7-bae5-a73b6c3056e1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba48c298-0add-453d-82f1-a70428678d3c", "sighting_of_ref": "indicator--8794588b-8cba-457a-9cd5-50ec803a61ae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2daf4010-8c79-4fcf-9fe4-5cffa77b59d1", "sighting_of_ref": "indicator--8794588b-8cba-457a-9cd5-50ec803a61ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--734ad4af-d0ff-481d-8eec-1b61d1710d99", "sighting_of_ref": "indicator--7a387294-5489-4be3-b70a-e657b6900775", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8f49e2a-21f0-49c4-90b2-f039add19c2b", "sighting_of_ref": "indicator--7a387294-5489-4be3-b70a-e657b6900775", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19d81dfd-029d-4912-bde3-c657b188be77", "sighting_of_ref": "indicator--fa3da78b-9d35-47d7-b656-cea18e2a6166", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4c24b70-41f3-48f8-a0f2-4f0c055c5335", "sighting_of_ref": "indicator--01c0ca5f-fe4a-4dee-ac59-b182c98cbd44", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1586627b-9139-4cc8-b7da-69fab54dde91", "sighting_of_ref": "indicator--01c0ca5f-fe4a-4dee-ac59-b182c98cbd44", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0337f14-971c-4c27-a7a0-22540c8f75b6", "sighting_of_ref": "indicator--aced1914-2f81-4f69-bafd-3b0522be1fa3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67cc2ed8-5c69-48b5-aaa6-8224b4cc534d", "sighting_of_ref": "indicator--9ef182b6-f807-49c9-906f-906b9084742f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0393c12c-cd70-4d0a-bc93-72ed96a5191b", "sighting_of_ref": "indicator--79f955b6-8b46-411c-a8d3-3598ffdf18a1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cedcfdc-bef4-4622-904c-ea076644d743", "sighting_of_ref": "indicator--c7a4ad6d-5d26-42ae-bbcd-8003a06fe1d5", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17193e85-4724-47f1-9454-17175011913e", "sighting_of_ref": "indicator--800f53a2-6e06-4e5d-855e-37fb0b50ca56", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6109f11f-2375-4336-a146-e45e85f8ca46", "sighting_of_ref": "indicator--9d39cef7-42b9-4626-983c-35845e83ee50", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e396421-ccf2-4a09-9d6b-8f2c22d9ef87", "sighting_of_ref": "indicator--beea56ec-f317-495d-beb3-9dc9dd450226", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17dcccf7-d2fd-46d8-ab05-18e59167a52b", "sighting_of_ref": "indicator--db52f17d-7757-4584-93e5-73ef83b46d87", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfd89e86-209b-4f17-a57f-3abf14e784c5", "sighting_of_ref": "indicator--49dc4487-8bec-4811-83a2-be313a1c8f28", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba6d0ea7-ce06-4896-bef9-749be1957824", "sighting_of_ref": "indicator--3be1f3a1-a8e6-4e8f-a4b1-5893fc1f03bd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40096bbd-66cb-4fe7-9b00-2ace55516901", "sighting_of_ref": "indicator--8dc8f8ca-051f-4aa7-99cd-15ec0b2c0e80", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bba09bf7-e4bc-4027-a784-0b9baeb52f15", "sighting_of_ref": "indicator--79d946a4-1edb-4886-90ee-3ca91d90216a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--541bf1af-9319-4c4c-949e-5a59e5a864b3", "sighting_of_ref": "indicator--2dc153f6-f3cd-4e2a-be65-51f0f4431451", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9cc569c-2f99-4290-be1e-2d321b4f0f65", "sighting_of_ref": "indicator--abb3f1a8-b7ae-4809-bf75-d4ad6283e522", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6d11f41-42d2-4651-9ce1-042d6b050c71", "sighting_of_ref": "indicator--b59ad771-bd3a-41a3-aae4-1b152d1df3da", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e735b80-e1ea-438f-a74e-288c4e1b5865", "sighting_of_ref": "indicator--3c4d06fc-100f-4104-a9a3-9e595d88a473", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f56a3098-88d6-4885-8e66-164fa8d77a81", "sighting_of_ref": "indicator--51ddd5fe-9117-4b3b-99a4-00adc62ede57", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acee2eea-e838-4a9d-b197-b4750e792f09", "sighting_of_ref": "indicator--aafe728c-39c3-452f-b238-3cd9e989f211", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62ca69f3-b4e8-430c-b9da-4957b8657395", "sighting_of_ref": "indicator--e1ea8af4-4a85-4b61-b3ee-c88a6f9e5102", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c770b4bb-6264-4d3a-9374-ce5e14933852", "sighting_of_ref": "indicator--539bfb06-5440-40f1-8f19-5979816954b4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b9cc069-c24c-431c-8e57-4afe39d57926", "sighting_of_ref": "indicator--b6b3e0a5-a605-4442-a58a-e4993c296c1c", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c33036f-1028-4c71-8899-fb2d9c3c5e8d", "sighting_of_ref": "indicator--1862e846-5b61-457c-bbf5-bf1537317a95", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45ef2abe-69c9-42d6-ab98-c6c02f83c815", "sighting_of_ref": "indicator--fc3b0be8-9249-41f9-95ea-aab5620e1352", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a69949d-dde6-4339-b995-1655aa6859c8", "sighting_of_ref": "indicator--4c385033-67ff-4c06-bec8-c6ba6af852b8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1de11eaa-c871-444f-b2b4-41e20ef07fc2", "sighting_of_ref": "indicator--347b4952-651b-42a8-88e6-3da6cb2490c5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bab3e129-9d6f-449f-bf6f-c77888815e43", "sighting_of_ref": "indicator--288d84c6-63dc-42c1-8232-e928caef244b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b68eb59-69ff-4c73-94a7-945ffc1d15e0", "sighting_of_ref": "indicator--3e03fe5a-b0d3-441b-a00a-c0998e88e0c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2585faa1-791f-4513-93c7-eee3486c28ba", "sighting_of_ref": "indicator--3e03fe5a-b0d3-441b-a00a-c0998e88e0c4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b853ff8d-a1db-4929-8890-1bba4293aefe", "sighting_of_ref": "indicator--4bcb72df-cd37-4963-acbb-7bb008c451c1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abfdf2fd-21e3-4ca6-b885-8ed90c0eca69", "sighting_of_ref": "indicator--4bcb72df-cd37-4963-acbb-7bb008c451c1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da4daccc-346d-477b-9482-f35f42a16faf", "sighting_of_ref": "indicator--65088f92-1839-4d82-88ed-69721de51c26", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb905ddb-c98f-4a48-a7bb-54a48aad7586", "sighting_of_ref": "indicator--65088f92-1839-4d82-88ed-69721de51c26", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--009e134a-ac26-4f3f-bbd0-b7e482f27c4c", "sighting_of_ref": "indicator--7bbef49a-474c-4fb9-8e6b-eee89f527b4b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5f830a4-8308-46c5-86ca-d5bf768d7f46", "sighting_of_ref": "indicator--7bbef49a-474c-4fb9-8e6b-eee89f527b4b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1368c138-921a-4b0d-bba4-4f2dbdeeb394", "sighting_of_ref": "indicator--c74b83c3-5ede-43db-8b75-bc6a5edb1120", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a312f07-46c6-4b2d-afef-c2d65565201b", "sighting_of_ref": "indicator--628c4640-b392-4fce-9d80-19dc938747ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d8881e7-596a-4dcc-a926-fcb1305fbfdb", "sighting_of_ref": "indicator--40fa1dea-7d2c-4272-9030-4e25d853b27f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a1046e6-7f10-49b1-97c6-bee1fc7823ed", "sighting_of_ref": "indicator--40fa1dea-7d2c-4272-9030-4e25d853b27f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83fcc567-d4d7-41a7-bcd4-08180a9ac98a", "sighting_of_ref": "indicator--06b97eb8-00bd-4a93-be74-baad3b21eae6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15215bea-a5e9-445c-ae08-09df6cb38d16", "sighting_of_ref": "indicator--dc1bc39a-ab87-43d4-bc39-a04670e2fbe8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16c7fbad-a429-4d68-a13a-f1791f455864", "sighting_of_ref": "indicator--e9271e08-d3aa-459f-91a3-4ed40bec87ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80e0fd0c-4d32-4fe6-aba5-d08d50d04cd6", "sighting_of_ref": "indicator--e9271e08-d3aa-459f-91a3-4ed40bec87ca", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--396aa927-f4d3-4928-a793-1b8e56c9d39b", "sighting_of_ref": "indicator--c2319228-dcdc-43f4-88c1-76a3b82da57a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0b335f5-bdbe-499d-b443-5295f2976d92", "sighting_of_ref": "indicator--bca7d52b-fe0e-4c2c-9f98-da6df4e30155", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54493d28-cc85-4761-bdce-834521370d98", "sighting_of_ref": "indicator--27f563d1-d05b-4c69-85fb-82bb256d6e96", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce926ef7-2ded-499a-b430-e34b088abcf5", "sighting_of_ref": "indicator--27f563d1-d05b-4c69-85fb-82bb256d6e96", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--886adbbf-5a7c-4bf3-897c-074b612bab51", "sighting_of_ref": "indicator--230a8b08-b81b-4a0a-8b06-2d3bc7de0eb0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f9390b7-73e7-4fa3-bbdc-e24c7318c4e7", "sighting_of_ref": "indicator--230a8b08-b81b-4a0a-8b06-2d3bc7de0eb0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbf4c6eb-a529-4542-b073-c43c83b4e693", "sighting_of_ref": "indicator--b1ae5281-111e-4dda-b6c5-a7754cff779a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa2ea706-8d1e-45b3-bc31-e14ed5a92bc1", "sighting_of_ref": "indicator--b1ae5281-111e-4dda-b6c5-a7754cff779a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1240eada-12b6-4e5e-adad-d4efa4ac76f6", "sighting_of_ref": "indicator--6d305bc1-8be0-483c-9aa1-ce255c38683d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fec8320-c07a-453e-acc7-c691be8bcdeb", "sighting_of_ref": "indicator--6d305bc1-8be0-483c-9aa1-ce255c38683d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d92c730-8245-4161-a49e-bc3f05642ad6", "sighting_of_ref": "indicator--89ba594d-7ca6-47cf-b9d7-df93c7714b6c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--022774da-2d89-4140-8b30-fc5c76b3237d", "sighting_of_ref": "indicator--89ba594d-7ca6-47cf-b9d7-df93c7714b6c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e86c9ca3-1956-4656-a3b5-1c994e25a66b", "sighting_of_ref": "indicator--4768787e-4787-4185-9c05-c4aeeb1dde46", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fd63016-711b-48e5-ad96-2a12cc66ceb1", "sighting_of_ref": "indicator--4768787e-4787-4185-9c05-c4aeeb1dde46", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6d4bf32-fded-4afd-aff9-49762e3a1531", "sighting_of_ref": "indicator--a7511dbe-947a-4553-83d6-f7f46e0bf861", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62ece9b8-99b4-401d-8bb0-150dcdb7d34c", "sighting_of_ref": "indicator--134b2ee2-2e25-4245-b9a3-ad73029886f1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e95c4140-4c49-4261-8415-bceea3da6df1", "sighting_of_ref": "indicator--134b2ee2-2e25-4245-b9a3-ad73029886f1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aca2d099-b34d-466a-ad3e-9049d2c7abf0", "sighting_of_ref": "indicator--50f698b6-0d08-4915-9b8b-fc4f7b951853", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b841168-dccd-461e-8dd9-2f9bc6464bbd", "sighting_of_ref": "indicator--68371870-b5d6-4640-88a6-932b36c8f62a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4602245f-3720-43e2-957a-cdb61738b4b6", "sighting_of_ref": "indicator--68371870-b5d6-4640-88a6-932b36c8f62a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4b314e5-0fda-4d89-a24d-a57a7efa4891", "sighting_of_ref": "indicator--76e551ec-491f-4f6f-81f7-5c2e9138acdd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69bf873e-a738-46a6-a241-7b8d75f8783c", "sighting_of_ref": "indicator--c0d4b3b1-3ba9-42ca-ba14-c14c9247e4a0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8efb409-7d10-4758-a845-df7ef9ed2775", "sighting_of_ref": "indicator--c0d4b3b1-3ba9-42ca-ba14-c14c9247e4a0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3f1d1cd-57f2-4100-9581-2d08d48399d7", "sighting_of_ref": "indicator--08c24edb-8b0c-4691-a8c2-fe1413aa6727", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--830698e6-da58-4c55-86f8-b53bb87f9231", "sighting_of_ref": "indicator--08c24edb-8b0c-4691-a8c2-fe1413aa6727", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--177ad42a-2811-4fa8-b153-da03cc5310dd", "sighting_of_ref": "indicator--a0a30613-a20c-4810-af72-e5b5b18e3568", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--638e956d-226f-48b3-b4ba-0286644fb4b0", "sighting_of_ref": "indicator--5a37db9c-cc81-4820-8a65-8f49f47f486d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b11fa55-1806-4e7f-a9d6-bf8dbe135443", "sighting_of_ref": "indicator--22dacfae-eeb7-4187-ac51-0a7385776a65", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f803bbd6-69da-457e-bf00-e2a3e6fe7cf9", "sighting_of_ref": "indicator--2083f2c3-93db-47f3-a9d0-e5345f8513af", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c444b2b4-8c8a-4cbd-9401-c475f9fc184b", "sighting_of_ref": "indicator--516c6a0d-08a9-48dc-aabb-07d75bd3458a", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14033df2-2ee1-49fc-aa00-ae8fd46910ce", "sighting_of_ref": "indicator--516c6a0d-08a9-48dc-aabb-07d75bd3458a", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0545be88-24f0-4ce9-a26b-84e37cd36ee5", "sighting_of_ref": "indicator--516c6a0d-08a9-48dc-aabb-07d75bd3458a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5ea7d9e-5b4c-47b0-af5c-793844545911", "sighting_of_ref": "indicator--516c6a0d-08a9-48dc-aabb-07d75bd3458a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7faac38b-4f50-4f60-8618-1ad6beb9c590", "sighting_of_ref": "indicator--516c6a0d-08a9-48dc-aabb-07d75bd3458a", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d33885e9-ee3c-4310-adee-578986fe21e0", "sighting_of_ref": "indicator--75d9eec8-fe0d-4f5b-b13c-7e7935ab980a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97e94fac-abbe-4aca-aa06-e37363246365", "sighting_of_ref": "indicator--75d9eec8-fe0d-4f5b-b13c-7e7935ab980a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c069eeca-d6be-4ba1-b269-dffb1448a3aa", "sighting_of_ref": "indicator--75d9eec8-fe0d-4f5b-b13c-7e7935ab980a", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b67be52c-7211-4fca-8fc5-19d68e66d080", "sighting_of_ref": "indicator--f544206f-99c6-4845-aa97-ddeca1429567", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f850d8e9-b66d-4eb6-a3e3-2cf4b8ef1527", "sighting_of_ref": "indicator--f544206f-99c6-4845-aa97-ddeca1429567", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58b28dda-9e67-4f7f-920c-d6a6f10ceda9", "sighting_of_ref": "indicator--f544206f-99c6-4845-aa97-ddeca1429567", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c1a80a5-5f33-4e18-a472-29a257243d83", "sighting_of_ref": "indicator--bcfe5bec-7e42-4bdb-a046-d9252a399a50", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--885cb813-3647-4631-bdfe-21642c6b6ec3", "sighting_of_ref": "indicator--bcfe5bec-7e42-4bdb-a046-d9252a399a50", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a049b055-f390-4f41-91c4-7d5d11b9c00f", "sighting_of_ref": "indicator--bcfe5bec-7e42-4bdb-a046-d9252a399a50", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fda91a75-b4bb-4f0d-a980-de1e646cc537", "sighting_of_ref": "indicator--de4b7903-eaa5-42e6-ad16-9a97438ecdf7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c20fc889-62dd-47ac-b3e7-94d9142ef9d2", "sighting_of_ref": "indicator--de4b7903-eaa5-42e6-ad16-9a97438ecdf7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcaf6063-5355-4457-806c-2f6efd1b88ab", "sighting_of_ref": "indicator--de4b7903-eaa5-42e6-ad16-9a97438ecdf7", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1313fde0-e12c-478c-b7db-3e912587dd26", "sighting_of_ref": "indicator--1e34a978-5c6d-43de-b091-a6ce513da4d4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c63f187-b2e5-4f4f-8488-eb321645edf7", "sighting_of_ref": "indicator--1e34a978-5c6d-43de-b091-a6ce513da4d4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2464b78-6c40-4eff-b99b-182cea41bbae", "sighting_of_ref": "indicator--1e34a978-5c6d-43de-b091-a6ce513da4d4", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4b70872-4258-4af9-9654-baa911fb69c2", "sighting_of_ref": "indicator--1ffcd551-ef22-438e-9009-253d588a1b58", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--912426ef-9f39-4877-a24a-893be48abd87", "sighting_of_ref": "indicator--1ffcd551-ef22-438e-9009-253d588a1b58", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--576e04bf-6f74-4e27-982d-ad80194f6469", "sighting_of_ref": "indicator--91d245a8-864e-4d60-b750-e4f1e3dda891", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32986de2-b4b5-4ac9-be0a-d251ea703289", "sighting_of_ref": "indicator--91d245a8-864e-4d60-b750-e4f1e3dda891", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad795a62-d352-41de-9ed6-77058b277a90", "sighting_of_ref": "indicator--6ab59b61-d53b-4f99-8505-9f18a7e5baf0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fae7f4f-8ea0-4298-bd2a-cc2243d83f5e", "sighting_of_ref": "indicator--6ab59b61-d53b-4f99-8505-9f18a7e5baf0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e080d705-73cc-4399-a853-76f409838d8b", "sighting_of_ref": "indicator--4e1fb9ab-bcd2-4f01-a52f-5372d08693e3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f2129d0-4a64-4655-ac91-dcef6b4e313f", "sighting_of_ref": "indicator--4e1fb9ab-bcd2-4f01-a52f-5372d08693e3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ba598ba-2fe0-4592-a789-824a50f839ee", "sighting_of_ref": "indicator--bd0e9964-2c38-47b7-8837-bc2e4c928756", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e323089-b4b8-4c36-8a7c-507f6f88e4ac", "sighting_of_ref": "indicator--bf8cf3d3-98ed-4a8a-9d0e-c5ca40491f63", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fb8cb17-a97d-4e14-986e-429fb2c0ae66", "sighting_of_ref": "indicator--95fdfde6-9703-455e-8aa6-049f1ea7e1a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57aad5b9-b5c2-49d0-9bcf-a5150697084e", "sighting_of_ref": "indicator--1b16de27-94cd-4d21-a3bc-b124d03ac8ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ee367e8-f3bb-4891-ae23-386e41ba291f", "sighting_of_ref": "indicator--1b16de27-94cd-4d21-a3bc-b124d03ac8ca", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f834c152-7ae1-451b-8de3-dbbeef8d27ec", "sighting_of_ref": "indicator--4f6ed90e-95f8-4a0c-aa1b-3406406de541", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c9c33e1-a672-4245-b287-0640f2d03151", "sighting_of_ref": "indicator--808fa081-8078-47fa-be44-c2bd355ea4be", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--181778dc-eef3-4a56-88c5-fc48463f1311", "sighting_of_ref": "indicator--df39c178-f38a-4b46-98b6-74b34e5b67db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72cc3c88-acca-45ec-aed1-8e569a89563e", "sighting_of_ref": "indicator--df39c178-f38a-4b46-98b6-74b34e5b67db", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac4dd3a2-5663-40b7-9304-4b893d7d905e", "sighting_of_ref": "indicator--665bac74-de6a-43c8-9e7f-4d768197993e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d047108-0573-4883-a86d-228a9c81ad57", "sighting_of_ref": "indicator--0d92c211-e10a-4b73-b653-91ab388fd273", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e87318ce-10b0-4c53-8ad0-e80781d488e5", "sighting_of_ref": "indicator--90e2560d-ce68-4f32-a68d-c94371205b6c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fec6822-b5b7-4ebb-a50d-7d017264ba3c", "sighting_of_ref": "indicator--3f328cce-797c-4996-a296-b16721363b18", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--922a2f95-1d33-4492-84f4-e44a1c40a9b7", "sighting_of_ref": "indicator--3f328cce-797c-4996-a296-b16721363b18", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9831e2f0-40ba-411f-896a-952d9c0ff817", "sighting_of_ref": "indicator--4b6cb6f9-1086-4296-a4f2-62f067c68fc7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--801b1916-7dcf-46cd-9ac5-bf63cbd7ad36", "sighting_of_ref": "indicator--ad81fb89-3fe2-4f06-bad1-ebf5c6330db0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afb46e90-3082-4944-93b0-5e63393bf3d3", "sighting_of_ref": "indicator--c2aa532e-4753-4b52-b02e-6b5d0ba8a3ef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--862d1164-cb1f-4bcd-9923-1d064de13af0", "sighting_of_ref": "indicator--98b72442-5be3-47a1-8b93-5bf43ab7c8a9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--120ce6ec-8973-4269-84f3-dcc3cf456963", "sighting_of_ref": "indicator--e4709957-98d9-44bb-8cb3-9640ae3ad0ef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b03f49eb-f12b-43d9-b679-ca04c1a949cd", "sighting_of_ref": "indicator--e4709957-98d9-44bb-8cb3-9640ae3ad0ef", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82dae58a-b206-448d-ac84-3cb2eb07947f", "sighting_of_ref": "indicator--e81923c5-07b1-40d3-92d5-9a12daf5848f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be9a1bf2-0fb1-4573-af3b-a3e2e1604175", "sighting_of_ref": "indicator--99855d0f-a250-4bf6-af8e-8b1e3f00c8ab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd56b25c-073f-43fb-83c9-91865532bd90", "sighting_of_ref": "indicator--6181930e-75ef-4fb7-8940-d6bacdf425b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b33353b-3a5d-42e7-bf6c-1730fd58c638", "sighting_of_ref": "indicator--e6c9cd12-bcb2-4999-b37d-10d6931f7c13", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--394f2783-62ea-4f97-831f-29f72bff54df", "sighting_of_ref": "indicator--b40779ea-6a01-4995-b7fe-a10d01a9555d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01f4fbdc-d6e3-41ba-af75-d699043145de", "sighting_of_ref": "indicator--b40779ea-6a01-4995-b7fe-a10d01a9555d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb303414-0a23-4be2-98d3-b0808a05e1a4", "sighting_of_ref": "indicator--a2cbb7a8-9275-4119-bfb9-9010f8ed9bab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2936b3cd-61b0-4165-82af-0693752ef746", "sighting_of_ref": "indicator--a2cbb7a8-9275-4119-bfb9-9010f8ed9bab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18a84362-c11f-4dd3-a9f5-ac21b50c5a89", "sighting_of_ref": "indicator--bb49dcb7-2020-4a9d-9164-85239be618a6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c099037-4834-4aa7-bf6b-915454d3c89b", "sighting_of_ref": "indicator--bb49dcb7-2020-4a9d-9164-85239be618a6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de4271bf-5d6f-4f06-b3e9-82aba00cc37d", "sighting_of_ref": "indicator--fcb1a1dc-5686-4455-a132-91ddc63fcd68", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03fab891-5157-4416-bf81-0d6382bffea5", "sighting_of_ref": "indicator--1802bf46-8749-42fd-892e-d042bd77608b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70659ccb-3cbb-4734-8d5b-dd66100d0f7a", "sighting_of_ref": "indicator--6f30c774-c633-42c8-b5ba-402716fe6492", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74b83ff8-7447-41aa-a6ca-56febd84c834", "sighting_of_ref": "indicator--6fe6b0ea-9edf-416a-8f70-b4e5ff028989", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02c2a2a4-02a4-4559-a14c-e5b7fbf49c16", "sighting_of_ref": "indicator--6c8f08ff-a3e9-4f61-8ed7-4c6b931af871", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8e9e917-c0da-4d9b-b48f-ca04f46b888f", "sighting_of_ref": "indicator--e66f83bc-acd5-407c-9cfe-20d6744c7955", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61b835c1-9a0a-411d-aced-fe131e69d03d", "sighting_of_ref": "indicator--fd7d532d-e84a-4121-87a6-ba22d81501df", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8605dcc9-bb5b-45fb-8526-a251f3b053c9", "sighting_of_ref": "indicator--09f06f00-144b-4712-9c9e-2f0096291dd2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d28ef09-c55f-4909-8934-f60182eac0c9", "sighting_of_ref": "indicator--81ec2eff-2dd2-45b5-beec-72a51353e512", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--754ba873-1ecc-44f7-a33d-64f35ea40fce", "sighting_of_ref": "indicator--a706c8a8-be06-4038-8367-afe434a3f7e9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fc991d5-6a95-439f-88fe-e1b818bb3aa5", "sighting_of_ref": "indicator--b58cdc94-869f-4201-bf6f-010e8ac72079", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f0f5223-c248-4c1d-8cca-d34162df6aed", "sighting_of_ref": "indicator--f1968e84-30b7-46ea-bb3e-ede740e5b2ba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa1d6562-c9bf-470d-9d6a-b6a746b2bbf6", "sighting_of_ref": "indicator--84ed05a5-9a19-4a48-8d18-9c32d6b3be8c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7ad98b5-cb22-4a69-817e-1410fb8bf499", "sighting_of_ref": "indicator--608d4f98-b3e2-43e5-8b8f-fd1d575e4901", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11a06bc8-5876-4af9-87be-0f080e0b30bc", "sighting_of_ref": "indicator--003ebc92-0a05-4071-850b-5c7b6540ad7a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f2f8f87-d581-43c3-b44f-c67dcba64b23", "sighting_of_ref": "indicator--3c50017a-6787-4fce-97dd-9586c5758d95", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00a162a2-519f-471d-a3d9-b8a4eca46f4c", "sighting_of_ref": "indicator--c99c503e-4367-4827-9d6e-00d3955da9fb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e045d1dc-500e-4886-8432-a3b531fc57bc", "sighting_of_ref": "indicator--718ecb5c-f5b3-400a-a921-f1c891850ac1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fca437d8-f125-485a-a5a4-c33e22ea1da2", "sighting_of_ref": "indicator--18fbdffd-8c94-4d42-bda7-9e71fddc6825", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eabb785d-5981-4aec-99a0-0e95567c90d4", "sighting_of_ref": "indicator--dd0556cf-4807-4ced-8c6f-7eae4059e671", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddfff48f-17c5-4604-bf18-8e1df0758fbf", "sighting_of_ref": "indicator--dbce281f-dce2-45ab-9210-bb703223b737", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88064fc3-dafe-4b66-a6b0-6575fc7b4cc3", "sighting_of_ref": "indicator--cb256a65-f4f1-4f60-9782-370df88430f8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13bcabc6-a5ec-44a5-9339-f7b4050aeecf", "sighting_of_ref": "indicator--6fad74cf-4bd3-4066-a57e-bcf7aee7a00b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8870f006-c6aa-4062-b2fe-85d532da985e", "sighting_of_ref": "indicator--2618adb7-b38e-45c9-918e-2ce1401935db", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d704384-52db-4df5-8c33-519732f641bf", "sighting_of_ref": "indicator--f81d14f4-2113-4dda-83fa-fa2ec390e92f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e7c3d39-f816-4f23-a8bb-fe748ea63441", "sighting_of_ref": "indicator--1f5604fd-0bfb-4776-b6e8-75a7350d75c4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47aff8bf-2e6e-473a-82f7-a8992bec3d48", "sighting_of_ref": "indicator--6ef49f54-d217-46f6-bde5-d35630f68391", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abbcf709-54ad-4c32-a8b0-b599eac7c4b9", "sighting_of_ref": "indicator--09e347d4-720b-47e4-a0d4-691ae2c6aad2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a423357-1d05-4ab5-9d1c-73b9931f84d0", "sighting_of_ref": "indicator--81da266e-197f-4514-b9c0-029bc8db2cb8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--234590bb-af27-42fb-b217-cc73c745ba35", "sighting_of_ref": "indicator--02fa172e-90c9-435c-85c0-27705a4df66c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1d6daf0-31a0-4ac3-8985-b52644465381", "sighting_of_ref": "indicator--cb3ab7a1-3635-4fe9-aa22-52178cd70322", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a8bdcd6-dcfb-4f53-a0bb-b92f15e0e63b", "sighting_of_ref": "indicator--d16089b7-bcc4-4eb0-9a1e-484ebdde5ed4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7335177e-f681-4cd0-80e5-f66c69199008", "sighting_of_ref": "indicator--d16089b7-bcc4-4eb0-9a1e-484ebdde5ed4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7f47fa0-8314-4877-a3df-d46ff06eaf02", "sighting_of_ref": "indicator--8c2ecaec-8501-48fa-a23b-3288271ad0e7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81fb8277-c070-485d-a4c2-6c48307fb74b", "sighting_of_ref": "indicator--66d42d87-9695-4cbb-9da0-98f431978b66", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a487e5be-aaad-4692-a79f-1c42bd2f2a29", "sighting_of_ref": "indicator--eb11f3a5-1552-4ff6-985f-4fa181bf6d46", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35daa293-0e1a-4709-af94-d840344fea9a", "sighting_of_ref": "indicator--a0058acb-15dc-4b56-81dc-db65582b6082", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc491617-ba97-4a15-84a1-acef2d019227", "sighting_of_ref": "indicator--09658de2-5bca-404d-bf92-6b6d1a5bc687", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00ba19c1-0846-4144-8404-8927275fd396", "sighting_of_ref": "indicator--f9a6eee2-11f5-4c58-9331-ac7be6ddf960", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5cd207f-cd33-469f-8ab6-2b79347fb78a", "sighting_of_ref": "indicator--06a3c8a8-af24-4d6e-8ad5-b0574de0002e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f5de4c2-1958-48c6-9c3d-c42c1f33df35", "sighting_of_ref": "indicator--a2ee9bc0-db98-48b0-aa5c-5998199d3369", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96f2da52-dba0-4b85-8b30-ef03921af2f4", "sighting_of_ref": "indicator--e1706868-f811-455a-8ce3-8c39226bace9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24d18cc6-afde-40c3-a2a5-577db5b3c4a3", "sighting_of_ref": "indicator--9fa7424b-691c-4f92-918b-65c346909907", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--918379f1-1d29-4976-943f-2d5906af67b9", "sighting_of_ref": "indicator--9fa7424b-691c-4f92-918b-65c346909907", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b523590-9d66-4a31-8218-6c0e7bc24fdd", "sighting_of_ref": "indicator--f4673397-5b54-42b2-87c8-97b239beebfb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--333159e5-79b8-4c6a-8fa3-dabd6850f921", "sighting_of_ref": "indicator--4b8b7bc0-e129-406e-9c08-142326a2b500", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6e85803-b939-4afd-8265-a9bf2a315a5e", "sighting_of_ref": "indicator--016b697c-77d7-4a8f-8da0-a351ba3dfbbb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26d311f1-6100-4be7-a988-719b851edc70", "sighting_of_ref": "indicator--3d1435c0-512d-488f-a910-325d784bfaf2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1afb0ca-c44c-43e4-ba19-f47cc52e2862", "sighting_of_ref": "indicator--5590beff-aa78-4230-ba41-e0f500e1f158", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--523a6197-c53f-47ee-8efa-080a3d92e0e0", "sighting_of_ref": "indicator--dda9609b-64f1-4d03-8a7b-3c1a1830cde3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e526848-4001-47be-9ae1-f93d5e55b719", "sighting_of_ref": "indicator--2b5e1d82-32c4-432b-b1bb-1493e49948bb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95c7ddde-af6a-4c82-8e6f-d0384ee90e94", "sighting_of_ref": "indicator--5cf65cf3-8ae1-4a0a-8335-0b6460b8953b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--095a7fa1-01af-436a-9299-6cd5061f1e47", "sighting_of_ref": "indicator--5cf65cf3-8ae1-4a0a-8335-0b6460b8953b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e073b512-2084-410f-a539-fea6e9d121f4", "sighting_of_ref": "indicator--6b158905-487d-402e-93f6-34d1be140717", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01f11dff-927c-4eb5-97aa-73a9eb345301", "sighting_of_ref": "indicator--3f724796-67cf-4ae1-8567-77b2d976206e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12092744-886c-437b-b239-c8d186037082", "sighting_of_ref": "indicator--c3a49b73-f1a0-4f7d-9cac-78329cb7caa1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8ae94b2-3c82-4d71-bba9-9ba08c0239fb", "sighting_of_ref": "indicator--c3a49b73-f1a0-4f7d-9cac-78329cb7caa1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62ec82ab-34e0-409e-bd3b-db9da66d6a49", "sighting_of_ref": "indicator--b827ece9-c57f-413b-894b-8cdcb6308609", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe8c0726-99af-445f-b106-892ddb3ddebb", "sighting_of_ref": "indicator--b827ece9-c57f-413b-894b-8cdcb6308609", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39f4cc54-8685-4bc0-a0e5-5a862aee645a", "sighting_of_ref": "indicator--2e3e359d-4b84-4cab-b77d-9bbbb2784a99", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f18cb75-7109-4add-a84b-2ba228444777", "sighting_of_ref": "indicator--2e3e359d-4b84-4cab-b77d-9bbbb2784a99", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37707744-c955-493b-8f8e-f72b7868cb95", "sighting_of_ref": "indicator--7c390adf-92fe-4709-b1e1-433875d7f0de", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15eaed05-568b-4f6b-ad2a-cc01685755db", "sighting_of_ref": "indicator--7c390adf-92fe-4709-b1e1-433875d7f0de", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b2c3742-643f-4cd4-9f65-96c74ac63263", "sighting_of_ref": "indicator--650595c1-8f77-4110-a54e-663b7a42c89e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8aad3956-5006-43f6-b9c0-7f78106ef15f", "sighting_of_ref": "indicator--650595c1-8f77-4110-a54e-663b7a42c89e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--166020a1-85b9-4d23-ae4a-5048bb9e00ae", "sighting_of_ref": "indicator--d1b748ce-8ef9-42fe-ac68-b094bc973be5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e42ac12c-de41-4b51-9ed2-49a2f222f130", "sighting_of_ref": "indicator--74452bf8-83bf-46ae-97d9-879c9e05788d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--926655df-07a5-4fb4-9231-338850c8ad58", "sighting_of_ref": "indicator--74452bf8-83bf-46ae-97d9-879c9e05788d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b80f6fcc-fe0a-4289-99ca-044b8aefbb6e", "sighting_of_ref": "indicator--d0a53da4-7893-4fa9-86eb-58c933b691ae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cb2cf6e-ef6e-48b3-bbd0-59b8e61d244b", "sighting_of_ref": "indicator--d0a53da4-7893-4fa9-86eb-58c933b691ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f677193c-9a81-45e9-8a1a-5594e00e285f", "sighting_of_ref": "indicator--70f36b6a-4c1e-484b-b02f-d2d00d08e077", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9d0a5d6-281e-4577-a251-598122e25cdd", "sighting_of_ref": "indicator--7eae9bda-4406-44cc-a946-3647a9e4a9ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a68e5746-2488-422d-b4eb-fa9dd1c49dd3", "sighting_of_ref": "indicator--71fecf72-dd10-474e-93a0-af2836366a1b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b43b003-b9c6-4a75-9aa1-1f3b54b567fc", "sighting_of_ref": "indicator--71fecf72-dd10-474e-93a0-af2836366a1b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ef33289-5334-4809-a342-d37eca5f9682", "sighting_of_ref": "indicator--71fecf72-dd10-474e-93a0-af2836366a1b", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27355500-a048-4844-908e-304f25d8624f", "sighting_of_ref": "indicator--93f8ae90-4c66-4332-80be-39ce8c299ada", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3082804-473a-4f97-b52f-3074e3293c3f", "sighting_of_ref": "indicator--a05d63a3-8fc7-4546-bbdf-cd3b82116eea", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d077e30-c61e-48fd-9a69-c3c7b5b3b4fd", "sighting_of_ref": "indicator--91e33daf-4679-4489-b1f3-370b4662f986", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbc9e7c7-2de1-449a-8e69-58799d20b7a9", "sighting_of_ref": "indicator--5efd8f08-defd-4850-ab69-fac5e1e11d9f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--141e6765-9e9f-4b3e-be7a-4d6ad11478aa", "sighting_of_ref": "indicator--b036778a-166b-49a9-9291-c02e1a8981ee", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09b2602c-5062-4812-b490-a0f8d62b6123", "sighting_of_ref": "indicator--7ed25736-e208-4d4e-9f1e-1297285a0b18", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d8e68e4-68b2-4cbf-a185-3ff693c68d6f", "sighting_of_ref": "indicator--61d47154-72d3-42c6-9321-8910fa5cf750", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b42a624-748c-4291-9096-88bb45b5b46b", "sighting_of_ref": "indicator--fb336682-0a45-42e8-aed3-3e3e0f6986df", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59c51bf3-1795-4b7e-bf44-27036c57093b", "sighting_of_ref": "indicator--5491bad5-b5b9-45b4-89ce-ffaaee7aa5a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db001b6a-64a5-4520-9280-ef014bc0d2a7", "sighting_of_ref": "indicator--c058d2e2-425f-4c64-b4b5-994ca39f5ef4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4105f11f-03f4-4c87-8ae2-b2073c67f05b", "sighting_of_ref": "indicator--db0a72c3-f3c3-420a-9a90-9c8ae25f490d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73bb4a31-b3e1-4e0c-82e5-bf1405f8f250", "sighting_of_ref": "indicator--db0a72c3-f3c3-420a-9a90-9c8ae25f490d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4036911-31b9-424d-a1e5-ade0201c00c8", "sighting_of_ref": "indicator--b9f6fd7f-753b-4e24-be77-e5ef2c638535", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9a365e2-a4ef-4666-b3e9-d02467ec2928", "sighting_of_ref": "indicator--b9f6fd7f-753b-4e24-be77-e5ef2c638535", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0319f3df-248c-4ba5-9600-bc4c01a35987", "sighting_of_ref": "indicator--2ded0480-b5ce-4b65-aa57-f95073c017a0", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f35ebd82-7339-4691-b2c5-736f783003ab", "sighting_of_ref": "indicator--90d13c17-38aa-4efb-a343-c601e3774863", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f3c8ca2-1fdb-48e8-823e-e6602b1a557f", "sighting_of_ref": "indicator--90d13c17-38aa-4efb-a343-c601e3774863", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47776a6d-2538-4db0-8a5a-262cf1f7d85e", "sighting_of_ref": "indicator--527fe902-9328-4cff-a8ae-afe52ccb56c0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a51902d0-1318-499d-97d3-925a8fcb75de", "sighting_of_ref": "indicator--527fe902-9328-4cff-a8ae-afe52ccb56c0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfc5f26d-9aa7-481d-be83-55b9ddfbd812", "sighting_of_ref": "indicator--7e32c87c-e383-4f06-a738-bce1664885ee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6713c951-8a79-4830-8444-b2a8743c4489", "sighting_of_ref": "indicator--f5db0de7-1cbe-4308-a98a-1907b2f8b9b0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f4643c4-dcec-48b5-a86c-310c3066e379", "sighting_of_ref": "indicator--0b2627d2-3e0e-453a-8c8a-cba49d2a3c8b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c64ce58-11a5-4807-a3c1-f0156fc0ba3e", "sighting_of_ref": "indicator--431d3b9a-e8c3-468d-8a54-5a39de4e8c4f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6395cf1-a104-4cc9-9c03-cae77298dde7", "sighting_of_ref": "indicator--431d3b9a-e8c3-468d-8a54-5a39de4e8c4f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0c9de7b-2392-492d-8e0f-ea8d0cc67541", "sighting_of_ref": "indicator--8c433192-0d6e-48c0-a739-dabe3bc8108e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e5b97e5-df11-4af1-85d7-fd90fda7d4fd", "sighting_of_ref": "indicator--5ea624e9-61c5-4287-a5f0-80bc3bc6835c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec477575-5a77-4545-8d0c-64d53cd23073", "sighting_of_ref": "indicator--694cc15d-1496-4fd7-b5d9-46e19f22c1a3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88910e23-2b34-447f-8cd2-694ac834e233", "sighting_of_ref": "indicator--2bffb069-b752-401d-af50-aead056563ed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fc20bf4-9dca-45ec-8e51-1e464f977a8d", "sighting_of_ref": "indicator--2bffb069-b752-401d-af50-aead056563ed", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bf63f62-38d2-4b81-9d5b-ae8ff2f19637", "sighting_of_ref": "indicator--4aa34864-b92a-4cab-a692-d22e63c00563", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48c8f9f9-cfe9-456a-9123-63f4d9ed2534", "sighting_of_ref": "indicator--c3cbd131-9f52-4f29-a07d-2093a6ce2542", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b174ea5-1830-45c8-9639-8240403d596f", "sighting_of_ref": "indicator--c3cbd131-9f52-4f29-a07d-2093a6ce2542", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba5d8319-5810-40ca-b5fb-1cf363333602", "sighting_of_ref": "indicator--a49a721a-a4f4-4e26-8a44-67e1f8c23f25", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d78848c-c0cc-4a96-8a24-0bfde7cf998b", "sighting_of_ref": "indicator--a49a721a-a4f4-4e26-8a44-67e1f8c23f25", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16153df4-0c6e-43a8-a2b9-7e1ccb084a6a", "sighting_of_ref": "indicator--b020ac79-6203-41ab-90c4-305b04bc536f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e64694bd-f717-4d86-b256-9a236801d8a1", "sighting_of_ref": "indicator--b020ac79-6203-41ab-90c4-305b04bc536f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f06ba9e-59ab-4747-9219-9198bb58895a", "sighting_of_ref": "indicator--30f95efd-49e0-415f-850f-9981687f3de0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f543ed2-3fd2-4116-91e7-76e16c424bcb", "sighting_of_ref": "indicator--30f95efd-49e0-415f-850f-9981687f3de0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eff9d879-3dce-407c-90c6-537cb72d2a42", "sighting_of_ref": "indicator--603da803-51d3-44a8-aece-416843254c10", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18d9866f-338a-4ca1-8a86-f233f59b1782", "sighting_of_ref": "indicator--e33f9401-987a-4997-b4b7-7c9a7bf102f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa4ca0e0-08d9-442b-b3d1-28fd34abb892", "sighting_of_ref": "indicator--e33f9401-987a-4997-b4b7-7c9a7bf102f8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c242173-a662-44e1-b554-3f934b37bcf1", "sighting_of_ref": "indicator--acf1dd4e-cad3-4e3d-9feb-fabd6c84c4b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b53b940-d141-4c9b-9bb2-640f491d6633", "sighting_of_ref": "indicator--acf1dd4e-cad3-4e3d-9feb-fabd6c84c4b7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df7e2068-ddf5-4a3e-9edf-fec5b1d91225", "sighting_of_ref": "indicator--083f9279-f355-4e03-8974-6ae21b5c1611", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d12e60dc-ee85-4ef6-8276-0c2aabdb3832", "sighting_of_ref": "indicator--083f9279-f355-4e03-8974-6ae21b5c1611", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c62b812-ccbb-45a8-acee-2537213a8b70", "sighting_of_ref": "indicator--62a2481d-08cd-4bb0-963b-b764ccfd7f77", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cbf17fe-4171-47ab-b587-2b49975bb4bc", "sighting_of_ref": "indicator--62a2481d-08cd-4bb0-963b-b764ccfd7f77", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1921d43-6d22-459b-8050-b904f17f2d14", "sighting_of_ref": "indicator--0724df32-9a24-4b44-84be-88a37a624236", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d841690e-f02e-41e0-bb1a-c064616b57fb", "sighting_of_ref": "indicator--0724df32-9a24-4b44-84be-88a37a624236", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd3e6bf1-9166-4561-9e8e-6f9fc426ec99", "sighting_of_ref": "indicator--3d665043-7973-44d7-95e8-6c3379cf5779", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27ab5603-76a1-4df7-b252-bcacf86f902f", "sighting_of_ref": "indicator--b5e264ce-5175-4768-85a1-68a19e545b32", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5d64f1e-e133-415a-a3fe-01de51cc184b", "sighting_of_ref": "indicator--06693d52-6e4f-4b2a-b171-420075c0e06b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5be924f-7f3d-4b39-a3a4-5d4284147e1c", "sighting_of_ref": "indicator--f4ca2b2c-f89c-442a-a22b-b550e184325b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23f3eb1a-96e9-425f-a17c-2fc1dd0f105b", "sighting_of_ref": "indicator--df0db88e-5bea-4236-af44-2b019c3be44c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b9d982d-6829-4f8b-8f56-459805eb7b98", "sighting_of_ref": "indicator--b09a4ea2-201f-4e68-a9b0-580604707cbf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b85a716-70c8-46d8-9a3e-6d0c4207e486", "sighting_of_ref": "indicator--b09a4ea2-201f-4e68-a9b0-580604707cbf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf82bc0a-b10b-4c71-a477-b55e0ac1906a", "sighting_of_ref": "indicator--b558a3f5-77fc-44b3-ae74-5852967bb299", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a79376d3-59b1-4bc6-9c53-22c1ed959a60", "sighting_of_ref": "indicator--b383c185-a332-472c-88c9-33a40a024d63", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf56f364-c472-48f5-a6f1-4ca672894607", "sighting_of_ref": "indicator--b383c185-a332-472c-88c9-33a40a024d63", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73a87fef-7ee5-4e4f-bce3-812327883f88", "sighting_of_ref": "indicator--b7f58bdf-d757-4bbc-bc41-8cdf24082d25", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b9aca48-10cf-4ab9-87d3-988b4e722793", "sighting_of_ref": "indicator--bf4f3fa1-6adf-40a8-8b06-602202ec8c47", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98bac887-97f3-42fa-a1fb-51a588f195fb", "sighting_of_ref": "indicator--bf4f3fa1-6adf-40a8-8b06-602202ec8c47", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a510cc3c-01ca-4c8a-bc2b-768134b427a7", "sighting_of_ref": "indicator--134749cd-b68d-4e6a-aac3-1c67295c33ae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4190c3cf-6f3c-41ed-be60-5fd39df85138", "sighting_of_ref": "indicator--134749cd-b68d-4e6a-aac3-1c67295c33ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a05cd6a-7f11-4e6e-bcef-4ac9634bdf47", "sighting_of_ref": "indicator--5b750f0e-2dde-41f8-8313-ce89fcfb505c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f0643c6-5617-475c-a33e-a82ca6cc3639", "sighting_of_ref": "indicator--5b750f0e-2dde-41f8-8313-ce89fcfb505c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2878f326-9805-4052-8061-0270fcb599a8", "sighting_of_ref": "indicator--a289919f-643f-438e-bccc-52f793090c1d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8467aa8b-774c-4eb2-87a1-e8d59fd23ae3", "sighting_of_ref": "indicator--a289919f-643f-438e-bccc-52f793090c1d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e05b1294-1ae6-4a57-b0ee-6dd8afafce81", "sighting_of_ref": "indicator--0c2671e3-2d7b-4bd6-8d26-a503ac35d62a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbee2228-2ad4-4d0b-93ff-1aa1c31de9d4", "sighting_of_ref": "indicator--0c2671e3-2d7b-4bd6-8d26-a503ac35d62a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79f34d61-28b6-4b93-978c-c4e3d127feed", "sighting_of_ref": "indicator--c732aff6-0f11-4c19-b85a-d4eaba4ea055", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fedb21e4-4a43-465a-9d73-fe23c650bea1", "sighting_of_ref": "indicator--c732aff6-0f11-4c19-b85a-d4eaba4ea055", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91f0c0e4-9fe4-4513-8b15-ad5535627087", "sighting_of_ref": "indicator--e2de6d1c-a90a-4785-a4fc-25f998b71f3f", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7d3b1c9-fd85-4575-8aee-9e383746e390", "sighting_of_ref": "indicator--b7e64e65-b2cc-492b-b359-247295abbd34", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa494e59-bf11-4cdf-a337-a4e8f668fb5a", "sighting_of_ref": "indicator--83f2ce44-e38b-4cbd-ade9-da1c467b030e", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dacf5ae5-6398-4320-ab58-396fdecb816b", "sighting_of_ref": "indicator--6cdec18d-d944-4c89-966d-e9dd5fcf0b35", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e03ffe1-a842-4501-9578-cffe6af01a58", "sighting_of_ref": "indicator--517c7bd3-5cb0-4fa5-bd62-3f3fb1f5a322", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b90e64e-0377-4877-ba64-d3bc99e2bde2", "sighting_of_ref": "indicator--494326ee-5b12-40e0-b575-958bac7378f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--802a5826-c040-4710-9825-f8a59f959ce0", "sighting_of_ref": "indicator--71960458-876b-4b71-afc5-faf379cf93c1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2f7cd61-d8a0-4522-87e3-047a62ad27f1", "sighting_of_ref": "indicator--5b311721-5b7d-4733-9e99-8a1717feb954", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c11f2340-ed22-4245-af6f-09fc3c436e0e", "sighting_of_ref": "indicator--5b311721-5b7d-4733-9e99-8a1717feb954", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fe965f6-d0fe-4d4f-b8bf-95b0220f9539", "sighting_of_ref": "indicator--8b6dc623-2e8a-4baa-a39c-66076ec75772", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34c52e0e-7ca9-45f3-8087-ab704c806f33", "sighting_of_ref": "indicator--8b6dc623-2e8a-4baa-a39c-66076ec75772", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28fbdbe7-5898-4c97-94ca-9f1a2da3b69b", "sighting_of_ref": "indicator--1a66cacf-31e7-4722-8ce7-ecbb4b365f59", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--758db077-1f04-4094-9ea3-13c4237d899e", "sighting_of_ref": "indicator--1a66cacf-31e7-4722-8ce7-ecbb4b365f59", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c50e335a-0b49-4179-a479-0716631a41eb", "sighting_of_ref": "indicator--144ebfd8-3bde-47f8-aa3c-f672761c7df4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2d1abc0-2ee8-4e3a-9e8e-737be8edc1a1", "sighting_of_ref": "indicator--144ebfd8-3bde-47f8-aa3c-f672761c7df4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73c34ee3-caa1-4fa0-8d93-c75f50e41c2a", "sighting_of_ref": "indicator--a13bd97d-210a-4317-a464-d7b1266c07d9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b16a0c02-2542-435b-bda0-dbf1d8c83dcb", "sighting_of_ref": "indicator--a13bd97d-210a-4317-a464-d7b1266c07d9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c1054cc-c70e-43c4-9695-3e5d92ed1189", "sighting_of_ref": "indicator--9f135a91-6dfb-435b-ae07-5a3c75a0dc20", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69ce5a77-9aab-40f2-879a-f6f0f3a05671", "sighting_of_ref": "indicator--9f135a91-6dfb-435b-ae07-5a3c75a0dc20", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2d360f0-c8de-45bf-92b9-114f8ad6b08b", "sighting_of_ref": "indicator--ca907f0a-7984-4a2f-a323-2377349b4d8e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7618d0b-dc95-44b0-b9f4-5d83e7d4844a", "sighting_of_ref": "indicator--7b33a479-b32c-4c37-b99d-d38d4c369e5c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd765279-deb2-4fcb-970e-3e95df3a9781", "sighting_of_ref": "indicator--d0997956-f2dc-4b80-91a3-751f3c07635d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8018b675-06b4-4174-88c4-803d1ca95d25", "sighting_of_ref": "indicator--d0997956-f2dc-4b80-91a3-751f3c07635d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b666d05-769c-49e0-88a9-0e59fd0b8b47", "sighting_of_ref": "indicator--d4a61514-04b6-4289-8ad0-eb579ba19c4c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01955818-2ebb-45f2-8a2b-cdad053c20f1", "sighting_of_ref": "indicator--11ee4843-2cb5-484f-94af-ae43d0dde573", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc9634a1-5583-4ce7-a06d-b6634cfe490e", "sighting_of_ref": "indicator--11ee4843-2cb5-484f-94af-ae43d0dde573", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25d9c62d-6ecc-41ba-8497-fe878fea1589", "sighting_of_ref": "indicator--02b018ea-88be-4a36-ba08-6f1032d00da3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d44a1ed5-26c8-45a8-b32e-44fe85ad4570", "sighting_of_ref": "indicator--93a0b4e0-b07f-4fdd-a5d8-50a8ec78ae8f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--359bdb4d-1a92-4ec1-b97a-3e681e91da96", "sighting_of_ref": "indicator--2a7c232f-f316-4ea2-b6c6-91cc6894fab2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0f783e2-85d7-4e89-9279-4ddd825de5ae", "sighting_of_ref": "indicator--b9f63119-c411-43c1-ae6a-ad4bf5797320", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b691c42a-0fbb-4f68-b820-37eaff7484af", "sighting_of_ref": "indicator--b9f63119-c411-43c1-ae6a-ad4bf5797320", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d036716c-4e82-4035-820b-4ce54cde82f9", "sighting_of_ref": "indicator--54b927b6-4dcc-47d6-b7d7-e4c5ba807987", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--773d6e21-d637-47bd-8932-8317befae027", "sighting_of_ref": "indicator--54b927b6-4dcc-47d6-b7d7-e4c5ba807987", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ba0d74a-1993-4e13-857e-3d874576f814", "sighting_of_ref": "indicator--5bb96e54-1d7c-47c4-88f3-bd2cde3a1241", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07beabec-3f4e-4519-babd-ad5187f61fc7", "sighting_of_ref": "indicator--5bb96e54-1d7c-47c4-88f3-bd2cde3a1241", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc1f2cd3-1a09-4afa-bc9b-71ffe10e6b18", "sighting_of_ref": "indicator--e009101c-b102-4777-8ff1-a6098d382b99", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6762ed9-eaf2-4a6f-b89e-e70f720d5dfa", "sighting_of_ref": "indicator--8e6c0095-5e8e-4480-ad51-640144567b81", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44f8b402-ab66-435b-94ea-1c28f4cc7e39", "sighting_of_ref": "indicator--95a749a4-4798-469e-87a0-e926e5cd87e3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa72708f-8d17-4514-817a-9cba04508d43", "sighting_of_ref": "indicator--95a749a4-4798-469e-87a0-e926e5cd87e3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59cd546d-f55e-4b69-bf11-e0ffb94f0535", "sighting_of_ref": "indicator--acc6aa3c-8614-422c-9d32-f9e7515f797a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50ad64f7-d667-4411-b3a2-3089ae29d60b", "sighting_of_ref": "indicator--b35d3b67-24be-434a-bf96-d45472efc966", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e15c12e-08c4-4eba-8068-ceb87348ef09", "sighting_of_ref": "indicator--b35d3b67-24be-434a-bf96-d45472efc966", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4689671b-cc91-4b06-9576-4b6b0a0d43fb", "sighting_of_ref": "indicator--f97336b9-3fdf-483d-a6db-11eab0816d33", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4e727b7-2096-4475-8386-80ccf9057971", "sighting_of_ref": "indicator--f97336b9-3fdf-483d-a6db-11eab0816d33", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e63136c0-91d8-4f1a-868d-f501e97a119b", "sighting_of_ref": "indicator--c7864865-adb2-4c8c-ac82-7fb9f99bda5e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffcf7aca-c422-4a88-81c4-1bb4addd8d2c", "sighting_of_ref": "indicator--c7864865-adb2-4c8c-ac82-7fb9f99bda5e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01434647-4366-4adf-aaa9-7840e49a96e0", "sighting_of_ref": "indicator--526c363e-7647-4b49-8533-e5154d34bef1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8482ab63-7862-4459-870d-b3d3fc398c58", "sighting_of_ref": "indicator--e906c6ea-2880-4727-925e-d87396f099e5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01f0d43c-ae20-43f2-b9e1-37ff4bffa490", "sighting_of_ref": "indicator--ddec955f-a857-47ef-bab9-ab093565a057", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3843a492-025f-4aad-a82e-bcc31b2d15ba", "sighting_of_ref": "indicator--ddec955f-a857-47ef-bab9-ab093565a057", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65d77511-460d-4416-87d7-82b2ddb4c516", "sighting_of_ref": "indicator--eda2110d-8362-4741-ae6c-150548ad1277", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34b7815a-6d81-4fc7-a5b8-7dea81ca5f96", "sighting_of_ref": "indicator--eda2110d-8362-4741-ae6c-150548ad1277", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfec9a2e-496d-4985-99b8-de5658319316", "sighting_of_ref": "indicator--2193ad66-f583-4822-8029-f19d95ab18ee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdb4f9d2-361b-42bf-b6bb-a7cbf1d66fd5", "sighting_of_ref": "indicator--512a1519-3bae-470a-84f2-c7eec62e8755", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a6bda3a-234b-412d-9369-26b7dbdf2926", "sighting_of_ref": "indicator--0459c861-125e-4945-b2fc-e9abd4f0478a", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be4ef023-e3d6-4433-aa28-008d5f66c8ff", "sighting_of_ref": "indicator--6aca3a85-fe7b-4f68-a227-ea20e0eda823", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4513788-9900-41a6-839c-9821240a477f", "sighting_of_ref": "indicator--db65315d-629b-42ef-88da-a52872e4bb29", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f99d3948-d886-48ab-9b91-89c7e7f7145f", "sighting_of_ref": "indicator--e883a6af-2a5d-4f69-b01a-34e5f5f6ce0b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f49bf87-907d-4982-aaa0-19bf3e890fb5", "sighting_of_ref": "indicator--7f1092ef-f6f9-457b-a99d-e7e840aaef11", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc85510c-cb2d-4453-bbf1-2ac8304f63d2", "sighting_of_ref": "indicator--7f1092ef-f6f9-457b-a99d-e7e840aaef11", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c97fd163-490b-4471-be6f-d76ee05d60fb", "sighting_of_ref": "indicator--b91136b8-33c2-4b86-9ad2-a5160a7d5b5d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f85107dd-1806-445f-a4f9-dcf459c6f85a", "sighting_of_ref": "indicator--c589655d-de5c-4193-8359-55d2d457e849", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6dc86fe-c6ff-4101-811b-ea34bb2bb226", "sighting_of_ref": "indicator--4c146176-04c8-4224-9e7e-1b0eb66db06b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40b12061-65e9-4c73-ba33-5714ed6b152e", "sighting_of_ref": "indicator--30c92c20-cc3a-4d83-af3e-1ec7dbba44e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86ea2416-a8bd-4d0d-b94e-0229f4ecc2a1", "sighting_of_ref": "indicator--4c102b2a-55e3-4f1b-823c-c062dcf40936", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13aa709f-80a0-4470-b041-c36ef444deda", "sighting_of_ref": "indicator--754a61ac-b6f1-43af-be1e-abc7d168b6cc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd0fa813-6d12-4acc-be23-ed7946175a0f", "sighting_of_ref": "indicator--e375169c-feb3-46f4-a785-d14acd7d5ba9", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe4f42d9-2232-4dff-a865-92e58201d59d", "sighting_of_ref": "indicator--40d693e8-1a07-4d9d-9b5f-8829509698a4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fcb6590-352f-4124-a152-579baf4e1a8c", "sighting_of_ref": "indicator--61098c68-ae6f-43ef-aaef-cbf8302acb19", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c01d186-36bf-43d4-a884-71dbe8eb089c", "sighting_of_ref": "indicator--8ba8a88d-de97-489f-9bda-b9603f809015", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a31ccc7-e4df-44c5-8574-2deb622d8468", "sighting_of_ref": "indicator--3e5141f6-7e4a-46ee-bb32-c39b05e87c3b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c2603ad-e79a-4efc-b6e4-f2063b59b187", "sighting_of_ref": "indicator--3a450ebd-fe76-43eb-849b-f5116cfcf99f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6808074a-c929-454f-a42a-b76c4c1ddd73", "sighting_of_ref": "indicator--2d482a9d-3337-4aa3-9783-c73b43508e74", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a383fa1c-ff49-4007-affc-448d2756c68d", "sighting_of_ref": "indicator--8473de8d-6279-40cc-8f6d-70b0830a8c20", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9dd56af-8e10-4a67-8547-07cef43be764", "sighting_of_ref": "indicator--1d75da4e-f148-4113-8aa7-1e0a8f3fcf64", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a41bb51-da04-4c1c-87a7-e160f5947b42", "sighting_of_ref": "indicator--b883a881-3f60-4d04-bf28-982be0a3423a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9b7d5c7-3441-4c05-a346-e80b7d7c74f1", "sighting_of_ref": "indicator--d594202f-87b7-44ca-bab9-bf03eddcac1c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--716cc36e-c1f7-48ef-b977-8526d6db90ae", "sighting_of_ref": "indicator--f1651933-c17d-4081-8805-79e6d719d5b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74a5cbc1-648c-4fd1-a2dc-fdb2a3ba22ef", "sighting_of_ref": "indicator--aa4a5222-638c-4d76-b632-1f55f371f3cb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--876a5dfd-a81c-47d6-bcf4-ccf414f3ac8b", "sighting_of_ref": "indicator--40b13e97-dd17-4e1a-94f9-1a6c27429cb6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5838fd97-211b-41b2-a2d7-8b45a6d87c8f", "sighting_of_ref": "indicator--ddc503b0-e585-4c5d-9d96-61b7ede8ce36", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d0c5873-2f98-43d0-a4a5-b387fd027141", "sighting_of_ref": "indicator--2e697a26-7902-4c97-bbd5-a498a1d8f121", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49f5bc99-34b1-4e40-be52-22669c6ea731", "sighting_of_ref": "indicator--212c68a2-9cb7-4f8e-a8f9-5a2d5bf42119", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc494744-7dd0-436b-b8d8-b90024ad9b45", "sighting_of_ref": "indicator--4ddb6d5b-b773-47f0-9a8b-11e2f2d42372", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f242499-7ba9-44b4-8ea9-bf5eb6db45a1", "sighting_of_ref": "indicator--955f9c8f-1d78-4ead-96cd-c3f6208f52ac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07080867-a647-4c44-bd33-1dfe20d23226", "sighting_of_ref": "indicator--e6b39d84-5234-4c3f-8355-81f12de65175", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50ee451e-4a75-426a-ab69-4046e48c1033", "sighting_of_ref": "indicator--cb216be8-3f98-42f9-98f8-1a10fb11a08d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3909260-8aab-407f-93f5-ecf7eb405cef", "sighting_of_ref": "indicator--3bb162f6-2261-4e8a-b009-073333436fa9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad4a316c-6faf-4366-bf96-6afe98665d6f", "sighting_of_ref": "indicator--db33b3af-9665-4eac-a6c0-1d429528500c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4aabe20-e25d-43d0-a313-c4d313307571", "sighting_of_ref": "indicator--ee4db4d7-dc8b-4baa-8dd5-258d3f7df5d4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4735db00-c210-42d0-a49e-c36946da85e3", "sighting_of_ref": "indicator--75ede0ff-34fd-48da-aa98-49e2eb152243", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5f04c15-4291-46cc-a0e5-437596fdb83a", "sighting_of_ref": "indicator--ac73178d-e462-4977-a89c-830f28cc786e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc63c6eb-da53-499c-8ad7-9a873e7ca8f9", "sighting_of_ref": "indicator--e7e461e7-1a83-4a74-9294-88f1f3257810", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22f5c2c8-43aa-4a6d-87fe-0ef0754390dc", "sighting_of_ref": "indicator--2f4ca961-2403-43e0-a052-c5fc7fdc8a8d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9640bcfe-84e4-4b98-82af-8d5c891289d5", "sighting_of_ref": "indicator--99661d29-c62b-446e-bbf3-be022b9f30cd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7210f1a8-50e7-46c2-8da3-24528ebac41a", "sighting_of_ref": "indicator--f6747771-f505-41d8-a8b1-59a454d5bd80", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d76a715c-7f8e-43b9-9b86-225b3bf9be75", "sighting_of_ref": "indicator--b69e48a2-e5ad-4978-9348-79c9dd4480d5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dfb38b6-f62d-406c-b313-376726645197", "sighting_of_ref": "indicator--9b3feb6d-3ab1-4f1d-b910-f6f6c042b1d9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41e409e7-6fd0-4ddb-9096-2390fdf342a4", "sighting_of_ref": "indicator--a314a770-e428-495c-8170-ed3d8b3d3467", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8083414-4e6f-420f-8f12-c8a495c99e9e", "sighting_of_ref": "indicator--ed1752f8-3d63-405e-9616-8505ad6523eb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dd9e1ab-a412-4858-bd2a-b29e57ea523b", "sighting_of_ref": "indicator--d73a838b-b5ad-4b4c-b981-6a8ca3a31630", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f5cc08a-4010-43fd-a0e0-7e2050fd0a67", "sighting_of_ref": "indicator--c1d51c48-1fb1-4f81-aa3a-28a618a5e284", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--161f1bbd-2211-416e-bc18-00f76ef1cb73", "sighting_of_ref": "indicator--6659a784-76fa-489e-b8a5-fb0cd1d3132d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c3d70a9-ced7-450e-8396-bc0b074f359f", "sighting_of_ref": "indicator--a8cf3353-be7c-44b5-9183-47c8f174e121", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15ab4439-ae5c-4c9f-b070-225c82a05060", "sighting_of_ref": "indicator--a3a1ea09-6660-4dc2-b3f2-5992c84782a7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a4e2b9e-339d-4940-9399-df3e23a4be59", "sighting_of_ref": "indicator--85bca866-390a-4ddf-ba56-653dffecb70b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90800117-f8a2-4826-87e1-0ec12701a2b1", "sighting_of_ref": "indicator--52894173-fddb-4fb1-951b-a470676b1828", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36f62fd8-73be-4596-845c-7d6ef3b949d0", "sighting_of_ref": "indicator--ee121470-4121-40d9-aef0-a4affe26cf44", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a802da6d-8863-41b5-95c2-5819e2d02f18", "sighting_of_ref": "indicator--27370543-655a-4fa4-aa99-122e3d48f223", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1edfe870-45c3-4d3a-ad23-3ed4c02a7a53", "sighting_of_ref": "indicator--52c05932-b9f0-4b42-9852-a53666a4b42e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be6732e5-3a1a-4225-874e-2adb3488c9c4", "sighting_of_ref": "indicator--5b6401ee-af75-4e67-9b69-15cfe14f9ba4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58ecf95f-6660-4b0a-b379-d94637e0717c", "sighting_of_ref": "indicator--d3183943-289f-4c0d-a762-d56379d28047", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d483859-014a-4f9e-b4d3-46e1e85fccbf", "sighting_of_ref": "indicator--5278dbf9-3d7c-49d1-a487-42adbab54460", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24f621a3-f2bc-473e-a7f6-f89bfea44349", "sighting_of_ref": "indicator--65b98170-e35d-4afc-9094-a6cce3ce16fc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3191b77-9260-4d2f-88fa-9788d454e45c", "sighting_of_ref": "indicator--c255269e-8f39-4970-aa5c-611c69b56b54", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ce485bc-aa76-4e1e-9c94-cc2cf40d4037", "sighting_of_ref": "indicator--b6e39561-33ae-4cb3-9913-5fa64c44f41f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca8932e6-68e4-4d63-865a-201dc4ee60ee", "sighting_of_ref": "indicator--c6c519cf-1c5b-416b-a8e0-2b8420c7712f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4aa88ac-d832-4401-ba47-5c7269be7ce7", "sighting_of_ref": "indicator--d00e57f2-840a-4c05-8da3-e1712d53cfc0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02314a12-302b-49ef-839c-d6b0fcabc158", "sighting_of_ref": "indicator--7b81ea65-8644-49c0-a464-ca91cd8afcae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--792a3eaf-c432-4fe5-8ab1-3bd61625ae32", "sighting_of_ref": "indicator--cfff8171-9382-4076-9964-849c0a62ec9e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61fc650d-c6d5-4e0f-a601-e4f36877cdea", "sighting_of_ref": "indicator--292f17f4-e77c-464b-8739-d23284e2f5d5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2b41c9c-4864-4db3-b840-8ab10453bfcc", "sighting_of_ref": "indicator--e331f8d1-624d-48d7-9295-73b43695d807", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79cd8edf-b1b3-441d-971c-3c127f9297c1", "sighting_of_ref": "indicator--d2650a9b-a541-4760-9763-5aa893a2d4db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daf2c006-e8e2-4cad-b275-48df3ce44d48", "sighting_of_ref": "indicator--f8a60452-657f-4383-aabb-9c22cb8b0617", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--685200b3-fdf7-4801-8f71-eac2ac0265ab", "sighting_of_ref": "indicator--f8a60452-657f-4383-aabb-9c22cb8b0617", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01c00fb8-514e-4f58-9a83-87600661edd5", "sighting_of_ref": "indicator--c138c704-5d03-4ee0-a4aa-4ae63ea49c60", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e3f3e29-f13a-4e8a-9803-5e6428083778", "sighting_of_ref": "indicator--53d56c42-a989-4914-b83b-ccee393c0113", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--172b898a-aae6-4290-ba0b-bd58aa0c05a9", "sighting_of_ref": "indicator--2e19f298-40d3-4c14-8445-fb993436cbae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--105f3de3-1fea-410a-84d2-9e66667c4724", "sighting_of_ref": "indicator--a0462120-4431-4178-9168-a46e93cce37d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03de404f-dafe-4179-9cf5-88fd671d2e17", "sighting_of_ref": "indicator--9161068d-eaed-4c0e-a297-ae4b224251f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b095c59-9088-405f-b34c-b57d8a43e584", "sighting_of_ref": "indicator--d2d2f965-22c7-4ac3-8a84-b086ae7eef60", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fa4d085-3ed4-4a45-8bad-3c51640af60d", "sighting_of_ref": "indicator--0925fcd9-6561-405b-b9a1-6b8b0103b480", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5fa8a66-85bf-467e-a217-f4128eb3c70a", "sighting_of_ref": "indicator--1b1f235a-7462-4976-bf18-fde164bb0c7c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70835cc7-870f-42c5-a981-a1a71364d57b", "sighting_of_ref": "indicator--a09ffcc8-10a2-4dc2-ba39-ced196192368", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e05a02d7-5801-4a7b-b7f4-1c7920511ac8", "sighting_of_ref": "indicator--03c78f8e-1d05-480e-b068-b6171f1e9b01", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df443efd-80cd-4dda-83d8-649294195ed2", "sighting_of_ref": "indicator--ca8866ae-9f4d-4eec-a290-f12cdc570334", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5624eccb-445c-4ba0-b59f-d8b11771de87", "sighting_of_ref": "indicator--1d3ef2b8-b8f9-4643-a748-ebb25ec60ade", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--348d92c6-0cd0-4f12-ad74-be964c98b11a", "sighting_of_ref": "indicator--10a6c96c-1433-445d-adb8-8539df1ab054", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb8f4049-de0f-4416-888a-130e8fef8d2c", "sighting_of_ref": "indicator--3e81a392-63b6-4a8e-a62b-d4b1c3b19e42", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ff84483-27f9-4988-bcd5-599a5ee6b01c", "sighting_of_ref": "indicator--406ca4a2-3af4-4f87-af31-5a2cc81cebea", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab8d6f85-ca30-487d-96e1-c23fa1277362", "sighting_of_ref": "indicator--b35d080e-7e86-42bd-abaf-9e8ed92b2964", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e978d9a-5500-4713-819c-af043eb072e6", "sighting_of_ref": "indicator--0f7ece3b-9244-4401-93cb-6bc507f1430a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a00499cf-7ab8-4cd4-b5a3-4b374546c3a4", "sighting_of_ref": "indicator--0ade6376-189a-4acc-b5c6-e164283efa9c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--500fc34d-8d9f-4d73-b1f5-2a5de0ebf4b6", "sighting_of_ref": "indicator--7163a6ae-f6c0-4b46-90a5-c3d8ab8d397a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e9bb831-7baf-475e-8e37-00b70724f832", "sighting_of_ref": "indicator--cf8cb857-dd71-4a19-be3d-d46c86e3ae9b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--726acce5-85b3-41b6-ba30-ef4d4162fe8a", "sighting_of_ref": "indicator--3acf6034-5436-46b5-8247-10c34c74a31d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--404868ea-6e9b-4137-9656-380d4b46d310", "sighting_of_ref": "indicator--7726a480-7b32-4802-9a86-561ff66161fa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fc7a779-cd47-4113-9d42-0eb97de280aa", "sighting_of_ref": "indicator--7726a480-7b32-4802-9a86-561ff66161fa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18df1aea-ef43-4fff-b035-e120ea00b882", "sighting_of_ref": "indicator--8544f561-810b-4202-b9e5-e761909576b9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43db5fee-89b9-4e03-8658-9a4ffe502d42", "sighting_of_ref": "indicator--a25c3bd6-b3ef-4e11-9ce0-53bf8716a233", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c63bc9d-730b-4149-85eb-4906d5201ebc", "sighting_of_ref": "indicator--3c4e2fc0-aca0-4acc-a78e-9f0bcea6d0ac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--581b952d-89d9-46ba-81f4-796c2a44e1c5", "sighting_of_ref": "indicator--668ff378-896f-4aa5-a2c3-5a07d78e9fc7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69e3976d-ea88-408f-a81b-50ad9687e4c1", "sighting_of_ref": "indicator--32ff6eac-cca3-4a6b-802c-b2a49b6974b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32036e3e-511d-49e3-be79-f122d0d4e118", "sighting_of_ref": "indicator--b2c44c2b-fc5b-45cf-9068-62e3bd5d719f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e237b32b-648a-405b-a80d-ae604b06320b", "sighting_of_ref": "indicator--7fa2083e-8642-4621-a76e-3caf7f83e3ab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6be58e9-d3ec-40f6-9468-31dd68eb74fc", "sighting_of_ref": "indicator--31735148-fb01-45dd-be4b-20f8b741c161", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab5ee85a-5bd8-41cb-8cb7-059ea338e037", "sighting_of_ref": "indicator--c86c529e-0daa-4bd9-b917-da2c5248b7e3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3aadcbea-f644-43a8-bb62-dc9327b647ed", "sighting_of_ref": "indicator--c86c529e-0daa-4bd9-b917-da2c5248b7e3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05678057-75c7-4a30-83c7-9663ec7d52c6", "sighting_of_ref": "indicator--36fe9106-08bb-4d08-ba5a-60dcbe118eaf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6985c16c-5823-4d9a-9cd5-384bf3a83dc8", "sighting_of_ref": "indicator--36fe9106-08bb-4d08-ba5a-60dcbe118eaf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b08594c5-783b-4777-87b7-92707f4facdc", "sighting_of_ref": "indicator--bf917696-b40b-4fbb-b410-f03b31b0c978", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0426e061-373a-4cd0-becd-e1ed466c8147", "sighting_of_ref": "indicator--07f3bddb-defe-4a52-84f1-a42e48566f13", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44414471-2498-4e8c-802b-19120d9f8ab4", "sighting_of_ref": "indicator--132aa48d-f79e-48a7-bea4-067d7251a887", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7ce6648-cdb7-4436-b56c-2aa7dfc26774", "sighting_of_ref": "indicator--79d08b58-c061-4b00-a920-eeb287f83f51", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67320951-325a-466e-8322-24426119c52f", "sighting_of_ref": "indicator--b2e76367-1b86-4b76-9809-18bc9c176ee5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5f961b0-325c-4114-a3ae-1d0733ba8f8c", "sighting_of_ref": "indicator--6b35b1eb-9f92-485e-8394-8496aaf082dc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e613a054-751d-4ebd-8a49-b3bf3c92ebb1", "sighting_of_ref": "indicator--7f23951a-88f4-4e36-abfc-5ca2ba800ff8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b6d2095-18c6-49fa-a2f5-67408cf2b274", "sighting_of_ref": "indicator--a57851e2-f3d9-4bb7-9ca8-1ec48b2e2094", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee97621a-a24d-4266-bfce-931d552230f1", "sighting_of_ref": "indicator--3ae58372-bc9a-4364-9402-4f58b215ebfa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00a67b18-f2df-4fe9-8544-a62310cf0037", "sighting_of_ref": "indicator--629cf7a4-cf80-45a2-ba5f-10b6f723e5fb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0946355b-e46c-448d-aca1-2b47d0260861", "sighting_of_ref": "indicator--0d1f13db-eff7-449d-a8a4-c851f4cb8254", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e24448d6-4f57-4ff4-9745-cefcad662657", "sighting_of_ref": "indicator--5e3b8098-0d70-40d4-b3fb-77307ce7a348", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f40c7048-53a1-46cb-9025-24142948cd61", "sighting_of_ref": "indicator--2b947c40-b600-4eb0-a829-29f177fbf702", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4366be0-1ccd-4eb7-8c0f-ba474f744a63", "sighting_of_ref": "indicator--189aba1c-fbd6-4cca-a477-578f18b5da97", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cae6c8c-a259-4ef3-ad63-531e97bf491a", "sighting_of_ref": "indicator--3c74def7-acb4-4aac-8c0f-d7b5284c47c0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--725ec8f8-7cc7-442c-bc32-4d332c47b7e7", "sighting_of_ref": "indicator--75d8d621-b073-49b4-abdf-00ecaf38b844", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb3e5c28-c55f-41de-bd47-424b96b83dfc", "sighting_of_ref": "indicator--4c0b0afd-b6d3-44ca-825a-c75efa7589fd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e4fcdea-777f-41f5-b95a-f4068d660650", "sighting_of_ref": "indicator--4c0b0afd-b6d3-44ca-825a-c75efa7589fd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--581069d4-86bb-4178-8167-1bc187b2ff42", "sighting_of_ref": "indicator--6b7abe41-cf65-4ce1-b982-c1068591161b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--290fbdb1-333b-4d34-b68a-f0f7d8cf957e", "sighting_of_ref": "indicator--4cb72b31-23e2-450b-b7aa-70dea500819b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfbed664-b38f-4569-b78f-fd794d1897e7", "sighting_of_ref": "indicator--0fa88fe9-5c99-4283-9e0b-2c2394968df0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01adc79f-773d-4309-be3e-a25c96bb0d84", "sighting_of_ref": "indicator--3bac63f6-e568-4215-86ba-719661ac05f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf6f691c-abbd-4ca7-8901-f9d960e3cd1c", "sighting_of_ref": "indicator--1ff867f5-85d6-4fa1-b953-40fb6ea0298d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8af76852-708a-4181-b20b-f231f712220c", "sighting_of_ref": "indicator--bc7e1084-b916-4d95-9c12-57ed4e85d56f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89c35532-ebf8-45c7-8c7e-3e5c2b6edc2d", "sighting_of_ref": "indicator--6da237cf-4b1a-4b7e-8ffb-afaa37c18910", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3f4efe9-cd3c-441f-a0e9-b7282610fe9f", "sighting_of_ref": "indicator--f1514e2f-a78f-4a1b-af08-e989c79f6259", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23a4ab72-8736-4c83-95c6-822b5d3c98c1", "sighting_of_ref": "indicator--eb51a316-7fc5-48c4-a200-5c6057cb4f4e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d09e75db-c43f-41df-8382-6611338e2254", "sighting_of_ref": "indicator--2132964a-ebcb-4674-856e-457b467cdf72", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f0c505c-a2ec-469d-b6ac-18f90dd67b09", "sighting_of_ref": "indicator--5e23e3d8-dfcd-4383-9d80-2bae9193f425", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa6a6afa-07ff-47df-928d-6c5b03c93e0a", "sighting_of_ref": "indicator--5e23e3d8-dfcd-4383-9d80-2bae9193f425", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9701e426-2b61-4785-9a3a-25cd966e0857", "sighting_of_ref": "indicator--23d8b853-aa70-4835-b682-08517a680e2a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65283676-dee7-4421-88de-eabb05a30f51", "sighting_of_ref": "indicator--57230b3a-3ea2-4400-9353-63f6b16d1981", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fec91d3-f6ed-407b-8153-f11ed5231136", "sighting_of_ref": "indicator--87889366-2b91-4f04-bc9f-4088bb7a621a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4416fb91-1bb9-43bc-bfec-95a5d9cee184", "sighting_of_ref": "indicator--dff73a37-b36d-4efe-83d0-6c5efc6a3ac4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19ad8115-45f2-4cee-9c4a-2d5099579669", "sighting_of_ref": "indicator--88eaa116-066f-451a-9647-748885137220", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e065ac6-bd34-41d7-823c-7da2723d8e1a", "sighting_of_ref": "indicator--519ebaf2-ae29-41bd-9387-fd5842574ff9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fecb2a15-8db0-41fe-8e8f-25f3a9b5ade7", "sighting_of_ref": "indicator--cbfbfd54-5ed8-4a27-a39f-7d8012189b2c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ca2192e-9f6e-43fe-aecb-2a8a73cc9b5a", "sighting_of_ref": "indicator--fe95c744-b947-431d-9962-0341da8a167c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cc2f67b-2484-4627-881f-0a4044893649", "sighting_of_ref": "indicator--8fcd957f-d7cc-4528-8772-33236c5f64fe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ad7057f-05e5-499c-8f72-c975561571ed", "sighting_of_ref": "indicator--f1f78d1b-657c-4413-afa8-eeb179ce0ebf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f9ca057-65cf-4d53-8bb7-d89396add79f", "sighting_of_ref": "indicator--860fb3a7-5853-4ad9-b893-b4a997386534", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2434cde9-c9a3-4203-9660-2b981a414bb1", "sighting_of_ref": "indicator--145069c2-a83a-4fbf-b5f2-14afdb0b078b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29571aab-9757-4ecb-834c-29babf11ee1b", "sighting_of_ref": "indicator--8712462d-53a4-432a-b75c-b8cd3e8cda9d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d89748d1-91c5-4339-8417-f816c5c12090", "sighting_of_ref": "indicator--0f5d5a15-af84-4cd6-89c7-20de07c86588", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91d7d601-f2e0-485f-80b6-ea252b529e3b", "sighting_of_ref": "indicator--0f5d5a15-af84-4cd6-89c7-20de07c86588", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--285592d5-3e38-45c0-b7a5-df3011c28a21", "sighting_of_ref": "indicator--99002551-f66b-4c67-bb1b-2d58cf6b2d96", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eed3e002-cc04-4e1f-b437-1f3a458467d9", "sighting_of_ref": "indicator--3c21b2f0-f9d3-4b63-b130-662790372d2f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4a5f7a2-db60-4b7e-a4fa-b68bf5786394", "sighting_of_ref": "indicator--6afb78e9-ea12-47ec-8473-73fb4e2d9f79", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c17305af-13cd-47b7-82c1-b1d2c70612a7", "sighting_of_ref": "indicator--f49cbe20-e148-4509-bfda-1a54205594b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a355a0f-3a1b-490c-90a6-706d1ce72afe", "sighting_of_ref": "indicator--2dfea0bd-8ce9-4506-92e9-57411c0c6ce3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d04eaea8-17e9-40eb-869d-65f6dbf996b5", "sighting_of_ref": "indicator--e15b52bd-d8ea-46a9-b367-70c0ef0b5c72", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7a7b63a-3cbf-418f-aed7-62ff040fd81c", "sighting_of_ref": "indicator--e15b52bd-d8ea-46a9-b367-70c0ef0b5c72", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a85a4b8b-eb85-4211-8e47-bed55967ed27", "sighting_of_ref": "indicator--f3fb884e-13cc-4290-a172-02890bba5d37", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b9906f9-289f-4f3f-8369-db5e92866f24", "sighting_of_ref": "indicator--3f68132f-8823-452f-930e-03f05e2ed1ff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--405557f3-2ac5-4a10-b896-78676eb84511", "sighting_of_ref": "indicator--c38f258b-c41a-4f1c-8c47-7188281b13ba", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--627ccc68-9892-4638-8667-5272c580c7e6", "sighting_of_ref": "indicator--7900ab0d-516d-4954-a473-6851b1f25086", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62701e62-6051-42d1-831d-cd292b4261b8", "sighting_of_ref": "indicator--ff542112-b53e-464a-9a6d-b66a84765092", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18fcea7f-3e15-47d9-bd2a-0ad60e380f3e", "sighting_of_ref": "indicator--5efe9681-e24f-43fe-a9f5-eafe0cedebab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c789f48-b4b2-42bc-b6bf-c56dd09b8d5a", "sighting_of_ref": "indicator--a2d363d9-ad4e-434f-b4dc-2a4f718c2294", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bab3393-18b8-4f77-9b69-8b2e77a97ba6", "sighting_of_ref": "indicator--f8b02502-8ea3-4a40-8516-ec1c06bfb279", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1eceea30-1be6-467f-ac3f-86c45e212669", "sighting_of_ref": "indicator--d6c2936d-43ba-4032-bbaf-e6b861d364e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7776ab40-f3ee-427e-883f-9792adbc772c", "sighting_of_ref": "indicator--8623c16b-28fa-47c0-9133-3eedbac692ac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab36efc9-1949-4898-9ea4-35198bed500d", "sighting_of_ref": "indicator--a9e63f87-da44-4d14-a844-35509f80ea76", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb39ec09-03e9-452c-a51b-bf071c8acbc0", "sighting_of_ref": "indicator--799c1fe6-d605-4106-b83b-2a2561baece4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f234b231-1982-444e-9533-98ce9917b5b6", "sighting_of_ref": "indicator--5ad2a704-1d25-4081-bb88-c24793346cec", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--081254b5-8490-438c-8717-f6cfdc593f3a", "sighting_of_ref": "indicator--96552725-1034-4f28-ab87-91a27b4569a4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63b4071c-bbe0-47a0-87ce-532695d65ef6", "sighting_of_ref": "indicator--0a3f25b9-ed87-49d4-a6d0-ff2bff7a7603", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--288a3d78-d953-440f-8c49-0dd50f6bceda", "sighting_of_ref": "indicator--17c69a3d-5e2b-484b-8fc3-df4e41a2a221", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00b9ece6-6330-4fad-a6fe-828a3f411a6b", "sighting_of_ref": "indicator--249431c6-5822-4c98-9e79-991573b2a9d2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e48e735-1c85-47d8-a8a6-6428da2f78ce", "sighting_of_ref": "indicator--648007c8-b0ff-4917-ba46-1a69d62bb9d4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3bd57d4-ac86-428b-baa6-322bd7ede71f", "sighting_of_ref": "indicator--ef419868-0965-4f26-8ed2-3412583ae01f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0527f8c6-389d-4b9c-85fe-be88e1919306", "sighting_of_ref": "indicator--8134d1b3-2911-4ea3-92ad-8bb1a0c82362", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf45f56c-6eb7-47b1-8344-4fd828a6dd96", "sighting_of_ref": "indicator--a03bb7f7-b142-44ea-a022-6c279b35d8b4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ca4cb28-615b-4e2e-ba1d-b32b9f750a7d", "sighting_of_ref": "indicator--611940bb-13dc-4c82-8426-22b87a7d3efa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2425c25-c6f2-48af-ad95-4d6e119818ca", "sighting_of_ref": "indicator--8d82b19e-118c-48df-a781-721ef82db81a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a376a62-9b6e-4fdf-9219-3aa4b6141baf", "sighting_of_ref": "indicator--dc078b18-f580-4c78-946f-efa6cb319828", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fb4c043-7ffc-4e19-a570-70c8b1294d78", "sighting_of_ref": "indicator--6d3b1e92-bfa6-44f0-82a1-f28f85962e1a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de454e83-b6b9-46ab-8780-fd981a4d57d0", "sighting_of_ref": "indicator--881de263-cb60-4d29-af0b-f7a678a7b1f7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3b8a0c1-87f0-4f14-a0b6-09527bb9b0f8", "sighting_of_ref": "indicator--19eeb1f8-7aba-4d75-acdc-2605b4b7f26f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b03a5698-45f5-4776-8d31-c2a0d99a1dce", "sighting_of_ref": "indicator--302d0876-6c43-4055-8f6c-0273ba5f6a54", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa45af99-c6d5-4af1-b25c-762f47e91d06", "sighting_of_ref": "indicator--05779171-2570-43b3-a70f-d6aa18bdaee1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40a7745e-54f4-488d-94e5-065e99b76273", "sighting_of_ref": "indicator--f9c92ced-c7ff-457c-82ca-a23f416ead31", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c47e62c-95df-444c-8eff-bf64bbe3ed7a", "sighting_of_ref": "indicator--210f7e90-9832-4730-85cc-dbd7b4f2a8e6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e76a93b6-8c70-468d-8a39-35e269af1cea", "sighting_of_ref": "indicator--6c28c71d-aaba-4136-87b5-360027ca219b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a46a1761-26db-4d52-973d-ba4fc76dca30", "sighting_of_ref": "indicator--63675b25-1db7-4096-932f-1ba96cc0cc4e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b654508a-1471-435a-a617-61395fc7cb0f", "sighting_of_ref": "indicator--6367f0bf-00ba-4582-8928-b0f85b8642b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e6674e7-9163-4325-8d5a-44b496b5da55", "sighting_of_ref": "indicator--ab70812c-aa3f-4cbe-a8af-25064ecfb1d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c413489-68c3-4db8-9dd5-c1693902360e", "sighting_of_ref": "indicator--4ce6c26d-0e91-40ce-959e-b83a32e0b97c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2785085-9efa-497a-b80a-3e982ba778c5", "sighting_of_ref": "indicator--dd946ac6-863e-4f8c-bfb9-84cf0b4d9455", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15a10558-d0d9-476a-b9c9-c796b4f96bcc", "sighting_of_ref": "indicator--4c5bacdf-a7d8-4c0d-8a6a-57aa8b6208bd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--417d7bdd-fff3-4af7-8729-13710fe34106", "sighting_of_ref": "indicator--4158fd27-1437-4994-9078-f8dc9913ec70", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aae21e9-417f-41f9-8b10-f933143be2b7", "sighting_of_ref": "indicator--4f8bed67-6556-42ee-8349-fffc320e89a7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7114244-e4ab-4263-ba38-c731e0fcfa16", "sighting_of_ref": "indicator--e4ce41f2-d4ea-40bb-89c7-eb5282ad47b8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37aca457-58ec-4a99-8572-271c3ba769fd", "sighting_of_ref": "indicator--2856eec2-3994-4fdd-8b31-e4fb323848b2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f96dbe23-4f00-4726-8b7f-7a9038459ff1", "sighting_of_ref": "indicator--06153f2d-ea27-4f88-92b2-33839dd7f604", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4112a6f-0870-480c-8005-849aa9b54ea5", "sighting_of_ref": "indicator--628638a3-4e63-4d51-8d60-0502c9e5355b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3a23cce-5309-4d1f-96ad-3d750a01698e", "sighting_of_ref": "indicator--e21e2205-879c-44d5-b76e-2716699d1721", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8d75bd1-5597-41f5-9977-c05bb4f6ebb8", "sighting_of_ref": "indicator--66ec8abb-e975-498a-aa8d-5f9e2fc26e7f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1fb489a-4c25-46f3-bc5e-4a37ed347e5d", "sighting_of_ref": "indicator--18c6afe9-8f5d-47d5-b384-f72a16cc1f18", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ed058d4-2cc2-41ae-bf05-6bb4ed80bd03", "sighting_of_ref": "indicator--ec20658a-8cfe-46f0-99b6-273859ffe7aa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2f83790-5855-415f-89ac-3f9608888a08", "sighting_of_ref": "indicator--0518329c-8216-4873-93d2-6e23e45eb441", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1be4d8f-d1e5-41e3-b1a1-0a44d6857b52", "sighting_of_ref": "indicator--16b0bf34-da57-411e-a244-3cf13c984f71", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--775b4d95-eb4c-4a39-a1d3-ee4a5f1188fc", "sighting_of_ref": "indicator--54bde0e8-91ac-4914-96f1-96713f419be3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0be4ddce-541f-468b-83cb-2ece883c8be1", "sighting_of_ref": "indicator--8b23e703-20cc-4665-9a59-3b457ed24b67", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1e57efa-8135-412d-b894-db8357c2dbe5", "sighting_of_ref": "indicator--ddd733b3-cd68-4443-82f3-f857f80c4853", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7afb2471-1fe7-4d2d-948e-66e8b5380333", "sighting_of_ref": "indicator--e1970e6b-ee25-4d2b-b3d5-85ed3ce0f3aa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2045cb15-d21a-421a-a82e-654e25421400", "sighting_of_ref": "indicator--19b60eac-b8e2-46fb-8b4d-ecb7f4601861", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20b62392-177b-48d0-9adf-eb6e20ba487d", "sighting_of_ref": "indicator--5228776c-cc1f-4f1d-b466-524c6337d73b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ece2f550-f6fd-4fce-8b2f-fd130d0dd112", "sighting_of_ref": "indicator--d6f9788a-00cc-4804-881b-4de96224f9a1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c617d78b-da02-47b0-952d-a49b0815da19", "sighting_of_ref": "indicator--af93706d-6ded-4cbf-8448-44065c20e28a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91eb61c9-8150-45a7-a726-b06ea079b755", "sighting_of_ref": "indicator--bbfce593-6a01-462e-a768-19325537e3de", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d59eaa1-8d37-43e0-a8c5-c65029d62f85", "sighting_of_ref": "indicator--7e3b5307-b9c6-42a2-bc06-8bf629370b50", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be24fdf8-8cca-46dd-81d8-6c7af55b796e", "sighting_of_ref": "indicator--c20b98f0-4427-4671-bfe5-b3ca549bd72f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb3f1c50-b627-4c45-ae5e-f48c3d68a30c", "sighting_of_ref": "indicator--18147a43-f887-4be1-9a08-8d2882b7adc6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92b39968-5506-4183-b650-49e08203936a", "sighting_of_ref": "indicator--433b69b5-2642-44bd-bdd7-3d2e74808d5c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--849bf23b-acce-42f3-a4b1-96683926d97f", "sighting_of_ref": "indicator--54505420-df17-4efb-9468-887b2ec6706a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b27d678-fbd0-4d3d-be9a-3dba0f947e45", "sighting_of_ref": "indicator--2113028f-40a5-4925-a3ac-0c655361641b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29b59201-d7f4-42c8-8cc3-49029f89abdf", "sighting_of_ref": "indicator--0508f443-a112-4db7-b558-8df9475d8a19", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0676abd4-5a07-45d6-b2af-f2a105b459b9", "sighting_of_ref": "indicator--32eb2d0f-a30b-4823-b834-74b797fe15f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfb99f7b-4bc5-4467-a086-24a770bdc69d", "sighting_of_ref": "indicator--fac1bea1-9e7f-456d-ba0b-a7412b2eb882", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e22a173-3080-4cb9-b915-ac33fc88ad26", "sighting_of_ref": "indicator--582a8922-ec0c-41e5-9a75-bafdfab903e8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6fdb608-c5fd-46f0-9778-de169bf98c23", "sighting_of_ref": "indicator--e0190cea-c964-49a0-8f1b-c70a06b8517f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b6a0d30-ec70-4fcf-869a-ca7a802455c4", "sighting_of_ref": "indicator--07affaf8-9e52-44b1-bc3e-1f67f1526b6f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b436dea-366a-4654-aa58-1af586feb3fb", "sighting_of_ref": "indicator--2e981e36-e77c-4c73-afda-1fc7fbf64cae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82410aa8-f309-420a-a1ad-70d569015ff2", "sighting_of_ref": "indicator--e527c38f-682e-4f2e-bfff-fd1c3c2a8698", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45eed0fc-ded4-467a-95a8-adbf1d0ccd7c", "sighting_of_ref": "indicator--242f0ad6-f0f4-4eab-b4dc-283f52885769", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--271de9e8-dd0f-4d0d-9de3-4174c6a5e50b", "sighting_of_ref": "indicator--5834e683-c0f3-4f73-9fda-75da418d4c6d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94f4a251-a9bf-472c-8585-ccc37b80acf1", "sighting_of_ref": "indicator--138aba21-a0b6-4ad5-a7bf-794bf38b8fe8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f352fb4c-bb89-4b74-9c20-395ba67754c7", "sighting_of_ref": "indicator--92c20bd8-26e8-4f04-a9eb-bcef22cb3f2b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--685bc384-1080-4fd8-a9ef-15ee591e2470", "sighting_of_ref": "indicator--ad01c2b9-61fb-40d3-be4a-5c13f1e5fb9e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d6112b6-5881-478f-91a5-4f120575e26d", "sighting_of_ref": "indicator--86510f32-986e-406b-8ea6-b43b433d0ef7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfbeb159-f1e2-4dbf-bc74-d45bd0119b2f", "sighting_of_ref": "indicator--8ee06dd2-b510-45a4-84d3-acb7301773b1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ef920ef-ca69-44aa-b2de-3bbc0d209df0", "sighting_of_ref": "indicator--b369d965-420b-4abe-8333-dbe24dc53e12", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b21e91a7-d740-4a73-8c47-13bf5355797b", "sighting_of_ref": "indicator--ca12a7fc-3c47-494c-b862-aa417973caaa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e055ec9-85b4-47d8-a9a5-5f4cfb28c9ed", "sighting_of_ref": "indicator--a30d8963-f809-41b4-9b9a-b0015cc32dad", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cefedf5f-fa32-4e49-9bb8-949ab39a44b1", "sighting_of_ref": "indicator--850f93f3-5766-449c-abba-1a29c0e9865f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a38cb977-a26f-4e0f-9618-5147a83ec253", "sighting_of_ref": "indicator--a233ceaa-d7d5-4e3a-b137-a5608264c3f3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--033a9e58-b0b0-4205-b2b9-3df8745ec9b2", "sighting_of_ref": "indicator--a233ceaa-d7d5-4e3a-b137-a5608264c3f3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bcbec8f-5872-4e28-a88b-73c5e6e457ad", "sighting_of_ref": "indicator--25c73e11-155e-4176-affa-b18c8e51af48", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b77b49bd-cd84-4a08-8392-7999015859ba", "sighting_of_ref": "indicator--0519d77d-a7a1-4265-adc8-e60250b6fcf7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--582bc1f5-67bc-4522-9626-36ec4f833dd3", "sighting_of_ref": "indicator--7050696c-afd5-4088-a09d-ad0c494de850", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63e0a108-fc62-4420-b53b-79cc2498255a", "sighting_of_ref": "indicator--290eb6f2-1f01-4164-9098-6f3de112427c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--533c564d-dcff-4375-b295-46cc56d4e895", "sighting_of_ref": "indicator--ea10acbd-e4bb-433a-9d1a-85e5c985c65c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95a18e57-b410-4c6e-8a2f-8c15ae8c329d", "sighting_of_ref": "indicator--7d396106-0830-48c6-af97-08fe52746d8b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3380239-aa16-42e9-95ea-5a99b258e355", "sighting_of_ref": "indicator--5cec2c6e-2e96-4b7d-8143-0ac1caa39378", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--814aa6ff-ff69-4beb-ba4d-778b23f13929", "sighting_of_ref": "indicator--32515f35-2893-4c8b-a5ef-3ae68770404a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec6d2a26-8acb-455a-a7de-36c7517f2164", "sighting_of_ref": "indicator--7050c133-2396-4df6-b93e-d0f381855d2f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--529098d4-b19d-4724-a9d4-91e4cdcd0b96", "sighting_of_ref": "indicator--e7d77f1a-f441-4f2b-b421-31afab5ef51d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08655177-8353-45e2-97b3-2a1781a69af0", "sighting_of_ref": "indicator--5e297655-545b-445a-b500-2a6093255473", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--749f38c0-080d-4a1b-9e54-4f2e5518fe2c", "sighting_of_ref": "indicator--13676bf1-274d-4ccf-9797-70645158e2cd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82a81cbf-0f75-4abd-9c78-41e9e684a2c4", "sighting_of_ref": "indicator--05c4ab7c-da8a-47de-8c6c-4b6e725aa970", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afbc6bcd-a683-42e5-beb2-b43523a82e6c", "sighting_of_ref": "indicator--0d9eca92-a7f1-4100-8c0d-5b0d411b8f9f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca97b0c1-d423-442e-946d-cd733d10ed1c", "sighting_of_ref": "indicator--cd7f4942-02d2-4f61-8692-b678fa87d688", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f735b5dd-ebfb-44d4-ae6c-d746acb0c167", "sighting_of_ref": "indicator--4f7c682a-7d75-48ca-8d37-252036763a4d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f717844-1258-4439-9a1f-b51a2401b3ba", "sighting_of_ref": "indicator--0fc5c5a9-79f3-45dc-b5e5-dabe4ba050cc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad5f9d42-17ba-4659-b355-cdd3d3e3921c", "sighting_of_ref": "indicator--c888e91a-a553-4a61-96ad-dd6f90040fd5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef62a189-5aa8-4e0b-b37e-f4c2401edd03", "sighting_of_ref": "indicator--e8bb9300-3cc9-4663-bb32-b4f0996c0160", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65bafde9-89b3-45da-ad1d-ae67583c5bd4", "sighting_of_ref": "indicator--b73a1597-7b52-4a40-ab9e-a8c03e8cab66", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c385326-d20a-40bb-90fe-eae9e82272fc", "sighting_of_ref": "indicator--f0f6e0fa-1c2f-4ce2-9eb2-74edfc0a1c97", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80594bbc-b464-4f65-b8f9-f4586d23aa9b", "sighting_of_ref": "indicator--c9e9cd50-63d9-4a5b-b1ae-eed4752cbd0d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33300cdf-4ef8-4a34-b5bd-4c9c25b9c153", "sighting_of_ref": "indicator--14dfb7f6-84a6-4ac8-ad06-24cd70cf6afb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80d1077d-2d9b-477c-b469-2832f48ec74c", "sighting_of_ref": "indicator--b30613d7-c0a1-4e26-818d-6a2becfca6c0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8a8ce11-8e63-41d3-9bba-9ace79b8cf52", "sighting_of_ref": "indicator--04767397-2b1d-4460-9fe9-bebcd09024b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88003d84-7491-46c4-95e1-dcae150b0bb7", "sighting_of_ref": "indicator--b0bfc3c9-0c8d-4e89-9e9c-328aefb21403", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4934520d-f689-4ab8-965f-4ae064a3b1c4", "sighting_of_ref": "indicator--babcbf10-f42b-483b-a695-75bf49474df1", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9558b063-3856-4a9d-bed0-5f4de6c0ecf1", "sighting_of_ref": "indicator--cc672149-d88a-4d57-88eb-75a81b9fa227", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a15501a-4ed7-4734-975e-886b915dd5aa", "sighting_of_ref": "indicator--9de6b0ef-6ab7-4bcd-9175-58ea29579ca6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62c193b1-74e6-4013-9e87-8cd654c09f9e", "sighting_of_ref": "indicator--c88200b5-840b-40d3-ae5a-f910290992b4", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ba4125b-47e9-42b0-848a-39b2b9dc8040", "sighting_of_ref": "indicator--b6ec35ed-8834-4b0e-becf-aa5c2c27b802", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c682d39e-a84c-487b-8041-af2df9eff055", "sighting_of_ref": "indicator--38c98ef9-27c4-45cb-8247-d354ddf180a0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d308b100-e1dd-40c8-81b3-50269d04f0e3", "sighting_of_ref": "indicator--ce54ad5f-a90d-4fcd-934d-3dc7eb85dc32", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6a49bd5-d741-488e-9b9b-36761bcc1aa3", "sighting_of_ref": "indicator--939f9bf3-9b9d-4940-bf1b-b1483c8b50e3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61368b8b-3624-4847-a7d6-ce8694411c75", "sighting_of_ref": "indicator--ad858f41-4623-4a1f-9496-4f7bc4e264d1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2ad2ed0-351e-4661-996c-13105f9cb9ec", "sighting_of_ref": "indicator--f6462556-d8ca-4701-89b2-1bce775df3c4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77bb619d-76d5-46d6-b14e-22624c8d619f", "sighting_of_ref": "indicator--0d8fdde4-9ad2-4c55-acf8-56d5d667ceac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9325a0d6-9c18-489c-8122-564a6cabc21c", "sighting_of_ref": "indicator--aed4f67f-708e-4de7-81cc-894f70f59d6d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f6d39c5-b970-48f5-adca-089273c54313", "sighting_of_ref": "indicator--b5dfc482-c33d-4767-93ac-ec12d4acc06f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90fd53d8-5b63-4fca-ac32-3e43cb1d8551", "sighting_of_ref": "indicator--f8de6662-bc86-4a21-98fb-967f617315ed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d9e7fdd-bf8e-4653-a75c-c86750361aaf", "sighting_of_ref": "indicator--c0db3671-250c-438d-9ee2-ed8cef5d1ea8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8981f1c7-41cd-4162-ba3b-c0b8d5b17fc4", "sighting_of_ref": "indicator--c0db3671-250c-438d-9ee2-ed8cef5d1ea8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b37cc73-93a0-4109-a786-1bf56bb213ad", "sighting_of_ref": "indicator--1a4722cd-b77b-41c6-a06f-9dba73485d3f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0810b0f-9619-4bec-9f0d-8525ee4e9596", "sighting_of_ref": "indicator--1a4722cd-b77b-41c6-a06f-9dba73485d3f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7a2cba2-fa69-49be-a22c-68c5eaceda37", "sighting_of_ref": "indicator--824ea30a-20f0-4f78-94e9-067013d06d73", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17803975-2bd5-45c6-a0df-59ce8400975e", "sighting_of_ref": "indicator--3b87e62b-deef-4bb6-93ba-245f36ef16da", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75d3fdea-1033-4980-8811-a6db0502998d", "sighting_of_ref": "indicator--3b87e62b-deef-4bb6-93ba-245f36ef16da", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dc3fb5b-f3c1-44d8-9522-054f2b974da0", "sighting_of_ref": "indicator--a764eb07-f4fc-41f5-9362-2d81688ed49d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d832966-e18d-4c10-9418-e5d28a996b65", "sighting_of_ref": "indicator--a764eb07-f4fc-41f5-9362-2d81688ed49d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--987b04d3-ce6b-4c75-8224-fb3cf2b25ef4", "sighting_of_ref": "indicator--a53bc211-e8f4-4552-b147-ba7d33953f3c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7a770a4-e6f3-44a1-bff6-7fd95281bc21", "sighting_of_ref": "indicator--d9cd631f-f9a2-4d07-8245-210b13f12c52", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b1786d9-16b8-44e6-8049-5e81750bf0b3", "sighting_of_ref": "indicator--d9cd631f-f9a2-4d07-8245-210b13f12c52", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a58e197-2c97-4478-a8f4-b89858807842", "sighting_of_ref": "indicator--50586c18-5eba-4254-a66d-afa929d7f07f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f68757d9-7d37-4c69-a289-950bc2ce8561", "sighting_of_ref": "indicator--522ada28-37c7-4612-882c-3790a87356e0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae3f3055-2d0e-463d-a9bc-b1a0e4b7677b", "sighting_of_ref": "indicator--a3121f02-ecc2-4a45-b78b-75d6ad978d3a", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea275734-2ebb-4bb5-ad42-eb11ebf11199", "sighting_of_ref": "indicator--d74084e6-5890-4c06-9be8-03be19c8bc80", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73ba3dc7-81d7-4864-83dd-db7776ebfb2c", "sighting_of_ref": "indicator--af1fbfd6-ac0a-477e-8307-09b57ba20e16", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9fbff18-2e74-415c-a6dd-9c2f77162be9", "sighting_of_ref": "indicator--af1fbfd6-ac0a-477e-8307-09b57ba20e16", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3f4b345-15c3-4946-bbca-ffdcd0f49e3b", "sighting_of_ref": "indicator--8d82e44e-9079-4eb2-b646-5e4f4ae4ddff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--272ed61d-59a6-4b61-94a1-3c7bc4b9cdc4", "sighting_of_ref": "indicator--1be61eaf-b182-45cc-984e-2caeaa5f2f2c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c10ed973-477f-4be7-abf5-679c646f0def", "sighting_of_ref": "indicator--f6df325f-7c10-47dc-8fae-b6a6e29412a1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84613951-3a4a-4815-b777-3bb209b40c75", "sighting_of_ref": "indicator--b93165d4-0c55-4f67-b401-6157486c3a5b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bf8cbc0-2b6e-4da5-b806-eaa7675fcc0e", "sighting_of_ref": "indicator--a2095a35-0193-433b-8d69-157df2018b1f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24d27c19-59ae-43a8-8b5a-eebd15487947", "sighting_of_ref": "indicator--57d46715-1c30-4ef9-9c70-65eef27c6db3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e64318f1-272f-4fb0-91a8-0619ff9eb6fd", "sighting_of_ref": "indicator--0d8aeecd-5425-4136-96de-8c5542dcf364", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--953b4e9c-0b9f-4e88-a806-e7180de7135e", "sighting_of_ref": "indicator--4df302be-37c4-4210-b6bb-74c475ce4d05", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef93295a-0b5c-497d-a938-4545dc1459f2", "sighting_of_ref": "indicator--2fec9d3a-c860-499e-aaf5-cdc4682c59ed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1286bd7f-062e-44a4-8b0e-39cf86238342", "sighting_of_ref": "indicator--3baad22d-572f-4eec-b8bd-9b0b89e41eaf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c097e5f-846e-488f-b6cf-b520d813add9", "sighting_of_ref": "indicator--3baad22d-572f-4eec-b8bd-9b0b89e41eaf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bf2aec1-42b6-4c27-aea4-759004d83992", "sighting_of_ref": "indicator--146c1a77-3f89-438f-a3ec-a9633c406452", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--459ae448-1b3c-4e84-b972-e1c79cacd18e", "sighting_of_ref": "indicator--146c1a77-3f89-438f-a3ec-a9633c406452", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3cfc01c-f3ca-4bad-95fc-8ecd85ff744b", "sighting_of_ref": "indicator--32a00c03-7bce-42c8-b0d8-f4863590746b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e4fd204-c04b-4e2e-bca6-b26622148460", "sighting_of_ref": "indicator--b87ca772-561c-4aab-ba17-571619af0cd3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aa844d1-6574-4ee9-a1b9-631dd6a4c3ff", "sighting_of_ref": "indicator--b87ca772-561c-4aab-ba17-571619af0cd3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--053f5fda-ec6b-4ff2-a03c-f0fe0278f0e2", "sighting_of_ref": "indicator--75dfc02a-673a-400f-aabf-131a7f6c8e17", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6919580-137d-42d7-a17e-70fd3aaebe89", "sighting_of_ref": "indicator--ef54e3a9-e72a-4957-8696-1029518c90ab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af29f98f-8a23-49d8-afa9-096706b1a8d5", "sighting_of_ref": "indicator--7f3ad5d4-b9a1-49ca-a99c-3f5b8aabbaf9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f14eef96-66b2-4349-9996-006fd3601e7e", "sighting_of_ref": "indicator--852d5a5a-55b7-4006-a99a-def73d74ec05", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f57b41a-1065-4984-a6e1-ed4cb2261c26", "sighting_of_ref": "indicator--852d5a5a-55b7-4006-a99a-def73d74ec05", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bcd10ab-1d30-4a8f-97c3-e76e33d577ce", "sighting_of_ref": "indicator--600c5382-2580-4692-9f5a-4bc2a15f4371", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d249d4dd-7248-495b-921a-4d8f07b1fe2e", "sighting_of_ref": "indicator--07bdce58-a5bc-4e88-b061-a68680a9fe32", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74a749de-d9cb-4b34-b659-a68ca396b60e", "sighting_of_ref": "indicator--f3419cec-2776-40e6-93b2-67346ea451c2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72e435e9-1cae-42e2-9818-e1e5b9d48aaf", "sighting_of_ref": "indicator--da18aa2d-fb62-4b8c-9bee-426ddb7020ba", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--381fa9b4-4538-467c-b948-450e12982898", "sighting_of_ref": "indicator--1f9bcab5-9ff4-48e7-a2ac-9fa6fcacc7db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d381f235-cd4b-4062-b403-ee9f51fda618", "sighting_of_ref": "indicator--1f9bcab5-9ff4-48e7-a2ac-9fa6fcacc7db", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0b36159-a361-4a28-9aa8-77e73ec8fe45", "sighting_of_ref": "indicator--0930a7f5-1ec8-406d-8beb-57d3604884b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb187eaa-9c57-4133-88a9-4cd7232e7dc7", "sighting_of_ref": "indicator--0930a7f5-1ec8-406d-8beb-57d3604884b6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5233e016-6644-4eec-967c-ebc709ba8bca", "sighting_of_ref": "indicator--e7fd2a07-a83e-40c3-9ff0-a9eb43935745", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1178779-034a-401a-b957-db1a9bd233f3", "sighting_of_ref": "indicator--912e336d-3305-4cd1-b233-b12b3cbd6c99", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3b9f856-062c-4823-acec-8f691098c82f", "sighting_of_ref": "indicator--65134026-82a3-46e5-946a-8e099daaae3b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44e3b6ea-dddd-4122-b8a6-9bf631848b65", "sighting_of_ref": "indicator--94b57d33-2e8c-4b25-a56a-a2a16f5d22b5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4814743-12ef-4b4c-a60c-3cd2f1084051", "sighting_of_ref": "indicator--7bbdc83e-5614-473b-bc89-5e9fa40a3119", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2bae627-91e8-4f10-acdf-3285f0768db4", "sighting_of_ref": "indicator--80c606a9-21a1-4f17-a56e-8e099b86601b", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70259fff-adcf-401c-97fc-1a10deb4eb6d", "sighting_of_ref": "indicator--18861d6c-5790-42b4-a211-39d95fd1942a", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6cd5ab0-f05c-4f03-bbba-3b849087b684", "sighting_of_ref": "indicator--d4c99e72-ae29-4394-ba15-d46b4191b3ec", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f60df9c3-c469-488f-a558-ab59143324f9", "sighting_of_ref": "indicator--d4c99e72-ae29-4394-ba15-d46b4191b3ec", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88ee11c5-13b5-43c3-9328-00bc78ae3bed", "sighting_of_ref": "indicator--eaed2580-f77e-48d5-bd10-a6cbbd58bb98", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e834ccd-1102-4ee9-93f8-6adde2189b24", "sighting_of_ref": "indicator--c9805cae-f165-4584-8d9e-2da2dbc04503", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0c1e918-c230-4994-acf6-fc427e2d03da", "sighting_of_ref": "indicator--825d6137-d156-41c9-9ae8-930167578179", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ea91d70-17a3-4611-90d6-7df2caf7ea38", "sighting_of_ref": "indicator--945c0d3e-93b1-4a57-808a-6f38dfd80a69", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58c5b6fe-f18d-4ede-a1d9-a81faa619e17", "sighting_of_ref": "indicator--945c0d3e-93b1-4a57-808a-6f38dfd80a69", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e23af27-b1b2-4e18-8c85-93264d776716", "sighting_of_ref": "indicator--ac83f647-e9fd-4119-8956-9a838832740c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c812e5b2-3e53-43c4-9df7-33fc73a490af", "sighting_of_ref": "indicator--ac83f647-e9fd-4119-8956-9a838832740c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f408f11e-3e15-4b85-aa7c-b0de31cfd49f", "sighting_of_ref": "indicator--512d8ede-eecc-4d02-8905-9ada73ea930c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d829365-98e1-4cd8-8b99-28e5b1a0cac2", "sighting_of_ref": "indicator--686f1a3a-7de5-4b74-8313-4e59695d5c07", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5985f20-0982-41b1-9abf-3c34e0889756", "sighting_of_ref": "indicator--17489a88-d2aa-494c-b9b4-56ed3c284f4c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b24dd91-a4b4-423e-8db0-87846096f755", "sighting_of_ref": "indicator--5b39a558-f290-4979-89b9-947b1f475f4e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e82006f-c967-438a-8026-794e371abdab", "sighting_of_ref": "indicator--b672c80f-cd41-4e48-9759-bb730facf647", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4d30993-b00a-4104-ba47-daa0524c7620", "sighting_of_ref": "indicator--0c84c5f1-754a-45a5-9830-605cbd6b536b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08d0ec6f-1493-46dc-b8a2-ef6a5ed96a23", "sighting_of_ref": "indicator--7db0ff10-2160-4c04-88f0-f6c2629f373d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efdd5496-a229-4fd3-ae31-c8467b8f5501", "sighting_of_ref": "indicator--cdb49831-4a68-4a16-83ed-8bfb92c4e26b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4b10561-492f-4775-810e-ebd999c74b92", "sighting_of_ref": "indicator--16cb2442-36a0-4d2f-90e6-de1033ccee8e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d690dd01-8ff5-4012-a335-b9770e240f47", "sighting_of_ref": "indicator--aa4ec894-456d-4612-b019-3deb6441b1ea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25b3e9c9-6c22-4640-b274-57c7ebfe7207", "sighting_of_ref": "indicator--2f925d4e-87c6-4d6e-8092-c00f1111287b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be2eb2a3-01c9-47ba-94d1-2afd20a7be60", "sighting_of_ref": "indicator--48555fcb-14f8-4c9d-bfb3-136848ede4cf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--582a0213-67bc-49e6-bad3-f3df607f8128", "sighting_of_ref": "indicator--759a7b97-282c-4077-8bea-ca5317e182eb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2b399ac-00e8-4d6e-93f0-7f415641442a", "sighting_of_ref": "indicator--9b23700d-901a-4a6c-b345-ed08a242da65", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--520ab719-dc28-4015-80e3-d90f26bd5915", "sighting_of_ref": "indicator--692214a2-2743-41dd-82da-fa4b5b304def", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e02deaf-36b9-4f03-82f7-30a3a0a9f973", "sighting_of_ref": "indicator--ac3c7d9a-0491-417d-8145-4fd859bd3acd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1d0b43b-0474-484e-9275-945900681ca5", "sighting_of_ref": "indicator--a6009030-0c48-4d67-b7fa-bd195097e184", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d6e38f1-b97f-416f-84e6-637abdf99a5e", "sighting_of_ref": "indicator--90cc1e6e-efab-4ad3-a8ba-f000c8c91e0c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6641d263-ecdd-4a16-ad9f-fd98d3418b6f", "sighting_of_ref": "indicator--f210e3de-6a7d-440a-80b6-fda0bdbd0611", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e99af41f-9d80-4900-8d9a-10e12570c83f", "sighting_of_ref": "indicator--f210e3de-6a7d-440a-80b6-fda0bdbd0611", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--528cc3ca-75c4-4300-8ede-9f28e343cec5", "sighting_of_ref": "indicator--5c355a85-77f9-43ee-8d71-1c9b2d52465e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5b43a3f-69bc-4958-bf25-910577609182", "sighting_of_ref": "indicator--336c24cd-4619-4afd-b079-516ed2fd6c7c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc7db546-775c-4f79-8b02-55ffae9eda5b", "sighting_of_ref": "indicator--58d8a2b7-f57f-4541-a39e-fd7dd0d39a2b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--574e849f-19b8-4f5c-9448-5f3419660105", "sighting_of_ref": "indicator--3662fe64-5744-4843-a5a9-8c652828b1a6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd95badc-4960-4cca-b7cf-b62ab132d23a", "sighting_of_ref": "indicator--f38955c1-7695-40d1-904a-09035fe6866c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bb8246e-97cd-402b-9cd2-72cf0a34b9b8", "sighting_of_ref": "indicator--8309b1eb-e070-419f-bce9-ccd64463caa1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ddf49f4-1487-4dc1-8219-d10972c3a151", "sighting_of_ref": "indicator--169c2440-93c3-4f28-ba7f-20a0b6faf0c6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7822f3b-5f6d-43e4-9c6a-f20009374656", "sighting_of_ref": "indicator--a7bf0c0e-6a17-464a-b241-f26c6933ce24", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bb15e06-ea28-4a21-a22b-ffdef9accb4f", "sighting_of_ref": "indicator--b42adb19-ef56-4222-adb4-6ebba9abcc6a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a71ead0c-32c9-4a89-8384-2e129328f2d0", "sighting_of_ref": "indicator--39f1b687-9c4d-4ca9-9bbf-42f92352ab27", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38686c30-b51c-438c-9afc-47822fb37087", "sighting_of_ref": "indicator--75ef34f0-dcb7-4a5c-aa47-c4381bba4411", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--339f0c3e-a973-4ff0-9907-6eb9d692b03d", "sighting_of_ref": "indicator--4645644f-6289-4648-bf5e-dee18c09a9ae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94eaa338-c77a-4f3d-b236-8e3298b68b40", "sighting_of_ref": "indicator--b19bf3dd-43dd-4b3c-8f0d-7709e431fcc3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5099ace-aa2f-42f3-8dc2-ecf78e35a5d2", "sighting_of_ref": "indicator--a074efe4-a4f3-4898-adf5-7a2d5456150e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e11997d-b2d9-483e-ad6e-521f5380d1d5", "sighting_of_ref": "indicator--017bced0-735a-4986-87c4-85a90a011640", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbf19bf2-a4f9-43a8-8125-33b166bae8b8", "sighting_of_ref": "indicator--34a19faf-475d-4176-9b21-73bd3a878fa9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de240999-cc1c-4076-b815-5e47b8e7259d", "sighting_of_ref": "indicator--b74cfa63-5d8c-4978-be7b-84c4cc96ec96", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b162ec07-5ff4-4fd4-80b6-0ae721fe2e0e", "sighting_of_ref": "indicator--2c1113d9-2d78-4588-907a-0b1790057d04", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c445c5c-b006-4a1d-b92b-920061184d4e", "sighting_of_ref": "indicator--a931d3c4-8843-467d-97cd-5ce5ae2949c8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b4635c4-2156-4d9a-a6ee-5210019d2649", "sighting_of_ref": "indicator--0ba26ae5-eb65-40a9-bd94-c6b4f55c8821", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7820d81-8013-4178-b21f-f8d3284d29fa", "sighting_of_ref": "indicator--7969405b-60f3-4c88-961d-5c6ab87c5fac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ad1854c-7746-41b9-9c29-2bc444fef6fc", "sighting_of_ref": "indicator--accecf47-3b25-40c0-b61d-a11d9921c931", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9500535-10ee-4185-99e1-022a6d65e120", "sighting_of_ref": "indicator--476a8a82-612c-4586-888f-2a960c967803", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d614faed-cf57-4d3d-9cf3-406648b576c6", "sighting_of_ref": "indicator--569d0f91-6412-4969-94b1-57351edb513f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--993a5557-3c08-4cc4-953e-4a00eebfe580", "sighting_of_ref": "indicator--456af398-c5d0-4308-928e-99fc1c46c4ac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61a11236-1e01-44f8-b784-36aa8208adc5", "sighting_of_ref": "indicator--f77b1fb5-6775-46b8-86b8-0f64f3d9ba7f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71fe189f-4d9d-4a66-910b-04f8018cf0dc", "sighting_of_ref": "indicator--98e7b95f-5eca-443c-8920-c88cb5a4722f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49a6073e-6042-4577-8b36-2c32db949a32", "sighting_of_ref": "indicator--411846a1-627b-4c35-9eda-24fada9ccebe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d2fed30-5d38-434e-8dbe-f4db7df41fae", "sighting_of_ref": "indicator--f105c36e-08ea-4f7a-a372-c09c2068a83b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a4ac039-8388-4b39-bece-c5a6142bd0cf", "sighting_of_ref": "indicator--37f47edd-01a1-4d0f-91cf-26910a3e4efd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed141fc6-7b4d-4488-821e-10e20b69c8ff", "sighting_of_ref": "indicator--37f47edd-01a1-4d0f-91cf-26910a3e4efd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c458e99-67c2-479c-8fc1-830161a50592", "sighting_of_ref": "indicator--0a203633-8ce6-4a12-a312-c9656e9d13db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd9bb35f-4545-4b3b-8b4a-f77d3b66823f", "sighting_of_ref": "indicator--43676b68-c33c-4606-a697-41627db7a51c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a06363e-e473-4aa0-8f55-c75a2cb99bb0", "sighting_of_ref": "indicator--b636a65d-f5a1-44f6-9cf7-e2ba4a466c49", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5546e0d-2269-406a-8343-1e2e6172d22c", "sighting_of_ref": "indicator--d4cf6058-6e46-4a81-9069-116f4a2dc51f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--679d0069-65aa-4b55-a4c8-9c78d18db170", "sighting_of_ref": "indicator--fc273c7e-72a3-4a8b-9d04-0ea89bb604b9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81b88b34-7bab-4237-a06d-2a9ffa574e85", "sighting_of_ref": "indicator--196994f8-60cb-4c41-ac0c-5acbc58b5c6c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bfb9469-3251-4355-a01a-fdb194c47936", "sighting_of_ref": "indicator--f3bc6612-9135-4250-b7e3-478c37913d2a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80ea9707-9281-4c1e-95b1-d5156c50a95a", "sighting_of_ref": "indicator--c6ac68c4-5494-4021-8935-886a4ffe6ead", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88b6b159-3de5-42b3-9be6-2f68b712ec11", "sighting_of_ref": "indicator--95015fb4-4b6f-4a20-9978-6fc3d1d74a77", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fae2d2a-845d-41b2-8d6c-1679811ca983", "sighting_of_ref": "indicator--624ad3f0-2c0b-4b24-adbf-5956223cca3f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4e54993-2ed5-4301-b3c2-2f21bbca6afd", "sighting_of_ref": "indicator--0fad74be-0fb2-4eb0-a614-ecbd2da9b898", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2bf164a-4986-4538-b49d-17ff8019313f", "sighting_of_ref": "indicator--b1842115-2639-4c19-9ae3-2daf855c139b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41eb2035-75a6-4a72-a219-f16989bf7776", "sighting_of_ref": "indicator--c2675f78-c031-497b-a705-ef73092526a7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77f421fc-cb96-470a-b1f5-c943c6aa68ca", "sighting_of_ref": "indicator--951e2e9f-7f76-456d-aa1c-6b811c2519e3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--933f79ef-ebbb-4c73-805b-27b5b6b2f8ce", "sighting_of_ref": "indicator--935b8dcc-15bf-4c5c-a9c9-b466596f898a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7683a10-ff6d-448c-8e93-59917cc1ddf9", "sighting_of_ref": "indicator--e9ca460e-85cc-4873-aa0a-d89742692e32", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b20706d1-a840-406a-88b5-8f5aa7cd9442", "sighting_of_ref": "indicator--67f97fb3-8775-42ac-8a4b-cc82934059ea", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4288f532-cfed-4343-91c6-53c0e77ab84c", "sighting_of_ref": "indicator--a84cdb3a-274d-41a0-8d98-e728cc160782", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70822177-1ac5-483f-8642-51fe5a139264", "sighting_of_ref": "indicator--74ff5132-2532-49d6-947b-7ebe958932cf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--018aa4e3-4b55-4fdc-842f-8fdb103c6494", "sighting_of_ref": "indicator--0575c514-5f57-4f89-a918-080a4683ba71", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88bd4c68-12d8-4556-a023-f7301d8fb7b2", "sighting_of_ref": "indicator--a003d193-2863-4c15-b41a-8406940e1993", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07a2f523-b9a4-4d00-8b95-05b221525bb0", "sighting_of_ref": "indicator--ea385494-660d-4ba3-b2e6-723fe89e3a4c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--777c3bcb-b48f-43b0-9fc8-04722fbbcf2b", "sighting_of_ref": "indicator--ea385494-660d-4ba3-b2e6-723fe89e3a4c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17b142ad-4e48-4ccb-8f31-a21a9b81bdf1", "sighting_of_ref": "indicator--12a45367-83ef-4815-805c-5e47900863fe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43c30e03-dbc8-4e6c-a37e-47e349650478", "sighting_of_ref": "indicator--fc2bf1f8-e169-4047-87b0-9e8d59146116", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2d06f86-ca4c-435e-8861-ac1203da06a3", "sighting_of_ref": "indicator--6d5c7625-2249-49c0-b816-0aa51a66875d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa503f2c-94d7-4506-bc26-194366cf6307", "sighting_of_ref": "indicator--90a3a892-7bda-4db6-95cf-6fe91f4e0404", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9153af88-a756-46b6-a936-80937c7592f3", "sighting_of_ref": "indicator--a313cc65-cab5-4985-bedc-4492b66993c7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88c570cd-a546-4e53-99f3-ba9e77ecdb25", "sighting_of_ref": "indicator--8d3f3432-cf15-4922-8ada-8a4fb252403c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70f19be5-1c57-4967-8dcb-c3bee44721d2", "sighting_of_ref": "indicator--3a5f5abe-0645-4f79-b3b1-d70842c0646d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f01454f6-5417-4783-98f9-9fc0fd5070a5", "sighting_of_ref": "indicator--eb1b5db4-8c53-4901-a45c-33aad8eb557d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45218e3f-6460-430d-a742-d4d105c9f3df", "sighting_of_ref": "indicator--5eb84ce8-22d2-45bb-abaa-62f8f40f0028", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff459e29-ae02-4bc1-ba07-e4d715feab3c", "sighting_of_ref": "indicator--11814db7-40c6-4e6c-b216-e6ebe6043809", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edc60dbf-f90a-49d9-920a-dcdd1adf2c76", "sighting_of_ref": "indicator--4e0f9d42-3c4f-40b5-9969-fd5bd7bc1bb6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fb73657-fb44-4317-8a1e-dda09efc18ad", "sighting_of_ref": "indicator--fbc83397-a7ef-4d3a-ac57-64eb33b1e592", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cff781a-d14e-4b63-87e4-2217e2bf9f30", "sighting_of_ref": "indicator--00e27ed5-6a9c-49ae-b47d-dfa1625fc203", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02d0db11-48ef-44b8-8f84-5c0828bbf7a1", "sighting_of_ref": "indicator--31e7005d-3784-4455-8106-90671ef6eec4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c78be5f-a650-4aa9-9975-72f2aa8b62d4", "sighting_of_ref": "indicator--ff2911c6-ec4d-4c89-8c50-4bcfbed8e683", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1090a375-98aa-4991-97a2-89fee8870e3e", "sighting_of_ref": "indicator--761c75a3-5bb1-4bca-bf66-b90576c606de", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0d1c53e-3119-4367-ac6f-c753f45e3544", "sighting_of_ref": "indicator--15772ea2-f960-4f9f-85da-8a4a94a8982e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9163a28-8f79-4708-9ab9-0c303a117463", "sighting_of_ref": "indicator--dde98d19-285b-4ddf-9609-18839ceaf718", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ba7570f-dac7-410d-975e-61a8693caebf", "sighting_of_ref": "indicator--85d4c930-bf71-4031-a6ae-cfafc7f2e7bb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b50d90b8-7800-473f-b872-eb4e6a06617e", "sighting_of_ref": "indicator--85d4c930-bf71-4031-a6ae-cfafc7f2e7bb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dcfbf5d-8cbf-497a-8bd1-5ceb781f668d", "sighting_of_ref": "indicator--9a3b8da1-232b-432e-91ca-752beff6c8aa", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47d7e09c-2d45-48e1-9cbc-2f27afa05259", "sighting_of_ref": "indicator--d020b64c-94a6-4cee-a7ba-a225ac6acc64", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b2a2747-884e-45b5-a898-8dff16190d3f", "sighting_of_ref": "indicator--e988c353-322d-4ec1-b030-929ff3dc0c18", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5309e937-1162-449d-9334-849e059f1191", "sighting_of_ref": "indicator--9c29e951-6bb1-41b3-9c09-37ccb380b22b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70c02d92-eb60-4848-a7f9-68e145f2f16b", "sighting_of_ref": "indicator--589a6fa9-fe66-4c4b-b368-9940c47ac1c5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb2b9e9e-e642-4e0f-9abf-3d8649058bfa", "sighting_of_ref": "indicator--5f59b122-73ae-4dfc-bdcc-dd25787b1359", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--295dc6bb-7fc3-48a3-a9bc-7b2bce4bbc14", "sighting_of_ref": "indicator--a720b0da-b72f-4154-9dcf-a51a1e9619b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d06152e-cb9c-4513-a303-1e478645e342", "sighting_of_ref": "indicator--b50b4e81-6e91-40db-9020-a8e94f5d547f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d733291a-43af-4ff1-8b29-ad3bdec34b83", "sighting_of_ref": "indicator--40abe9f7-7653-44e0-b0d0-74257efa4f8d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acfcd18f-000f-4744-b7e0-211e69019aa1", "sighting_of_ref": "indicator--86076189-2d7d-4b47-bdbb-c66c202d9b67", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93c2bab4-2a84-4533-889b-7dd9a41ebb96", "sighting_of_ref": "indicator--87692e2e-d6b1-4246-82c3-a47c58cd2b62", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ed122a3-1232-47d9-92a2-4a94bc4b7a20", "sighting_of_ref": "indicator--ff0cf83a-dd72-4843-b35b-73348ce3e458", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--040cfe46-76eb-4762-adf3-532a8666d03f", "sighting_of_ref": "indicator--59f21e16-df77-444c-9d66-3cb2e9fd9d59", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4ab89f5-8bff-476a-a2fc-341effe94bd1", "sighting_of_ref": "indicator--b6622f47-8d11-444e-9364-1a2cbb6275f1", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1180aee7-7d9d-49c8-81a0-8c08606c80fc", "sighting_of_ref": "indicator--b6622f47-8d11-444e-9364-1a2cbb6275f1", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f1e2097-bb61-44b2-ad72-756f07e1de1c", "sighting_of_ref": "indicator--5e9408d5-2e10-4962-9656-dbe699fedee4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57c7618b-4deb-4c0a-9a38-43b1ab9d5d30", "sighting_of_ref": "indicator--5aced7e9-a669-497f-bdd5-9bcd8b4447ec", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02fa7ccd-e0e9-41ea-a379-c5cce4b7cee1", "sighting_of_ref": "indicator--21ac689d-b76b-4126-bb05-7c0a7c116a51", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7c27228-b032-4650-9eb5-dc253564b108", "sighting_of_ref": "indicator--608952db-ab53-441d-8cb3-2abcf4eedecc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddb13d0a-1bd7-428f-aefb-614dbea54e28", "sighting_of_ref": "indicator--120e4271-8636-4b00-a6da-517c2b02d2b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56807aed-8135-4bb2-b397-2e053fd0cc9a", "sighting_of_ref": "indicator--d6145bf0-330f-45c1-9d57-4bb0b6fc7969", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ae171df-f17b-492f-95b4-e865b853aab9", "sighting_of_ref": "indicator--45b3f50a-31a1-4466-b59f-7e8000e0b95a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11787c71-ee24-4d98-97df-9f39ba8e6092", "sighting_of_ref": "indicator--9d22bd1d-1490-4467-8206-1d543a0e7a8e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1cc8f85-487a-4e67-bf06-d442f91ce76f", "sighting_of_ref": "indicator--8cd27151-c4a9-4d9f-846b-2ae26f3d8520", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e213e83-2eb6-44f1-b598-b1bcd3488083", "sighting_of_ref": "indicator--19d79b40-7c12-4eca-a83e-e2df5157e97d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d631812-5f5b-4faa-b75c-9646394449cb", "sighting_of_ref": "indicator--95834799-0ebd-47fb-aacb-0892c4978fda", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51c4057c-40db-4458-ab32-75eb9eccc9de", "sighting_of_ref": "indicator--abe394d0-d0ff-4109-82c6-048a1cef7475", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8e822a2-58d0-4cb5-a781-4f647ab13437", "sighting_of_ref": "indicator--58266c6e-f073-4f8c-92e6-14bebd9dd38f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--919e67a9-a87c-47ac-a8b9-854cfd765cba", "sighting_of_ref": "indicator--efbe5360-52bd-4726-b194-de278bcaaa31", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--462d5e6e-9b01-443e-904e-978e3384a2b8", "sighting_of_ref": "indicator--be220537-f498-4d3f-ab45-58dd33e62f10", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f403315-05f4-4858-b865-c63c607a8fe3", "sighting_of_ref": "indicator--5a5b052f-d016-4127-829d-989c4e96380a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4002abdf-88b7-4769-a1b0-5f2785f30bed", "sighting_of_ref": "indicator--1dffa12b-b176-4b03-ae0f-59fc1b95b793", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b84a8a56-baa1-463f-9289-7732ab3fb43d", "sighting_of_ref": "indicator--50805b74-059a-4180-bcc0-f5034d17eff1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46a9712a-5832-4748-8708-362c6c46bc57", "sighting_of_ref": "indicator--50805b74-059a-4180-bcc0-f5034d17eff1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c697f630-4d54-44fd-ac8a-8acbef7fbee4", "sighting_of_ref": "indicator--b574c4dc-840d-47a3-8400-064f878385ce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6bbecd7-72d0-4cd0-b6f9-837dbb8f5282", "sighting_of_ref": "indicator--3bd41bab-3ac7-4e41-9aa2-d06aa1ad0d7c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--081911f4-b5c3-413f-baa6-2bc35a25287d", "sighting_of_ref": "indicator--45a97ecf-8330-42d3-8b25-48b801370538", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4476d65f-385a-4cf8-acd1-6c24db070b53", "sighting_of_ref": "indicator--74c83798-c200-4773-8c80-feccf8789ed7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b20cebb-7564-4a4a-a3c0-62bb29b4ba1e", "sighting_of_ref": "indicator--74800272-a2bd-403b-9299-b1b02bbb9024", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5c820d8-c1cc-416c-bebb-21f5c8cce808", "sighting_of_ref": "indicator--9f6bbea5-7b50-4b21-ba65-e02ea4f4ccc0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfa06ce9-479f-473f-8687-311fe533b164", "sighting_of_ref": "indicator--e5698f50-d1f9-4de4-848e-49fee96c6724", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9a27ae1-8abd-43da-8691-3dcba8e52c97", "sighting_of_ref": "indicator--0ecbd6ba-f91f-43fe-900e-8a9ce3e1d25d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4f75a65-60d8-4ac4-995c-8c54722bc17c", "sighting_of_ref": "indicator--5ef461cd-76dc-4384-9480-6daf41567f33", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5bfe9ad-f511-4a6a-9cdd-f6348b7296ef", "sighting_of_ref": "indicator--5ef461cd-76dc-4384-9480-6daf41567f33", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--803c37bc-1262-414b-97d7-47a9b052f52b", "sighting_of_ref": "indicator--206b34ff-7eef-4bf8-862b-13c1e095f2b0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db3393d7-23d0-4fc8-a1ac-1f3430eda265", "sighting_of_ref": "indicator--0f561603-9f98-4e98-9426-2496dd74b4cc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee1d6b3b-99d6-493c-9967-279a18868be7", "sighting_of_ref": "indicator--d7eb41f3-1d5b-4b6f-b54f-0763ba8a124a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c263177-5da4-4e1b-8da7-c84b8eef2655", "sighting_of_ref": "indicator--99fa0b80-16e7-49c1-8933-011c570cbd15", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fb7f8bb-9b1f-46bc-9567-533e38d14032", "sighting_of_ref": "indicator--0d727592-da17-473e-ba2b-0e20db38de98", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ecc2d0b-65fd-4f23-b265-ddaca6a018a4", "sighting_of_ref": "indicator--0d727592-da17-473e-ba2b-0e20db38de98", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76097cb0-f97a-49e9-bef8-b237510b148d", "sighting_of_ref": "indicator--ac39b08e-d485-4c4c-9e4d-ebd93154a83e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f733ccef-9427-4d7f-bc75-043748397536", "sighting_of_ref": "indicator--72ed6253-eb0a-41a1-a242-774d1dcfa27d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c6f7b9b-42ae-4d80-86fc-4492043df254", "sighting_of_ref": "indicator--8bec2b07-76a7-4a0a-b878-b5d95b466934", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e0f002b-cead-4fb7-833d-7122f7eeb272", "sighting_of_ref": "indicator--8bec2b07-76a7-4a0a-b878-b5d95b466934", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbd6ac25-756c-4fba-be79-e7b19b0b21e9", "sighting_of_ref": "indicator--39ab4f7b-5f23-4e3c-9ccc-46472a8266a3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9332263-dda2-4104-87aa-acfa781f9f24", "sighting_of_ref": "indicator--74cf421f-6180-4a6d-bf01-7a722e7e34dd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6dfb4f6-8b38-48c5-8d4c-6afd1e766ecc", "sighting_of_ref": "indicator--2cefa417-774b-47e3-957e-3022b21408a9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e312ee84-9744-4d04-933f-0bf30308a336", "sighting_of_ref": "indicator--569e3db3-a851-4631-8200-d9c11ac43e03", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58900574-8c58-4e42-98f0-406a9aa344a4", "sighting_of_ref": "indicator--0dcdc60d-d74e-41b1-9a97-b458c673f26f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe0ffcf1-7e63-4a2f-94be-deaca8a310d2", "sighting_of_ref": "indicator--635e7ab6-3e05-4411-aefc-efabbf012217", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd215923-bdc9-4fcb-9116-3ffdde651f18", "sighting_of_ref": "indicator--635e7ab6-3e05-4411-aefc-efabbf012217", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed626d3e-2100-426c-81ab-eda0454be880", "sighting_of_ref": "indicator--0dd3b0a3-054d-40bb-9d77-bc9ccbd8fbdc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcfcabf0-c256-4bb6-8036-f43b9530bfe8", "sighting_of_ref": "indicator--7ecc86a2-f062-44b2-9b3f-b2988b44d2f1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4145e6a-d34a-4ee9-84a1-8f0b8937fe75", "sighting_of_ref": "indicator--d727985c-c209-4afe-84ad-1fa428e9f138", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4244d66b-829c-4786-9a2a-daaca8f36fc5", "sighting_of_ref": "indicator--dc4d2827-6d8f-4627-9850-eaafb4ce3522", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c5fd811-bdc3-441c-b939-e102f6c1e4ee", "sighting_of_ref": "indicator--dc4d2827-6d8f-4627-9850-eaafb4ce3522", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ae6af43-ff2e-4c0d-bd7e-8bc10c471246", "sighting_of_ref": "indicator--cc51669b-070b-4ed6-a9f7-1749734dca9f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f445cce1-ceb8-4e3b-92cc-679ab3159c32", "sighting_of_ref": "indicator--3ea26c5c-12d2-4f91-9a0c-0d87ff3bea15", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24b8d447-0b8b-48a2-bb3f-8e818a4779eb", "sighting_of_ref": "indicator--4dd40469-dc2c-44ba-93a0-ea29526ba124", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5317c64b-6c6c-4e37-b674-ed4df0d781b4", "sighting_of_ref": "indicator--059e2b53-3e37-4aea-bf29-71434027c336", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6172c7a7-d37a-4b3a-8299-7f465e23c9b0", "sighting_of_ref": "indicator--e91c076a-0ba3-42ae-96f6-84e4b4949160", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--373ed3cb-51c6-49bf-9edd-efe058fd7989", "sighting_of_ref": "indicator--41822d6c-7fa3-4234-ac6c-f5acb1121fb9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--676baffc-d826-457c-b609-a609529783f9", "sighting_of_ref": "indicator--34841f07-2b18-457e-a131-6e9060187fa5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90b96602-19b3-41f5-9052-fb300b888d70", "sighting_of_ref": "indicator--34841f07-2b18-457e-a131-6e9060187fa5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6135e147-b175-40c0-bfad-e3ad7f479ea7", "sighting_of_ref": "indicator--64bbc253-2526-4806-a323-62599f3aa9e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4929e45-b66b-421a-b0f3-f34ca228a6c1", "sighting_of_ref": "indicator--64bbc253-2526-4806-a323-62599f3aa9e1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--448afb3c-12f2-472e-994e-e8617e391f31", "sighting_of_ref": "indicator--7902efb1-1241-4043-a86c-74dc8c366cd7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48a62308-082b-401e-b364-32326f8c8ffc", "sighting_of_ref": "indicator--365e7f15-a388-4b58-bbd1-93136f7f57ce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--963a4ec0-e995-4eec-a645-b9ccb1111b07", "sighting_of_ref": "indicator--365e7f15-a388-4b58-bbd1-93136f7f57ce", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e5c40c4-4a7e-447d-8ab7-712b91ace902", "sighting_of_ref": "indicator--62c15f54-9e4f-49ca-8132-b8f9fa0b93c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5146f9e9-5386-432e-ba0f-6edc1e2404f7", "sighting_of_ref": "indicator--62c15f54-9e4f-49ca-8132-b8f9fa0b93c4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--730e9a6d-73e6-4eea-8d9f-6c789103069b", "sighting_of_ref": "indicator--265a0d73-7f18-4e75-81cd-d859c5b63008", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--255c2979-2e42-42d9-98e6-1ce96e994bfa", "sighting_of_ref": "indicator--aca0dc27-ec41-451d-8d6f-f921e0336a49", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1e629cf-14c8-4f78-a01e-6ff0ccb4884f", "sighting_of_ref": "indicator--e5d1da51-3e04-4073-bb52-8fdf6ced85ac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e2da14b-066e-4bd3-99ff-7e3bf223b4cf", "sighting_of_ref": "indicator--e7ee6b78-844c-4ef4-98fb-cc2cec6e9381", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbb4c2d1-2f4d-4950-b821-b4006bfd49ed", "sighting_of_ref": "indicator--33a4f88b-cc84-4661-98d1-9277b6489d2a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9cf5789-47a6-4cef-acc7-7230ac07a3c5", "sighting_of_ref": "indicator--7d238759-5fee-47a8-bf84-19189f143663", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2f7ff6e-5913-4107-b337-cf960126f962", "sighting_of_ref": "indicator--ccc57def-2fae-4be6-8c9c-844e2a34d721", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a53526f-37fb-4920-8b4a-1d3968b2d8d9", "sighting_of_ref": "indicator--c6d80018-8ffc-4bda-9de7-c94f8d606627", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--619c190e-1ed9-4bbb-adb9-c30f84adb2b6", "sighting_of_ref": "indicator--c6d80018-8ffc-4bda-9de7-c94f8d606627", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a955a40-784c-4546-8ae0-819f3b2fea2e", "sighting_of_ref": "indicator--4cb12d34-3c53-4e67-9be4-db93242617f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d22fa786-92a6-4ecc-b45e-5701e52bb73d", "sighting_of_ref": "indicator--b1ea394f-93fc-4dd3-9bc6-c156e258d290", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43693251-1a31-4a30-b043-7d38a068d088", "sighting_of_ref": "indicator--9d2fd2ed-6d4d-4189-861a-d2ab4d529045", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b771a99f-e1da-4d0f-9bb8-a7e8ffd2cc0b", "sighting_of_ref": "indicator--7c67716a-fb2a-466d-9326-a40ea306fefc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2016d2e7-d9c6-475d-854f-955c57430821", "sighting_of_ref": "indicator--d9d619cb-8ac4-4974-8a12-69d9cea9ebf1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9cfba90-6c27-42d1-b333-69b50a5e992b", "sighting_of_ref": "indicator--d9d619cb-8ac4-4974-8a12-69d9cea9ebf1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7dc3288-ac48-444c-832f-dff855ab3686", "sighting_of_ref": "indicator--91dcb179-911e-4e76-a6b5-32025a5324ee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2f40c7e-ecea-400a-85de-a72ee760e016", "sighting_of_ref": "indicator--d8c56d5f-4640-4a1b-9e16-948fcf8fc3d5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3191a9a6-1e73-4d95-8f16-021dbeb014be", "sighting_of_ref": "indicator--d8c56d5f-4640-4a1b-9e16-948fcf8fc3d5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2819d491-9337-4a05-a332-76b3132b237b", "sighting_of_ref": "indicator--5d014602-4016-44fe-a388-88c5142783e9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa8a9163-c82a-4b5c-8517-cd02adfa0823", "sighting_of_ref": "indicator--2b83a399-2062-4f2c-896f-02e067a58782", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f550581d-091b-4426-b869-0d62c3ae9985", "sighting_of_ref": "indicator--2b83a399-2062-4f2c-896f-02e067a58782", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a41465d-da2b-4e8a-a1c5-baf51df094a1", "sighting_of_ref": "indicator--7eec9e06-3acf-4a89-aae6-b1888f3e4684", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf9b5470-3f8e-4a18-9e99-8d722bc33baa", "sighting_of_ref": "indicator--ddfdb9d8-009b-4877-b75d-0fc9261a76d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0f7ab5e-610e-422f-be3f-55e81ce05c6c", "sighting_of_ref": "indicator--e2a6d81f-1b98-4194-b831-7d971f32145c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1890cf1-2217-4e3d-88d2-9d636d376825", "sighting_of_ref": "indicator--52a47a29-5f46-4e6c-a831-f761b15ccc27", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51a9612c-c0c9-43bc-af74-3ae9c86e87eb", "sighting_of_ref": "indicator--52a47a29-5f46-4e6c-a831-f761b15ccc27", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2099aea-f1b6-444d-a863-b44469288506", "sighting_of_ref": "indicator--a7852b44-cf7e-490f-bf1c-8623cbc8e7c2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e42ad6eb-c456-498f-bd47-bc62d8bb52ad", "sighting_of_ref": "indicator--3fd819ee-e4bb-4317-96f3-d27859695a6f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f32ff60-8e97-4548-8522-eb2ca3e505ad", "sighting_of_ref": "indicator--c713c1d3-1a5f-48c1-9b9c-ddf9057e0083", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--472998a1-5da6-438c-ad3b-84e77158d59e", "sighting_of_ref": "indicator--23973299-fe7e-486f-9c20-7526a56a2a81", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faec6a9b-43a8-4a2f-a51f-77d3e55a2dc5", "sighting_of_ref": "indicator--a2aadeb8-f6f7-4e53-8694-97013b2ad822", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b3fcbd-5223-4401-a56f-7f8fea72b758", "sighting_of_ref": "indicator--652f5952-f2fd-45d4-8423-ad082ae7a68f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8757fec-7c9b-4161-9c62-bd050ea9609d", "sighting_of_ref": "indicator--aae66467-6091-46cd-9bae-8e5ef17e68bc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf2845c9-d478-48d3-aae6-b225b6f233d2", "sighting_of_ref": "indicator--bb813ecd-6370-4364-a2b3-c724c932a409", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34c6a2da-57c1-4ba2-896a-75652318b065", "sighting_of_ref": "indicator--7bb1028f-631a-411d-95ef-73cb64a2e0b0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a68d1bc5-1683-4b56-bce7-dca2db38cf49", "sighting_of_ref": "indicator--ec79592e-8750-4777-a662-b87aa05fd9b5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84b80bef-1ced-441b-8ffa-bc37fde8d7bb", "sighting_of_ref": "indicator--ec79592e-8750-4777-a662-b87aa05fd9b5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47e1945f-6b24-42cc-a971-aad49b94a6fb", "sighting_of_ref": "indicator--3f64c92e-e6b0-4eca-b5b1-c6a437f6c13a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9693c1d3-6e9e-4fd4-9009-dd2f8eb64277", "sighting_of_ref": "indicator--3f64c92e-e6b0-4eca-b5b1-c6a437f6c13a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84586e65-6fb2-4887-805e-7e27246c64d3", "sighting_of_ref": "indicator--f83a00b8-8e48-4d64-abf7-e28a32df6d30", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd41c947-9735-45a3-a5d4-d04045b4833c", "sighting_of_ref": "indicator--f4cf1785-610b-46b3-bcb1-d37c4387e5ae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10b3417f-5dd1-4eec-8236-f21ec2365a97", "sighting_of_ref": "indicator--6a5315d4-6604-4ca7-ac73-4b2e88517c0d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84ff3a92-9fa8-44f0-ad6e-b4b15558a113", "sighting_of_ref": "indicator--72af292c-00c7-4e88-9e96-3816fb79fcf4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc898a32-e276-49cf-90c8-5388ef2abacb", "sighting_of_ref": "indicator--625b6560-2512-4cde-ba83-fda6f20bb2f7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--532dcdfa-aa11-4e44-9906-ef7157edf53a", "sighting_of_ref": "indicator--2c31e170-fa2e-4299-88e4-874bf5f1dd17", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89bc40a7-726a-4b24-a2c3-61b97c747e37", "sighting_of_ref": "indicator--66bcfd73-1c7f-45e8-bafa-4ff7aeb45760", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--955f47ca-4b9d-4493-8a2e-644c5baf59c4", "sighting_of_ref": "indicator--31ae3a02-0728-4ed8-a91c-202679df6f53", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c063b948-98d5-4ed2-87c2-3ffab76ea641", "sighting_of_ref": "indicator--eef0fb7a-63fa-43ce-84a0-582cb826f2a2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d06ddc46-32e3-483b-99e3-717151195ef7", "sighting_of_ref": "indicator--f23c113c-6350-4ea5-bfc7-7e788e133a0b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29395091-737d-4f88-be60-b52ce67e32f6", "sighting_of_ref": "indicator--cd3024a4-91a3-407b-b453-96818fe3bf04", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2db2f78c-44dd-4de0-a4f2-7632326f9bef", "sighting_of_ref": "indicator--47a40d64-29b4-4a6b-a645-112f1f9c75a4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fa2a17e-e552-4f3b-b6dc-8a55347dbe53", "sighting_of_ref": "indicator--a3715f38-71b3-49a2-92f2-15afa10c4111", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69cc5a6e-bdf8-4892-bad3-fee98453c6da", "sighting_of_ref": "indicator--a3440ed8-7964-40f4-b92a-49192cbc9cf8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac35781e-dcb2-4e2f-b000-995a5d73cc92", "sighting_of_ref": "indicator--9840dcdd-4bf8-46e9-a480-b6ebc62c2fa4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30d73bb8-c48a-4c50-b0e5-7bd173be318c", "sighting_of_ref": "indicator--72ef5dfe-dc19-45e2-a442-b9009f618bdd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b1d824d-012a-4b54-9c84-4f991a0c07e2", "sighting_of_ref": "indicator--07b1deb9-194f-447e-99ec-119fe44fe464", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cc2de77-ac04-42d7-a37a-85d37e19cd54", "sighting_of_ref": "indicator--a8ff817f-3c1e-4ba2-ae2b-fcfba57f734e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47fda2de-e133-49df-811b-a05a8212969a", "sighting_of_ref": "indicator--89303efb-34af-48b2-b8b7-d545abcf1922", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f79dec7-53e7-4896-8381-dc124f0fc956", "sighting_of_ref": "indicator--6d0d12e9-3bbb-41f8-bf0b-76c6e77717c0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ada385ab-46a1-4546-b5ff-742e63d98949", "sighting_of_ref": "indicator--6d0d12e9-3bbb-41f8-bf0b-76c6e77717c0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60ba85d6-3b4d-4512-96de-510bdb4c8cb9", "sighting_of_ref": "indicator--321128b7-965b-4854-b9ac-863f6e9cb9ad", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7b43b76-96b2-4330-9c1c-bb3c4fdb8ac1", "sighting_of_ref": "indicator--67a08e24-deba-400c-bb2b-fec5c648854f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--678c9324-9efa-4098-a3c9-ab4219d8df9d", "sighting_of_ref": "indicator--67a08e24-deba-400c-bb2b-fec5c648854f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f15b6b2d-c9b1-4bff-9252-37073979cc0b", "sighting_of_ref": "indicator--ce2bc827-c6bd-463c-8c8e-58474af3fd97", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b9c2298-167d-4431-91b8-3b425a7e72a7", "sighting_of_ref": "indicator--fe1f5c82-599c-45f0-8109-9a50b9d8338d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b136d86d-d6f0-4f1d-b909-5d2cee740b99", "sighting_of_ref": "indicator--495d92f7-d553-4659-9a68-c175d74e06d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5678ec3b-e2d0-4022-ae6a-bb24291068e7", "sighting_of_ref": "indicator--060c662c-4870-450b-b869-5426a0861875", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ace0cfc-3d11-4740-b2cf-a0d91f795087", "sighting_of_ref": "indicator--62fc953d-9bd5-4758-95f7-a270724dee25", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2d8a830-5ea2-4648-9c31-fcc489583d87", "sighting_of_ref": "indicator--e5978756-862e-47b4-86cc-a3b2a19d5809", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5431dd7-8907-47a4-b9db-91228517fcb3", "sighting_of_ref": "indicator--342d4bc7-28c1-412c-b3e0-21fe5e545c34", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f68ef1c-faa1-46ae-9d33-c376943092b4", "sighting_of_ref": "indicator--2c86adce-a68a-493f-acce-20be74ded979", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b6fccdb-266b-4580-94c7-3513d03f7b14", "sighting_of_ref": "indicator--9f41ab81-2b34-4d08-9af9-143419e986e7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6cb7ac7-cd9b-49d9-8c3a-18e7a79994aa", "sighting_of_ref": "indicator--2662270a-38d5-4579-b1b0-2c6525158ccf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e266d0d-f636-46ce-901c-ecce1f36ec12", "sighting_of_ref": "indicator--796f21b4-5f35-4d97-8a89-14bdec136815", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d801ded9-b5ca-4cf4-ab6b-1dbd5e0e302e", "sighting_of_ref": "indicator--a181ef83-8622-4123-9935-6080d6af0c2e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20158345-6d91-4471-976c-650f326023f5", "sighting_of_ref": "indicator--ccc1ad90-3c2f-41c1-a97d-f3a65c6f2912", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca2a66b0-68b5-4f99-a28f-8b59b8a05df6", "sighting_of_ref": "indicator--2e28b85f-4bb7-44e3-8847-405a9c9b278b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3cad915-f623-4471-ad82-838d080367bc", "sighting_of_ref": "indicator--018aff11-bbe1-4a11-a61e-7334be2cdb04", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b2bceeb-0e92-48c9-8af8-39adbff70b47", "sighting_of_ref": "indicator--7fe0ec4e-7a71-4e6a-9ed3-654584a0f5f9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c2af8f9-ef5f-40a3-a6e8-547536dd306a", "sighting_of_ref": "indicator--91ce8956-7661-4042-b2a7-8bf122523225", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ea5bb86-f496-49fd-91bc-5923c8a6b6fa", "sighting_of_ref": "indicator--001460fd-4175-4453-8671-39cbbfc98d89", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1062484-ac9b-4ef4-ba8b-985a9f4342d7", "sighting_of_ref": "indicator--2732c6bf-0de5-4a40-a539-9ded9a205929", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca63193b-c58e-433c-8d13-163bf3de0d3d", "sighting_of_ref": "indicator--84aa8d99-8b42-417f-b645-3e4ed7098dc8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b77af532-93ea-4bb5-b6ee-9cf854c152e0", "sighting_of_ref": "indicator--1321cd5a-3c1c-40f7-89fa-665802a25279", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--219aef96-fb51-44c9-9596-905ea3cfa3e7", "sighting_of_ref": "indicator--31f8ca9a-440c-4f46-a166-c7cdd07db722", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--698e561f-d108-4758-b649-f68022e664a4", "sighting_of_ref": "indicator--90b46909-377c-4758-86f5-3c1449973457", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--291299d9-ccf5-4e1d-be3c-aa77e20b9cd7", "sighting_of_ref": "indicator--90b46909-377c-4758-86f5-3c1449973457", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f0aaeed-2ade-4789-886c-de561cbbf777", "sighting_of_ref": "indicator--dbf58348-4cb5-4b7b-a156-418e14beac9c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c1b1a93-3337-457a-a0db-cc53ba3af984", "sighting_of_ref": "indicator--dbf58348-4cb5-4b7b-a156-418e14beac9c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6fa8ce3-801c-4360-a16a-555221dd85f4", "sighting_of_ref": "indicator--d2799a80-107e-48b6-b61b-8cf180d04a86", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bc71bf2-3e1c-4a86-97f2-3259ab7cf4f4", "sighting_of_ref": "indicator--094a41b0-62a0-4b1b-a8bc-bc81b4c262d6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc458b4f-f71c-499c-8d1e-40c5886c71a4", "sighting_of_ref": "indicator--072b1a61-7854-4aef-a906-ec86e0749240", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1f28836-ef3c-4220-9662-886eede9a833", "sighting_of_ref": "indicator--0035e5a1-4a13-4130-a49a-b682ff578402", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d42be602-d06d-4f64-b493-9b3f60fb5c98", "sighting_of_ref": "indicator--6be5f500-2928-451a-a03a-0460d713ef76", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--887876aa-cfd3-4ebe-8a0b-c71c13eb8958", "sighting_of_ref": "indicator--6be5f500-2928-451a-a03a-0460d713ef76", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c2ea6df-5084-4a15-b7f1-1d651b34e685", "sighting_of_ref": "indicator--9dd9a6ec-564d-493c-a729-8c4ba302bdf3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--242a7b50-81d0-44b6-bed1-3d2260408671", "sighting_of_ref": "indicator--1e5627b2-a7d2-4230-a8af-060a03d35fda", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3742aac4-16ad-4d73-a751-b2f40f488ad1", "sighting_of_ref": "indicator--1e5627b2-a7d2-4230-a8af-060a03d35fda", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4b794e0-9a20-4605-a3bc-abf8d8f09eab", "sighting_of_ref": "indicator--b1559468-2656-4169-b098-d5b04e647580", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84bede84-47ec-4f9e-9da9-4e8941987b63", "sighting_of_ref": "indicator--e6ba5c59-0c80-47d0-9652-ab67dec560b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ec44f47-4555-4ab6-9302-090996d5f3cd", "sighting_of_ref": "indicator--b2ade95e-98ae-4e0f-a48f-1a927a11f35c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f550f134-cdb8-4bdc-873b-631152d89507", "sighting_of_ref": "indicator--16fe7757-9aa5-4c42-8bac-401fa6f9b487", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a9ec63c-6b5a-4026-9658-00c50160a774", "sighting_of_ref": "indicator--5af78274-0ca5-4ca6-a034-e405e2e73297", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08116002-0e0f-4c6b-af4b-8988043c3b86", "sighting_of_ref": "indicator--0729a21c-1b53-44f0-8662-216da662a039", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22cbf4b0-f058-42f5-89ee-5daa2a1e9fe5", "sighting_of_ref": "indicator--5cbeed74-c88b-4a52-a95d-2b75db8396d6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5a620e5-93c4-470c-96a6-2294550f02d2", "sighting_of_ref": "indicator--bd8d2073-b81a-4e07-bd35-d35a6aa0c65d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07ac3aef-a60c-482b-82b9-319a2ce0e6bd", "sighting_of_ref": "indicator--bd8d2073-b81a-4e07-bd35-d35a6aa0c65d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02ccd073-c823-4425-9ad9-b89ae6f64c03", "sighting_of_ref": "indicator--df28eb0b-9ba1-4280-b3a7-ddc14416c5ce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe45db50-c053-4679-adfd-d89961ebd933", "sighting_of_ref": "indicator--14999506-fa58-4941-b686-ab43d5842e45", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c295fdb9-f382-4c62-8503-fe9165172f9f", "sighting_of_ref": "indicator--996ca740-21b2-43a6-82ad-0970abdcc2aa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62d99521-ee95-4d80-8800-bb3692a9c689", "sighting_of_ref": "indicator--e04236f6-2115-448a-bd22-a80c539e5d15", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e21a8fe-42f6-4916-82a0-8e7bb1f35a3e", "sighting_of_ref": "indicator--64b85c02-3322-4234-8661-80d2947e2a4a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9b8bed5-f917-46de-920d-a9f4568c36e3", "sighting_of_ref": "indicator--8f24c689-cabc-478a-8032-24f52350ae8d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e25ff0a-e1cf-400b-9694-ae13ddd3bd50", "sighting_of_ref": "indicator--dd963344-72d7-42e0-8417-746ff25c6ba0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56580c20-f685-4009-8f96-71f4d63cb6d4", "sighting_of_ref": "indicator--6527ef57-aa2c-4e43-b0d5-448b393a8528", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c08d3386-7775-4b48-a3ee-429dbeef8b5e", "sighting_of_ref": "indicator--2db678b7-93e8-4507-bdd1-81d125a05ad7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--306b3c91-5fc2-4350-a85b-52948ec126d4", "sighting_of_ref": "indicator--8b223a40-8c9f-4228-978f-872ddb0a5fdd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e225a6d5-a31e-45e9-b86f-b5f921d3b7cd", "sighting_of_ref": "indicator--03eb6c7d-8bff-4611-b1dc-9badc6d56ed3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ad29252-87b3-4c7c-9479-bc526efd192c", "sighting_of_ref": "indicator--ed3637ea-22b7-4a3b-9297-94345b741e0f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fee8492e-5a0f-410f-9f87-888d0c30e331", "sighting_of_ref": "indicator--be931a99-583f-461a-b926-152bcd2132d9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a04c79e-10ff-4718-9e7a-bc5bed4506e0", "sighting_of_ref": "indicator--91396955-f454-4c6c-914b-3b088cb8712a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56e8f218-5398-461a-b5ea-e931939f605b", "sighting_of_ref": "indicator--aecc4373-5891-4262-ad26-2b7683fb90cb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c57a8800-c4e2-4a84-b61d-af921413f732", "sighting_of_ref": "indicator--aecc4373-5891-4262-ad26-2b7683fb90cb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--240114fc-f4a1-4441-b750-fd9e5f873462", "sighting_of_ref": "indicator--00e8ea60-fb3a-4aa9-9648-4029ee63c4a0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d1f9a3f-99e8-48bf-8f43-f0bcf7631c6f", "sighting_of_ref": "indicator--47ebd7cd-f222-4a17-9741-57081404a77b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5f0ee0f-e378-41ed-a9aa-066cbfcae13d", "sighting_of_ref": "indicator--bc529ee6-f568-4219-8c8d-e188da48b2b5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65e58e64-f585-4c50-a282-b3afeca7d9ad", "sighting_of_ref": "indicator--bc529ee6-f568-4219-8c8d-e188da48b2b5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3157f800-128d-4c89-b707-4ea57f2430e0", "sighting_of_ref": "indicator--ae17535b-9ade-4396-825b-47559057c9ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--295845cc-28b5-4613-8cc5-c773109612dd", "sighting_of_ref": "indicator--c8ef31e9-8051-4fb3-a6c5-45c72c57c657", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f8bef81-f10a-41c7-8ef1-4eb3ae07d352", "sighting_of_ref": "indicator--900b9d69-aaf9-4e73-b19d-863ab8d8aff6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5b81b23-24e3-4966-bad0-b4d12a1c8982", "sighting_of_ref": "indicator--900b9d69-aaf9-4e73-b19d-863ab8d8aff6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ea1b866-3e80-4863-a40f-136061d3b19d", "sighting_of_ref": "indicator--a196cc03-b556-46cc-8919-b67ccf6ab66f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--720adb4b-f7f7-431c-93d5-2fb39ab1567b", "sighting_of_ref": "indicator--43b09e05-80de-4c79-941d-7a56ab00203b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78bc9002-8eaa-492d-81b5-cbaebacaa44c", "sighting_of_ref": "indicator--9d1dda72-c1f7-4cd3-a227-07faeb7ab42c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abcaab1e-7841-4914-be64-ac8d6ad691fe", "sighting_of_ref": "indicator--9d1dda72-c1f7-4cd3-a227-07faeb7ab42c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a328136-0472-4d24-b3d3-fc3ff8ff9787", "sighting_of_ref": "indicator--d24a06fa-5a16-463a-ae49-31177e602fe2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7ccb29f-7397-4a64-9f07-6e446ddf1234", "sighting_of_ref": "indicator--6d3f5da2-26bb-4b10-b16d-02f85e4d19f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c220946a-0eb9-4359-a13b-71e498f06032", "sighting_of_ref": "indicator--6d3f5da2-26bb-4b10-b16d-02f85e4d19f7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cca5eaf4-de58-46d4-9947-0f5ba74a108f", "sighting_of_ref": "indicator--8732e0b0-0d41-47b4-8ee9-38076f62ea42", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7739acff-7e1e-4aff-a549-f8ab339c7557", "sighting_of_ref": "indicator--eadce634-3107-4e33-9057-30304c4a5de9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--657c6e5a-e0b9-43d7-954b-592831d21b1d", "sighting_of_ref": "indicator--19acc078-7da9-4ae1-8910-7d223167e2b9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d590b95-1154-4658-99c2-1a2a85982d75", "sighting_of_ref": "indicator--c6c25c12-bcf6-4f40-b643-699e539bd91b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9449d87-162b-4089-8700-d0f512f0c0b5", "sighting_of_ref": "indicator--e0e765ed-ee0d-418c-b69b-61097a972900", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e16a99d1-5e27-4fbd-a589-85272bb4aad4", "sighting_of_ref": "indicator--bd9ec6ee-89cf-4ce6-9d30-1fa3a41a84d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a72cea5d-6cd7-4f8b-84be-d7c5fe9c1d6f", "sighting_of_ref": "indicator--669205ad-0276-4598-9a54-ac62440dd939", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f1074f2-d39c-40ac-b5f9-26abedd48687", "sighting_of_ref": "indicator--d5b18675-9e7f-4e97-9241-ec6804b11ba1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26753120-d573-42ee-8476-18f30ef90bc3", "sighting_of_ref": "indicator--779aa51b-81f6-404c-b513-0b0b728f4339", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02ccefb8-9d1c-4e0a-9c5e-2f11f404a8d9", "sighting_of_ref": "indicator--22fe0302-babd-4eb0-a296-526744014f9c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aed2d48-9522-446b-a7f0-42c3d9449d04", "sighting_of_ref": "indicator--e85603dd-8e9f-4ece-a072-045fbf20ee48", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8388eded-95fe-4741-9826-0c6c706bc367", "sighting_of_ref": "indicator--ea3978b2-a2bb-41d7-92a3-29e6336a7f7c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30d08469-3d95-4ea8-919c-46f5105dea65", "sighting_of_ref": "indicator--7afa57f5-c142-4d03-a57f-d60db57b7653", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2506aba6-3ef7-4f56-a4c4-b19cd9cd91bc", "sighting_of_ref": "indicator--c9b17b0e-d237-4154-954e-adee93ee4506", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87ff3a20-663b-49ff-8c69-bffe8719f515", "sighting_of_ref": "indicator--489c82df-48ad-4fd9-bbd8-aa3cc028d9cb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3d65dd9-6988-4ad4-ab85-540685643f1c", "sighting_of_ref": "indicator--bab1ed6a-bf17-4910-8882-cd86dbe9acc0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47d7f4b9-4632-47c0-849c-541c46d7d680", "sighting_of_ref": "indicator--cc1c6d63-fd0d-405c-b1c0-cd4117555623", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d52d9fd4-010d-4ac3-b2e3-a6434c8dfeec", "sighting_of_ref": "indicator--848e2c1c-9ded-4f9f-9de3-98a962a4d0c1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d2fdc69-5346-4d30-99d0-cb8c08ea9680", "sighting_of_ref": "indicator--acda024e-d4df-4f77-8117-334db9367cf7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45332d08-49d5-479c-9a63-e39ccb245f2b", "sighting_of_ref": "indicator--dd99c1eb-824d-463c-a88f-64612f8dca9d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91388630-c050-4e1a-b066-a30530804f70", "sighting_of_ref": "indicator--ccd5f264-0492-4c33-8ef1-aee294b0df9d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ab36199-1ea4-4efe-bbca-e621d4d41739", "sighting_of_ref": "indicator--88ecd74d-7288-414e-a2c2-e3038d098458", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee013b35-d7ab-4cb7-9c8c-88b0843f5dbd", "sighting_of_ref": "indicator--27b5c144-257c-47f7-81b5-271397abaf82", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b34bccd-facf-4bb8-8876-746ec2e49ffb", "sighting_of_ref": "indicator--b1fb7a46-6a4e-4697-9ade-dc310f5350c8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab6402f9-67d0-44fc-b348-fd0fc2558a8f", "sighting_of_ref": "indicator--8558e9b2-cfc2-4250-a64c-6957f0b49461", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d683ea30-55f2-4541-91ed-6d96437630f3", "sighting_of_ref": "indicator--de1a341f-ff64-4c3a-8695-f27ae4584bb6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09fb03c4-e760-4a04-8b37-d8051603e166", "sighting_of_ref": "indicator--d0578425-4ac5-4842-ba7f-a8f1193db36c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25bd21c7-78a0-46e5-b7ce-e0174e2ddcc9", "sighting_of_ref": "indicator--e650abf7-dc4d-4190-a3d4-61d6f10d9a7a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92d007f9-e93e-4b41-881b-592a25460df3", "sighting_of_ref": "indicator--e650abf7-dc4d-4190-a3d4-61d6f10d9a7a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d09f9334-4f85-428e-8585-559ca1355138", "sighting_of_ref": "indicator--ff939cc2-f70c-4406-8eb2-5991ce19f197", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--751fe20e-2d51-4a1e-b600-18f9a68f7a3b", "sighting_of_ref": "indicator--92589479-8872-43b8-ae1b-0cac3bbd1535", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--068ff29d-7203-4972-9d8b-cc78d8904fe0", "sighting_of_ref": "indicator--2b5ee8fc-b66e-40e5-a149-e4871a3d4257", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d92a86eb-de15-4e61-945a-cc51fecf5b6c", "sighting_of_ref": "indicator--d5f2576f-2fbc-4203-bbb7-d1cd8dbe962d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5cc8923-4640-4ba4-a40d-64d5f3f8b177", "sighting_of_ref": "indicator--b8988c45-53b0-479a-bf07-585920d4ac59", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4bf103a-d300-4a07-81af-e3e82f1b65a9", "sighting_of_ref": "indicator--35302ea7-b84b-4b1f-9153-f73805708ace", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--112232c2-002d-4d69-9adc-b5c7345220d9", "sighting_of_ref": "indicator--912ab37e-fe09-49cc-a3a7-85b286705545", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--956dd621-7172-46ef-84c7-6cf18d35147d", "sighting_of_ref": "indicator--dbda96ff-a3cb-4889-8e55-c6903a607466", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5315ddbf-5106-4743-83e9-8931790750c0", "sighting_of_ref": "indicator--63086c55-ba8f-406b-86a6-4c6268d38d45", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3463f642-723f-49cb-a1bf-8d1d1238dfaa", "sighting_of_ref": "indicator--a2efc24f-b67c-48f1-97e6-9cf4d3806ce6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d65d1de-4936-4ff1-9bab-2747e2f7441b", "sighting_of_ref": "indicator--a2efc24f-b67c-48f1-97e6-9cf4d3806ce6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0c5f42e-e795-41b6-bf8b-f8758f2255ed", "sighting_of_ref": "indicator--81fdfbd2-5d29-4470-b150-2cfa69cd2a84", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d24d62c6-75b2-4d5f-a831-68a111137e39", "sighting_of_ref": "indicator--e9194381-e79d-4be0-9964-96334570d9f6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52de5025-1a00-4a49-b85a-595dcf2b2fa3", "sighting_of_ref": "indicator--12258ba8-1b24-4505-bab3-8da558dc5e5b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee40e136-781d-4feb-923d-f30c51222f78", "sighting_of_ref": "indicator--c157875b-23db-41cf-a8d9-ed612878cd56", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15fa3c10-0352-4076-a903-a1bc7471cc83", "sighting_of_ref": "indicator--5162a52f-3f40-4ce2-8b9a-ae4ac756f8ce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5ac57ea-4003-4ca8-96d6-9f76e2e50c79", "sighting_of_ref": "indicator--c0d938cf-c23d-448d-aac2-0f9bf4e3f57c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfdf0770-7387-4b78-9ff9-0a29c8684ba9", "sighting_of_ref": "indicator--c0d938cf-c23d-448d-aac2-0f9bf4e3f57c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af293167-3bb4-476d-9e58-cdb23db0b759", "sighting_of_ref": "indicator--84ec0593-cb3c-4089-874f-a2b08dc6b7ea", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d15182d-97de-4cd8-93da-e6d3bcc2c701", "sighting_of_ref": "indicator--ff7a31c4-43d6-4cdc-a223-5e8721cbc349", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f742dcc-1f60-4599-bec0-c57b2ec44067", "sighting_of_ref": "indicator--1b49068f-d830-49bd-8a04-3e6f9ed2fbf0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6eabbfde-06cc-4bed-8274-8a71576def62", "sighting_of_ref": "indicator--43a0505a-8de7-4d3e-926c-565d08b752f6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9505e62-8a43-4989-9d2b-d072a4df5902", "sighting_of_ref": "indicator--31e14b47-e075-43f0-8403-6feeb372686a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dad7d9f-d938-44b3-8b8e-39b55d0950ac", "sighting_of_ref": "indicator--2548af7a-e13e-4d7a-a78e-4f02f67fdf91", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e70995cc-64c6-45f1-bdce-bae55e004dc8", "sighting_of_ref": "indicator--9cfd1ce9-102f-438a-b363-a18b93b6cfdd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f05217e-b16f-44f1-a66f-6ea67fafe5aa", "sighting_of_ref": "indicator--686c98fb-72f0-4c97-93f7-31240e30aa4e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a044eb49-40b0-4bb9-9390-304ced456238", "sighting_of_ref": "indicator--f5d50776-c214-48e9-9f65-4edec3fb404c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b22c5e5-b112-4728-936c-8da19b4dacce", "sighting_of_ref": "indicator--b53421ce-24ba-4b02-87c2-558a5558feae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f98cd01-ca21-4450-8983-ee98dd899e93", "sighting_of_ref": "indicator--adf85152-8daf-407e-8453-409f30322fb3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18a0dbff-0aa2-4d4e-8a1d-fcf9a7461b04", "sighting_of_ref": "indicator--e6d34c43-2d75-4f96-9e57-f2bf57313bb4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bc9d4d2-90c2-415b-8433-db37a328b0c1", "sighting_of_ref": "indicator--df2923c8-3c4f-41b4-94ab-52495cccd9d3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dd9ed1d-989b-475e-a4f2-35cad2c4c2e1", "sighting_of_ref": "indicator--df2923c8-3c4f-41b4-94ab-52495cccd9d3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05deabdd-d7cf-41e9-a490-e59fb8f721e2", "sighting_of_ref": "indicator--7dd0b5a3-991d-49dc-9568-b48c2e749dc2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9fae10b-8e2d-40b4-aaa0-89c17205d1f7", "sighting_of_ref": "indicator--1c8e9bcf-92c7-4ff2-959f-a5a02410ae82", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--693e8e2f-9735-401b-ad76-69e7fcb25f27", "sighting_of_ref": "indicator--8cddcb28-2e0f-4940-89a2-2237655f3ee0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a8a6d09-1c52-4155-ac93-2aa47e3cdabb", "sighting_of_ref": "indicator--20ab4bae-a281-4719-bfd9-84abb41c3146", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--528dbfd5-9b73-49aa-8c57-858ea952a62d", "sighting_of_ref": "indicator--36cce09f-760c-4487-843b-9839a8475275", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4a82ed1-1e21-4009-b93c-2d31a5645412", "sighting_of_ref": "indicator--262ba158-e753-4d24-8430-162ede05c96e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d1bf97d-13db-48d4-a10c-1c8b0a5e2a7f", "sighting_of_ref": "indicator--a58d93f0-9079-40ae-9489-9489971c87f6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--706436a6-7ddc-4f43-b20a-a989eda271a6", "sighting_of_ref": "indicator--702f8923-7496-4c3e-831d-28a19f3c67ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7f05c45-0b5b-43c6-bca6-5ee20c34d568", "sighting_of_ref": "indicator--48cb9b81-1078-4533-a17a-f645a1fdd4f5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70ade41c-f939-45bd-93cb-df607e0d5e04", "sighting_of_ref": "indicator--0350609d-dca5-48c1-9dc3-9de3be715dc6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c91789ed-26c3-443d-848d-28d89bc9c666", "sighting_of_ref": "indicator--cec01108-640c-4f8f-95dc-1b2ece2fc1da", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfa61ea6-51da-41e8-bb1d-5c34c82d51ce", "sighting_of_ref": "indicator--dadfde82-c998-4782-97aa-68e47e534d66", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c18bd64b-c7e0-4f88-8099-5de9d8e495a4", "sighting_of_ref": "indicator--c1f988c6-517b-4d7b-acc9-dc3f92033feb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e767377-e566-4b37-9fc6-5d224b7c3c17", "sighting_of_ref": "indicator--d91afefa-a261-4c16-ae80-d7cfa105b65b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf42ee33-7174-42e1-acf2-4ab963a05274", "sighting_of_ref": "indicator--2561227a-590d-4cfa-95cb-d0fa4c5b87bb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db34a7a7-c447-4f1a-90e4-922e3d3a62bb", "sighting_of_ref": "indicator--e4ece524-aee6-4a71-8b6b-d8adad305d00", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d349ce40-fbb8-40ce-a2a9-220ae484995b", "sighting_of_ref": "indicator--8e6d5138-6ff6-4444-960d-175bdfd39549", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49d20df6-7b0c-495e-9c7e-d98b82ba8f73", "sighting_of_ref": "indicator--8e6d5138-6ff6-4444-960d-175bdfd39549", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f7b576c-b762-4d30-b7fb-b19894772ae8", "sighting_of_ref": "indicator--95002fa0-a5d0-4935-9e24-fea65b387068", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0080015-de2c-4aec-acce-054410aebff7", "sighting_of_ref": "indicator--2a012447-e14d-4c06-9a95-a390f5c2c505", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--828e6f3d-34f7-4aab-aa4f-91630febaabd", "sighting_of_ref": "indicator--2a012447-e14d-4c06-9a95-a390f5c2c505", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48502b94-ea5e-451f-a1d3-9f3c6616334f", "sighting_of_ref": "indicator--7bc2e011-85fb-4fae-82bb-1f8a453f293d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68bed35a-a00a-4402-8cfc-c75931a5d383", "sighting_of_ref": "indicator--189f1793-2525-4593-a846-5720448364f3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00f198ba-10f2-4e97-972b-a36cbea79b35", "sighting_of_ref": "indicator--ed517bb9-992e-43ac-badb-dcdfdfdd6086", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb40202d-81be-4e89-9468-629d61abd46e", "sighting_of_ref": "indicator--5ddd78d3-11d8-4d34-9ec1-dfcc1fd035c5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0242465-2110-4736-a64f-cc11f436651f", "sighting_of_ref": "indicator--0d36e1ed-c39e-4708-be9b-f35ee4232fa2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--769f28a0-a3d6-4e7c-877f-b94c9b866b35", "sighting_of_ref": "indicator--caaafc9e-aa5a-4441-a7cd-76d5ad589f3d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--175a0af0-18de-437c-b770-dbed54c99eeb", "sighting_of_ref": "indicator--8f11b250-db7e-472d-860d-4031f21278cb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f54439de-12cc-4768-ba98-d6a0105315c6", "sighting_of_ref": "indicator--e2f17f34-6766-4961-9767-fc6c10b30d2b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--036a1503-7b32-452a-8f0e-422a4ca60eb6", "sighting_of_ref": "indicator--36e3275b-dc92-4bb1-a680-a9e1dbffd807", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d312912-18e8-4a5d-b8fb-43d0373462f9", "sighting_of_ref": "indicator--36e3275b-dc92-4bb1-a680-a9e1dbffd807", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4665619a-b4e8-4ced-a108-5373a996a7a1", "sighting_of_ref": "indicator--33569d01-7272-451b-8be7-387136cc7a3e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13216310-efdf-4d81-b334-c04bbc9f6094", "sighting_of_ref": "indicator--1b9de306-c077-4d87-99e9-f5331259d1eb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d83b48dd-a6b0-448a-9cda-422cb4bb9eae", "sighting_of_ref": "indicator--0a75a6fe-f0f3-40ab-b610-695f3449f385", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0deede35-3a2e-46d2-a158-4361392ee37d", "sighting_of_ref": "indicator--8825aa2a-7428-4cf8-b30a-635141e4f7a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--477f37c2-38f8-4a8a-9b8c-f1794a323887", "sighting_of_ref": "indicator--90559558-c153-41f3-bb0d-a74727ac5aae", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c415fb03-c79c-42af-8f97-9af350a73552", "sighting_of_ref": "indicator--43edeede-c4b6-44dc-a6fe-dbc111d2f148", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b936d55b-5504-4084-a1c8-9885e12bf06a", "sighting_of_ref": "indicator--7da9826e-ccbf-4265-b4c3-953a50bf8cd7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--263eb0f8-18ff-4c70-8d41-a65f2fe51b26", "sighting_of_ref": "indicator--d1d9023b-983a-45b2-9dba-d22ffe6fe8ed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--656a6015-c5ae-445a-a689-002492b1fd8e", "sighting_of_ref": "indicator--8d535755-8118-46f4-b2fa-d694d72c96e3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d961123-4611-42d4-b742-b69e712e27fa", "sighting_of_ref": "indicator--b50d666d-8728-43a5-9979-a8b17be2b3bb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c5d4098-2af7-48ca-be46-8b57e008dd92", "sighting_of_ref": "indicator--400ee570-7953-4577-adfe-312f4f96dfd0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23bbd65b-1206-4ebd-b9da-6aca8476e317", "sighting_of_ref": "indicator--36e8779c-bca0-444c-8f8d-7f8d735106e7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcfe02a5-d596-44d0-a93f-42634be88e6d", "sighting_of_ref": "indicator--36e8779c-bca0-444c-8f8d-7f8d735106e7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--093f9e46-c27c-4092-b9ce-dcce4e55648a", "sighting_of_ref": "indicator--13c654ff-5900-43e2-8102-c7ad68234ddf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33118b88-e1c4-47ef-8219-9f1c04556703", "sighting_of_ref": "indicator--13c654ff-5900-43e2-8102-c7ad68234ddf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e441bfe-2e3a-419d-9a58-2980919fec79", "sighting_of_ref": "indicator--1c47728b-477f-46d1-bcdf-d75dd00c69bd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3955090-81f6-4682-b023-64aebfb350bf", "sighting_of_ref": "indicator--205a852d-a032-403a-a740-d6a6d8732994", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5728665-c2e5-4b36-8566-7db9339cf50c", "sighting_of_ref": "indicator--193a85ec-70fc-4930-9e6b-79543b728a41", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6951ee93-57c4-418e-8a65-911cea2e8c3e", "sighting_of_ref": "indicator--a575faba-6df5-41cb-bcfb-256ad6ba3b8e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1afbf24d-b422-4dcd-9874-8278a65385c6", "sighting_of_ref": "indicator--32c87afd-8689-44a1-a0f7-47040c5ed676", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c5bc360-73ce-4b7b-a34b-318104be33e3", "sighting_of_ref": "indicator--fed3420a-f02d-492e-b5fa-8aaa2bd50c6e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7ef208c-f841-49bf-820c-00661a976d20", "sighting_of_ref": "indicator--446ef716-e51d-49e7-a42f-cb8db02c1177", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--884aa9b4-baab-4f1c-aa2d-68d13e0c19bd", "sighting_of_ref": "indicator--f074b8dc-0f4a-46c7-93fd-e201f54bcb62", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--341d127c-4fad-43b1-9149-3593f29f5160", "sighting_of_ref": "indicator--d7dc0c9f-d40f-4faf-b74e-63ae5a16df7d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a52157a1-b359-431d-9554-8dda080547e5", "sighting_of_ref": "indicator--a2a15a38-778b-49d6-a4cf-474c2729db99", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85f65391-8b09-4867-b405-0222c2c29903", "sighting_of_ref": "indicator--4ed96e8a-7c05-4455-8a18-3de29b66390a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90704df8-b1f8-4194-b999-84541c4e3120", "sighting_of_ref": "indicator--4ed96e8a-7c05-4455-8a18-3de29b66390a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2c9def4-8eb6-4573-b170-0bb6ef65f7c6", "sighting_of_ref": "indicator--c4730b2a-6370-4ad5-bbcd-6105c0d499cb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75b8dafb-d42f-4123-b65b-ff3b0f31cefb", "sighting_of_ref": "indicator--a6e3f13c-36cf-4b49-9c48-cd6dda20dbc4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59a754dd-578f-4eae-b6bb-2d3b69f41074", "sighting_of_ref": "indicator--d6549536-b478-466f-a641-bfa43228ac0e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8586ccd3-54ab-4e75-9cab-79d7c281cfe3", "sighting_of_ref": "indicator--d6549536-b478-466f-a641-bfa43228ac0e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c35b5b04-2582-4237-a542-2052a16c8df5", "sighting_of_ref": "indicator--cb219ff5-8240-407d-a34f-f46516a10010", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e33f718d-fb19-4575-a0cb-e05514b14555", "sighting_of_ref": "indicator--ef6073f0-b5d7-4be1-b7d8-15be95d7a60b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a424b668-1588-447d-b3e4-c2b3a6c64c9d", "sighting_of_ref": "indicator--8f96ad29-7c0d-44ab-9232-018e8c0634dc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1adc48c-4dda-4180-8435-9a67a9870dba", "sighting_of_ref": "indicator--b0608486-e4eb-4730-8b4f-bf136186766f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16abbd53-8b8b-4b21-a09a-5e3d56e2be0b", "sighting_of_ref": "indicator--2dde8dcb-5d3a-460c-9371-53a1e197439a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0864afd2-fa32-4279-8b95-14c0916c47e0", "sighting_of_ref": "indicator--2dde8dcb-5d3a-460c-9371-53a1e197439a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d290c190-0b53-4c7f-810d-7f07e2628ce3", "sighting_of_ref": "indicator--f8641421-32a7-4e02-82d0-1ddcc3ff6051", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6c99a82-f2e8-4a68-b81f-676095abced9", "sighting_of_ref": "indicator--c23beb61-b65c-4cf5-9153-b8b9b9df94aa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ff948a0-703c-4133-a9a0-ba0d0feb6f1d", "sighting_of_ref": "indicator--31a7cd86-f60d-4b71-98df-374128d5aae5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7deecfcc-daf8-48d1-9a11-83232a8bfe60", "sighting_of_ref": "indicator--b51d0cf8-6369-47c9-85b6-ecb438311446", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--434ec40d-6e00-4262-abad-28cc34a25bbc", "sighting_of_ref": "indicator--dbc75a68-84af-41ac-a1ea-156b9191e663", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfa18140-e986-40b3-ad9e-152dcf137380", "sighting_of_ref": "indicator--d1a2764c-f5a2-4dec-a67e-ad32b1f25eaa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60690af7-d4d2-42ec-b28d-a36116ebc050", "sighting_of_ref": "indicator--2fc9cb8f-ceea-45db-9f73-2c5c09afabc2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f2fe70b-7dce-4398-832b-60eaf8d04106", "sighting_of_ref": "indicator--2fc9cb8f-ceea-45db-9f73-2c5c09afabc2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--938c4062-07a3-467b-a10e-27f7dfc71159", "sighting_of_ref": "indicator--ae342acf-983f-4be3-9f8e-eed8e206929d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a09b8216-b7b3-459f-95d0-bd503e079f0a", "sighting_of_ref": "indicator--d218ff25-f1e6-482e-87ac-2a8724cd56a1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01beef95-2069-4a5e-90fe-4e3e915f8249", "sighting_of_ref": "indicator--20454424-2170-4c28-be9f-1aee8e5a9020", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1799cf0e-e0d4-403b-9c0f-6b58e9b7fefa", "sighting_of_ref": "indicator--3fc61972-215d-4fec-86b0-3a1b150315b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd1d26c5-e9a4-4b4c-be5c-5267d1b9bfd6", "sighting_of_ref": "indicator--810a0535-fe27-4749-8838-11eaaa7327ac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbcedf2b-455a-4896-b4f2-486e9a42a13e", "sighting_of_ref": "indicator--810a0535-fe27-4749-8838-11eaaa7327ac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cb9a20a-6661-45e0-8102-1a362d60199b", "sighting_of_ref": "indicator--24d61df0-dabb-450c-a2c1-6ef41ec31336", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d83b6e46-66c7-4ae4-995a-ddc342a0659d", "sighting_of_ref": "indicator--2945898f-dbd0-4979-b3bc-357edd116068", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23586888-7f41-47c6-aa87-55b81a630d66", "sighting_of_ref": "indicator--f8b2af88-330c-4a1b-9789-c68047396708", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dae93d6-f494-4780-9cd4-bf62758f1246", "sighting_of_ref": "indicator--27bf510d-5178-4f71-8e0a-3b4621d0bf35", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d72b2600-92f8-4f69-b1e7-702781ec62c0", "sighting_of_ref": "indicator--766cad04-7e86-4739-a794-efd8bdd4662d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d578438-ef33-4d12-b29b-f10f10a2276b", "sighting_of_ref": "indicator--d02ac0a6-4edf-4756-9473-27106713ba0d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94fd8e9c-334c-4ce8-9a4c-8619b037d72e", "sighting_of_ref": "indicator--63a36276-2b66-4c6f-9cab-b6f4aede65e7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57df3737-d3c5-446a-ab35-ad3b9980834d", "sighting_of_ref": "indicator--a1d5eda8-7bb5-4405-9149-55e17b3f82c5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c264e775-d44e-4d5a-8cfa-163e19cb3dc1", "sighting_of_ref": "indicator--276df8f4-e8fd-4bde-904b-5498d90e73e1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a51169c-c525-480d-9b8e-a83ee3187a7b", "sighting_of_ref": "indicator--df8fcc54-f9f9-46af-897d-876ebf8eab1b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a581e41a-ad8f-41b6-ae0b-d7958756d12c", "sighting_of_ref": "indicator--b87ce143-ab2c-4134-9d61-171e04787568", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc3afce9-6c7b-4561-973a-a203644b3065", "sighting_of_ref": "indicator--b87ce143-ab2c-4134-9d61-171e04787568", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6525f7a-f169-414c-9465-41e4a6e54e52", "sighting_of_ref": "indicator--f6547e5a-b466-4edf-b8c7-9ab09e8a4d13", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b390aea6-2899-4f6e-b710-e8abbd810d42", "sighting_of_ref": "indicator--c07d53b5-0b1d-434f-874a-477cbfea2851", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a549599b-af4e-4c78-a25f-facf8f1ed128", "sighting_of_ref": "indicator--97ddeb68-985a-4437-970d-0de256b0b14d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bb4cda6-edad-4ff3-a52b-ff22bbc3ba77", "sighting_of_ref": "indicator--0d546246-7831-42bc-aaaf-3f4e10433a40", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab5487ca-3e87-4298-93ab-2422fd500f8e", "sighting_of_ref": "indicator--153f9a74-91ac-402d-adb0-a24986f2b981", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b4d2ee6-bde1-4154-bffb-92ab53a91eb9", "sighting_of_ref": "indicator--2ace606d-2bec-4a3d-8e6a-4470140bbc16", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11686fe6-49c8-4128-a62e-2f2a2a280cd9", "sighting_of_ref": "indicator--5d1ad89b-7e9a-40e4-b640-b8de80ca771c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0cc9c28-9b75-4d16-8810-77ff5eb13df5", "sighting_of_ref": "indicator--f349f553-8c94-46c1-b9c8-713df7d4fe47", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--358d32d7-9818-4325-817f-7038f285d470", "sighting_of_ref": "indicator--eea471bd-b6bc-4fdd-b8fe-2d312fa82e80", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97ddbd58-37e1-4e5a-b690-fc807587b226", "sighting_of_ref": "indicator--d0bbde1f-1818-420b-b637-1ffcc2976459", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcf2bc3f-e1f5-4412-be47-b8bd6248cc99", "sighting_of_ref": "indicator--d0bbde1f-1818-420b-b637-1ffcc2976459", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17c13be9-65b0-4e78-8e13-2c2090483677", "sighting_of_ref": "indicator--1ff4ad0b-20e7-432f-9a28-d0ebec650c85", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab5c8ccd-751c-4f63-a460-b94d666ba621", "sighting_of_ref": "indicator--fc2bd36b-90a4-4b9f-8197-e6c3a7047f1d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5722998-ffe2-456f-9cf2-c638b63e93b5", "sighting_of_ref": "indicator--0ae1a791-c9e8-489f-8f08-b8a53f251d92", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--906f256b-3553-4f6f-8552-f62906cbf587", "sighting_of_ref": "indicator--da8b9950-2c82-4831-aba5-68c6a218b429", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b50ef08f-efb6-4e29-9256-01f42a7eddc6", "sighting_of_ref": "indicator--9b269f68-5a94-41b3-a359-40420ad7c39e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feac0ec7-4618-453c-9cb3-94b9bb013f32", "sighting_of_ref": "indicator--4d0bb418-1a93-4f6a-adaf-6c24f0976fe3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc579ecb-9662-4eff-85e6-81a307dbe4e1", "sighting_of_ref": "indicator--6821a096-8f63-435e-bed7-21ba92cac341", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77882409-7885-4a6d-816c-cdb4aa3e005d", "sighting_of_ref": "indicator--b73b7007-375e-41ad-9ecd-acf57a851da2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb13017b-3bf2-4517-9afd-66575869f00e", "sighting_of_ref": "indicator--6f50481d-d499-4d13-9284-0d8bdd0693a2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ce71ece-2331-42ed-8397-cbd14fd20175", "sighting_of_ref": "indicator--6f50481d-d499-4d13-9284-0d8bdd0693a2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6ba1818-8d28-4901-be90-152e2ba67c13", "sighting_of_ref": "indicator--5ba77e68-ffe6-43f6-915e-a5c9dea12e6f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a2ea41a-4742-4386-8965-2c33196c345f", "sighting_of_ref": "indicator--1cd954c8-9510-423e-a343-a18a53c50fb6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0a480fd-fb2c-4165-92e1-8c09d8140521", "sighting_of_ref": "indicator--a4362739-fd66-46c8-8d7e-74d3aeb66719", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d069de8-f803-4437-9d43-17cdb1cc35d0", "sighting_of_ref": "indicator--95c43449-be38-4cbf-9a3e-ddae39e3ed9f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f730806b-dbe5-4f32-86f5-2a90f0036be9", "sighting_of_ref": "indicator--53bf92b9-24c7-447c-9af8-82195ca6a7a8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dc33f51-8102-48f0-9961-53f455996561", "sighting_of_ref": "indicator--38bfca7e-df19-41d3-8d19-f204784f7bd5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2256e5de-ad03-4dae-bd2b-a328e2ee2e6f", "sighting_of_ref": "indicator--74cf6b40-9e6c-406f-9d64-2596b6a25aba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6279a4bc-467d-41f9-9cae-da7e82794a60", "sighting_of_ref": "indicator--67c44a2a-8c5b-43d1-a886-4cdd8dd09a58", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79b960f9-db0c-44c2-b54c-f440fbf03ebd", "sighting_of_ref": "indicator--ca5f6d04-3f0b-488d-a87d-e84aa5f730e1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eeb5c240-b979-4b4f-96e5-73f413496bc1", "sighting_of_ref": "indicator--9e28ef72-317f-4e85-96ee-b1f7f77263c2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6abe75ec-7efe-4ea8-8d0c-2f03b9b591e2", "sighting_of_ref": "indicator--0933755b-de50-4345-8b2a-d78d49bb74d1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3a51680-3213-4b12-9e3c-a1bf68cc0b7b", "sighting_of_ref": "indicator--7d9c7361-95d7-4d74-b21c-25a765f1e8f6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--828a05eb-9bcc-4227-abd1-81ae2abcd748", "sighting_of_ref": "indicator--454ab707-51bb-4bb6-b7be-13cd2e9b7fc2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd17d67c-7ef5-4f85-971d-8472c4eaa987", "sighting_of_ref": "indicator--cf9e9f5b-b2c5-49cf-811e-cd26b8303113", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87087007-d1a5-42d0-b2dd-89c71b0eb30c", "sighting_of_ref": "indicator--4b000468-aef1-4d62-b79c-91b30f9939cc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6080a83-7de8-418a-849b-d2c507d78177", "sighting_of_ref": "indicator--884daee2-6663-4a4c-bdf7-255f1e7dbf95", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a22cb37-68dd-437f-a6dc-1ae161d0036b", "sighting_of_ref": "indicator--db7cdfd3-996a-43f1-9792-17e2b55ca4eb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39a009f5-afcb-432e-8c5a-cb946d09b21f", "sighting_of_ref": "indicator--12f8cdf1-464d-421d-b6b3-6b92cdecd6c0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4db7ffd-160e-4b1e-8172-757dc90934ef", "sighting_of_ref": "indicator--23674fad-29ca-4a1f-8bb0-83f6955ba211", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--492c1707-a072-461e-b88e-d2bb58363f79", "sighting_of_ref": "indicator--9d9f003a-d4c8-4f66-8deb-761c514283f5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8db319e2-d52a-470a-8e30-b6ababa18801", "sighting_of_ref": "indicator--ba59e261-a16d-4551-b8fd-0060c5b2ee1d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1837d6c0-d862-481c-90ad-eb031d456758", "sighting_of_ref": "indicator--ba59e261-a16d-4551-b8fd-0060c5b2ee1d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e0d3080-da6e-4669-ab28-bc67cd100caa", "sighting_of_ref": "indicator--fe93a6c3-18c4-4930-9d3e-d9903aa84dc7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--959760e9-538f-4e30-8838-d92137ab6b0a", "sighting_of_ref": "indicator--bc8dc813-8e28-49e1-a5d4-c974dc188cd4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf0af96c-05a9-460c-a168-72b37d85e3d2", "sighting_of_ref": "indicator--407b2ebb-a50e-4b57-ab6f-869d921a9e0b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e51f395-c896-4dbd-910b-be962540bb8b", "sighting_of_ref": "indicator--b2797ef8-244f-48a6-b379-f0e141eb70cb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56f97487-4d00-4d20-b89b-e351cf69d6fa", "sighting_of_ref": "indicator--72c3a604-094e-4b7e-8181-c0c82fd8629d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c4fc019-899b-43c7-8670-fec4023384ff", "sighting_of_ref": "indicator--b181bead-4cd9-47ab-8023-914821e7e419", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--368d3f34-860a-406d-a161-5e91d90afbf5", "sighting_of_ref": "indicator--5a618f4d-a5d5-444a-8cf6-39ce96419c12", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ae2f269-74a5-4551-ae02-025cab9f4692", "sighting_of_ref": "indicator--68e103ce-d980-4688-9a5a-87b313a03a3e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afbad006-91e1-4fd5-82af-f50e6ad19812", "sighting_of_ref": "indicator--792e07f6-66b6-4450-b666-11654c96c39e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--763564ab-4f05-4e11-a68d-d9fd8950d33d", "sighting_of_ref": "indicator--792e07f6-66b6-4450-b666-11654c96c39e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ea30164-58b5-4d89-8eff-4315ce6e7da5", "sighting_of_ref": "indicator--8a3f86df-b300-47fe-bb51-af92f3a31a43", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f5a5869-dcd9-4cb7-9aef-54af8d731b53", "sighting_of_ref": "indicator--8a3f86df-b300-47fe-bb51-af92f3a31a43", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--126c0af5-abdd-4d62-b023-6550c1060390", "sighting_of_ref": "indicator--9b206463-5978-41dc-8136-4d7dd2e090ba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f69db61-e01c-4c5e-9965-c5878f524ac7", "sighting_of_ref": "indicator--476c6715-ef37-4285-9fda-12bc2e2fe523", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49815b71-6ca7-4e7e-bf48-21d5ff5492c4", "sighting_of_ref": "indicator--476c6715-ef37-4285-9fda-12bc2e2fe523", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3e041f7-a479-45a6-a6ae-92f80f8030ff", "sighting_of_ref": "indicator--8e90d5dd-c899-4a81-a2d1-21ea4d19ab58", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61b2cfa4-6785-494b-a445-a3452c038fd2", "sighting_of_ref": "indicator--8e90d5dd-c899-4a81-a2d1-21ea4d19ab58", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4da4ec95-e2f2-4e7a-b2e4-bbab74e0a68f", "sighting_of_ref": "indicator--e475ce83-9b23-4844-bb48-24937fe11c0e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ac75306-4d99-4e89-a83f-4e8ed46c889e", "sighting_of_ref": "indicator--457fef1a-9e54-4493-b575-a2dca7adbf35", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39b0cdbd-5962-4bbc-9b56-f4ff1fc9082c", "sighting_of_ref": "indicator--e767188f-c85b-4ebf-8b14-bde7fc6213e9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--564274c3-32b7-4d6c-9cb4-7ed863cdd7c3", "sighting_of_ref": "indicator--f8e8396f-8f60-4526-98fb-307f8d36427b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f729464-a4ad-4ca9-9bb0-b8e3c9697da0", "sighting_of_ref": "indicator--f8e8396f-8f60-4526-98fb-307f8d36427b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2f68752-4077-4cf7-a9d7-79a1770ed12c", "sighting_of_ref": "indicator--86c2e4df-855a-4439-8fe7-97977e9cd2ad", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--750f22b3-7b28-4798-8009-19e8b1b4029f", "sighting_of_ref": "indicator--86c2e4df-855a-4439-8fe7-97977e9cd2ad", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ce3d869-b6c0-4b74-9813-9bd51c9099f2", "sighting_of_ref": "indicator--9efb4129-d68e-4864-8026-4ff5615cedc3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d7b7f4e-e8d0-4486-a595-a7d8feb9fd73", "sighting_of_ref": "indicator--9efb4129-d68e-4864-8026-4ff5615cedc3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3739c621-c2ed-443d-94b2-50a672a1c2d0", "sighting_of_ref": "indicator--f788ab58-c58e-4efe-802e-a5a256c9862b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--827fc6fc-0d1d-49ef-b52e-b458e17a1879", "sighting_of_ref": "indicator--dc850a25-6172-432d-9ecd-41cb39123aa2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c10dbf12-79bc-47f2-947b-a469d43f0a44", "sighting_of_ref": "indicator--dc850a25-6172-432d-9ecd-41cb39123aa2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--452853f8-07c3-4b0f-9614-565115f9606e", "sighting_of_ref": "indicator--f5aa88b5-8a5b-414a-8eb1-f8f3a86d437c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62a66539-acf6-4a99-bc7b-7dc6c1845379", "sighting_of_ref": "indicator--f5aa88b5-8a5b-414a-8eb1-f8f3a86d437c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dadafeb-fc77-4fbf-ad59-89204369965c", "sighting_of_ref": "indicator--74b0da5b-16c9-4754-92ae-50615ff5fa65", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e226cb01-cf3a-4fe8-bf54-e81fafb4c4de", "sighting_of_ref": "indicator--05ecf514-334e-4607-b8c4-ce0e013566fb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bcddd75-a73d-4264-9f54-896c0645e18f", "sighting_of_ref": "indicator--8074d853-9fdd-4685-8d78-a0ff110b6f1a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7956316c-bcaf-4ecf-80fb-ddf41b041ef0", "sighting_of_ref": "indicator--703b539d-b2de-480c-8c35-8fd2cc8d445d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58c2e3c8-2153-4979-844b-8a9c619725e3", "sighting_of_ref": "indicator--d6c67712-04b8-418d-bee9-c308effe9169", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e6564c3-5003-4552-bcd4-1cc329a803ee", "sighting_of_ref": "indicator--cc78b2bc-15e1-43e1-8c59-3e881ae8c576", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbe8f158-b36b-448a-9d55-6c9f74e33c56", "sighting_of_ref": "indicator--d0eb4782-a5cb-4abb-bd47-adf59cb8f5b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4df53293-d4e5-4e2a-8b87-33e3bbadc2e1", "sighting_of_ref": "indicator--8d54720c-7e8e-4ee5-a8db-fc361ca15db4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcc03fa2-99bc-4d97-9b56-8a6f57878d76", "sighting_of_ref": "indicator--cdd1f1aa-5c7d-4515-878a-ea38cd2ebc1f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4afe105e-6292-4a86-acfe-cc9fbcda1021", "sighting_of_ref": "indicator--0a8f50b9-6fca-4565-b47d-3ca81936ce9b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--974da63a-6c5b-4d8b-84c9-c91f524bc48d", "sighting_of_ref": "indicator--8daffa65-55d7-45db-bbb0-4ec5777a5823", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0778d16c-96df-4e93-ba1f-47e3bc5266f1", "sighting_of_ref": "indicator--3959bc5d-b8f1-481a-8b11-fb613d2a31a7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbd7ab59-1fac-4659-b739-3e1d905136d9", "sighting_of_ref": "indicator--3959bc5d-b8f1-481a-8b11-fb613d2a31a7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa58a63d-771d-47ab-9cc7-879bd85034dd", "sighting_of_ref": "indicator--8f30bee7-cdd0-4e40-8d23-993f5a5d03f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e727c146-df18-416e-8f79-3e26464a3be5", "sighting_of_ref": "indicator--0ff25c32-f537-41ca-b697-e292da23fa97", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8dd7bea-481b-4629-9c04-1ca80e528507", "sighting_of_ref": "indicator--edebbc59-02aa-4539-91c5-041d59b47cb9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4593f5f5-c74b-4991-b46b-fa90013a636f", "sighting_of_ref": "indicator--edebbc59-02aa-4539-91c5-041d59b47cb9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fbf0072-c2df-4072-87f4-8e6b309e34a2", "sighting_of_ref": "indicator--04b7e9b7-6953-4375-82f0-4d967775ae4f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--995cc640-a198-487a-99e4-e43e65bd27fb", "sighting_of_ref": "indicator--04b7e9b7-6953-4375-82f0-4d967775ae4f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef43fc9f-e168-42af-8e51-0761ef6fa203", "sighting_of_ref": "indicator--1aaabbf1-2e1c-4f71-b6b9-be762c8730e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a3c6275-1524-407b-9dbd-b22e855b38c1", "sighting_of_ref": "indicator--8835a708-1d5a-4455-9163-9c937282e469", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54e26e81-457f-402b-88c0-9248f780f7ff", "sighting_of_ref": "indicator--8bdb8714-787e-496a-92aa-7aeec4530807", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8ef01ef-0dfb-420d-b6e0-117c4026d527", "sighting_of_ref": "indicator--998f3fa2-07bd-466e-83ce-44036156f7d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fd1a31c-a27a-4742-bed8-16de4da5864b", "sighting_of_ref": "indicator--998f3fa2-07bd-466e-83ce-44036156f7d8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--430ae8c2-435c-4c64-b942-3792c11813b4", "sighting_of_ref": "indicator--89e3f1e6-f13a-413b-8c30-7cedc64cfea4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8980a88-80fa-404c-b63c-f64b342b7431", "sighting_of_ref": "indicator--89e3f1e6-f13a-413b-8c30-7cedc64cfea4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dafa2a50-8a5b-4133-a426-eed46a3fb1d8", "sighting_of_ref": "indicator--fbe52e12-0531-4802-ae06-94fd9499a9f2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8314ffae-664c-48a5-98c0-c6d97305102f", "sighting_of_ref": "indicator--fbe52e12-0531-4802-ae06-94fd9499a9f2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61beaa02-c166-4d71-bc0a-b556396b0df3", "sighting_of_ref": "indicator--7ae8e007-9e4f-4f75-a4d5-ed6cd36d774a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3c24a60-e699-4f84-bb07-3f961a86ae96", "sighting_of_ref": "indicator--bd4ebe77-fc2c-4df3-b473-bf9524367adc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92fb5c8c-f979-47d9-a04b-f7e32d017738", "sighting_of_ref": "indicator--701913d6-9d88-42b6-9fb4-8b1a84689cc0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23b28702-0566-4215-beb3-0dd03de82749", "sighting_of_ref": "indicator--1f7f6a1d-a156-49f3-9152-7f9941ed42d2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c60a0cf-288b-40b0-8283-b0ca143df472", "sighting_of_ref": "indicator--2058050e-9e55-4b86-8e83-fcab79666cc6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b65e23b-ca35-40c4-b967-faaec84277d3", "sighting_of_ref": "indicator--2058050e-9e55-4b86-8e83-fcab79666cc6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b1b94bc-ea94-488d-8fb8-2b7bfcf8be67", "sighting_of_ref": "indicator--7652df80-ffa7-448a-8ae8-7d99c685624c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df4934cf-59dd-4ba2-914e-8ae2ce24bebb", "sighting_of_ref": "indicator--2274256f-0e8d-4747-80ab-0871dd36be4e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06e93ecc-482d-4c5d-a10b-5ec714d425f5", "sighting_of_ref": "indicator--40bb3d7e-9c0b-4596-bc76-ce796d4e2592", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75eb6689-d0e9-4368-b019-3bbc104cb3d1", "sighting_of_ref": "indicator--17d61bcc-b560-496f-8adb-03bd2298fef2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6944f912-f68a-4daf-9004-c3cd2e2d8403", "sighting_of_ref": "indicator--303ef234-f7ae-4d9b-9c85-a7efcba63562", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad61526c-ef93-4a0f-adea-d0612b67c171", "sighting_of_ref": "indicator--c21a8d91-8a8e-46ab-8be7-5c8c8bc4d4fb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f62572e6-d35b-4523-9167-1d3deb6f4456", "sighting_of_ref": "indicator--c21a8d91-8a8e-46ab-8be7-5c8c8bc4d4fb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc909484-4165-4164-9e12-bb39e7b5cc0b", "sighting_of_ref": "indicator--cd8fdf5a-3a88-4445-9231-8bdea419757b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d75ea0c-7a26-4f15-9cfc-45f9cba4d2a4", "sighting_of_ref": "indicator--49e371ff-65bf-45cf-84fc-b0fadd371257", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9f426b9-e283-47ad-bd4c-97b7f1587a0b", "sighting_of_ref": "indicator--49e371ff-65bf-45cf-84fc-b0fadd371257", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f50fff13-b47c-400b-9962-30c831e7fc40", "sighting_of_ref": "indicator--85fefa9f-2544-4524-96c7-a4440089629c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d11957a-3123-458e-9945-edb13fe2930b", "sighting_of_ref": "indicator--85fefa9f-2544-4524-96c7-a4440089629c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d494073-7c1b-4c88-a214-1793363a3283", "sighting_of_ref": "indicator--c75e1c77-c86d-41e8-be14-68d05dd0807e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c30cacfd-b57a-4533-a5be-1b7ea0782f47", "sighting_of_ref": "indicator--c98936b3-14ea-46da-b42e-f3eb96ec3ec0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c3bc7c8-2734-4fa2-b71b-e3803ee209a9", "sighting_of_ref": "indicator--c98936b3-14ea-46da-b42e-f3eb96ec3ec0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--464ca918-defd-412d-b812-53686deb3da6", "sighting_of_ref": "indicator--2702e9af-19d4-4eee-978e-a29ea1845abe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bc4e627-fca0-439c-9472-f54a399a5abf", "sighting_of_ref": "indicator--90633898-8c75-4b40-ac1f-0cf21ac91392", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5390359-00f8-4e50-91bb-387dac495fdc", "sighting_of_ref": "indicator--367f9e63-e3d8-4131-8036-a88af09fb998", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c4f46ab-0a4d-496e-94f5-8b48cd746f5e", "sighting_of_ref": "indicator--4538f7b1-0d17-418c-82a2-ad6145bd3356", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5b204f0-4291-4492-8b47-0c5709a536bf", "sighting_of_ref": "indicator--4538f7b1-0d17-418c-82a2-ad6145bd3356", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05c8997c-e359-4756-9259-14cfd3e7becb", "sighting_of_ref": "indicator--8f6a8e6e-71a1-4adc-8339-6a1318df5e2c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--994d2063-efdc-4f42-9b5c-96db1fdaf9ec", "sighting_of_ref": "indicator--367b405d-061d-4dc1-b974-e384bcf03b40", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72427351-8d56-4235-8b7d-30b4172ff1da", "sighting_of_ref": "indicator--e481afb9-3dbd-4436-a146-36a05d677356", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--737c7f19-eb7f-478f-988b-00c27330f80f", "sighting_of_ref": "indicator--e481afb9-3dbd-4436-a146-36a05d677356", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--350f7cdd-cd56-4ae2-a26f-0af713677b68", "sighting_of_ref": "indicator--74546581-e6aa-4c3f-9322-9a7485e9ca07", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--954ebecb-c8d0-42e9-ba40-29e1d33c2219", "sighting_of_ref": "indicator--74546581-e6aa-4c3f-9322-9a7485e9ca07", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64f820e9-4a32-4b51-a1ad-d6cccc7896f4", "sighting_of_ref": "indicator--8c88295f-9e7b-4012-aede-28661f93e35b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72cac5b1-2000-42cb-8c0e-7b7cb3c06485", "sighting_of_ref": "indicator--60c558c3-d0f7-47e4-b914-ad8a4282c28c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aa80f26-dcec-4f40-aafd-c30c9d1945bc", "sighting_of_ref": "indicator--3020c22a-1c38-4339-b579-21ba86ae56cd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--954a05df-a86f-4d20-b19f-ef4e8c116f2d", "sighting_of_ref": "indicator--dea501cf-6aff-41e5-a451-48fb0ca3dd1f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7897842e-b002-4f2c-813a-0266ad064b6d", "sighting_of_ref": "indicator--3e36bc00-6843-4dcf-928c-f9eda8f24489", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--736fe431-b959-4313-84a1-20934100e5b2", "sighting_of_ref": "indicator--699fba34-3436-49c9-bd8e-35043f5a581f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--250601ee-169e-4af4-ae08-d8c7bff8b647", "sighting_of_ref": "indicator--4cecfe01-c10a-4e6b-aa5e-a2dcddea5aff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--838bbd72-0cc5-4130-9750-7405c088e8bc", "sighting_of_ref": "indicator--4cecfe01-c10a-4e6b-aa5e-a2dcddea5aff", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8533506-20c3-4839-bb02-be92847a8864", "sighting_of_ref": "indicator--533ad446-524e-44ad-8e48-ec0c0ef9f6b9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bae31e44-0e27-4707-92de-dfb9d7c51e8d", "sighting_of_ref": "indicator--7fce4ee2-cc3b-4127-9f6c-d76802e38275", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f3cdec3-5958-4afd-967c-a613736235ba", "sighting_of_ref": "indicator--8276d74d-40f0-4174-bdb2-9f69c2b3ce12", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--435898c2-7f0e-4bea-ac3b-45a907337687", "sighting_of_ref": "indicator--8276d74d-40f0-4174-bdb2-9f69c2b3ce12", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9599de9-377b-49e4-8c46-2d3d0b734c2c", "sighting_of_ref": "indicator--8922b179-e9e7-43f3-a93d-10ff19653136", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85306fff-0128-4276-bf72-480887607092", "sighting_of_ref": "indicator--8922b179-e9e7-43f3-a93d-10ff19653136", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39e9babe-acf7-4dab-9a39-4e60de6b3dbd", "sighting_of_ref": "indicator--65ef809c-e790-4a08-b004-60caf038871d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c2ae23a-3b58-49e3-9b36-cc5e3844960c", "sighting_of_ref": "indicator--65ef809c-e790-4a08-b004-60caf038871d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c183cc4e-cdb5-4ebd-a5b7-1754ee132309", "sighting_of_ref": "indicator--a386a834-1f7f-45b1-a16a-f385cd6f6cbe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab12a8ae-f3f0-41ab-beb3-cd3476f2abfb", "sighting_of_ref": "indicator--a386a834-1f7f-45b1-a16a-f385cd6f6cbe", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc4b2df7-f2f3-4ffa-983d-a994f55864f1", "sighting_of_ref": "indicator--0c3e221f-677e-407c-b1ec-3a9e857cee80", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46aaa856-9d6a-417b-90c0-a90002f3be04", "sighting_of_ref": "indicator--0c3e221f-677e-407c-b1ec-3a9e857cee80", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f566e83a-b79e-41f7-9c27-7d3a9d7e8a09", "sighting_of_ref": "indicator--cc07cbad-5a5d-49fc-966f-96ae30f6e79e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f7560b3-f944-4b3a-b227-ffb25ea973f1", "sighting_of_ref": "indicator--49045145-baec-417d-9ecf-253b6185c9d4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa7f4d21-24c4-45ec-8f1e-5a4918624c7e", "sighting_of_ref": "indicator--882bf5d3-1883-47b0-8e49-60b407e7fb0a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac7dcf51-0d38-4a26-a0c8-afdfc7dab54a", "sighting_of_ref": "indicator--1becd5f2-f073-473f-9cf0-d5ddc7440a13", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b55cd490-4f9b-45af-954f-4aa7e15c4cb6", "sighting_of_ref": "indicator--3b95289c-a5ee-4185-8839-1e1311943eed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3018933e-90b6-43f5-b718-fc6b15266009", "sighting_of_ref": "indicator--cc1379f7-6671-4e31-98fc-047c116b1881", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5bd8609-2696-42f2-8645-063f7d32d574", "sighting_of_ref": "indicator--cc1379f7-6671-4e31-98fc-047c116b1881", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddb56d46-4151-45da-89f5-f0a42dadff60", "sighting_of_ref": "indicator--afacf239-1966-4988-881f-19173f6f1407", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--949838a2-6e92-4b68-ac2a-2a339b4dbc4f", "sighting_of_ref": "indicator--c223f212-d812-466a-be49-dee170322c93", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5501f097-d986-4cd8-81bc-2476e5a55164", "sighting_of_ref": "indicator--4aa231f2-38c8-4982-8585-3f3270fe0c9b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c409cc7-941a-447c-8284-91faddf95887", "sighting_of_ref": "indicator--15312c8f-8e40-411b-a333-13ea0c1baaff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3edf7d75-9dae-4cf0-8187-cfce3700ab58", "sighting_of_ref": "indicator--78c2cdd1-754d-4301-ad57-4e8380315d19", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab6e1daa-b2f9-4058-8f30-f075702e87d9", "sighting_of_ref": "indicator--ea490fdd-9c39-4955-aeeb-83a13cfa1a49", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7030b51-6def-43e4-9df0-9c7134425635", "sighting_of_ref": "indicator--b320c2f1-8aa9-4f8c-9b50-4e15410ca233", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14103c4f-282b-4487-a6db-c4e24a2639a0", "sighting_of_ref": "indicator--c07e8bf6-fc43-4c0a-9125-28a2d87c9158", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2751ebee-f3f4-4b2e-9cd3-ae3b3d0f1aa6", "sighting_of_ref": "indicator--1c3e7327-4969-44f3-a5d0-699553c76b70", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b91638c9-4ad1-42ff-873f-734cd28de739", "sighting_of_ref": "indicator--722bd142-35e3-4a7a-8653-aa2d06add33b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7df4b694-4b3e-4859-8748-a391139bd779", "sighting_of_ref": "indicator--4571bd09-3664-4e8e-afbc-4bc86c61b437", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2356ca98-08b4-44aa-a7ba-b18c3f21bcd1", "sighting_of_ref": "indicator--9d0515a8-d2b2-4ae8-af34-1cf8ca3d588e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78aba4a0-66fb-4370-8399-8b3f57bbf3cf", "sighting_of_ref": "indicator--8a60d55f-f370-4146-986a-cd2785c9288e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--116965aa-3c5b-4f38-9df9-2a451a41a9bd", "sighting_of_ref": "indicator--9dbe7496-2207-4171-a075-b181fa6931a4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--316a26f6-190b-4862-b7af-68c6571da1b5", "sighting_of_ref": "indicator--e914dc0a-7f1c-4c72-a945-a2b4484a9531", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0446d482-ac9f-4c54-a700-4121ac458a3c", "sighting_of_ref": "indicator--30d0f0a6-cb53-49e6-a810-245692635c86", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c536aaa1-bafe-4a5f-9434-a2b3e75a722e", "sighting_of_ref": "indicator--30d0f0a6-cb53-49e6-a810-245692635c86", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9140b18-4658-47e9-b100-cffec3645303", "sighting_of_ref": "indicator--4db99947-9747-4a26-8bba-825cf6946e9c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d72e10a3-30c4-4a16-8a3e-af990e6bb288", "sighting_of_ref": "indicator--4db99947-9747-4a26-8bba-825cf6946e9c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--723d22be-2db6-4aa2-9aa1-f881a03242c2", "sighting_of_ref": "indicator--d4cafba9-dd55-4729-bfdd-cc11aae1ea97", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2a645d4-da58-4c37-8cee-f7488b68da83", "sighting_of_ref": "indicator--8806789e-7e61-48a4-b6cc-949f6bd9832d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--616f4dd8-8544-4503-b73c-afad8484fabb", "sighting_of_ref": "indicator--8806789e-7e61-48a4-b6cc-949f6bd9832d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9e6d6a5-4d5b-4e10-b96a-86e2c687eeac", "sighting_of_ref": "indicator--fe6cb25a-fe58-444f-895d-5657d89df61d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84b32536-c33b-4b62-b387-e31451eee66e", "sighting_of_ref": "indicator--5e48f0a3-15ff-4efe-a007-dbfe200d25ec", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43efba1e-297f-49e9-8882-d8374a7e5e7a", "sighting_of_ref": "indicator--df34a288-1279-445e-b048-1eb9a7b03b60", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1e16eaa-9bda-4051-b263-82405adb5dbf", "sighting_of_ref": "indicator--233aadcc-fc39-4b27-b061-4e49ecd61e4c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f4cb9fd-c150-49ec-849a-408ad6f73362", "sighting_of_ref": "indicator--233aadcc-fc39-4b27-b061-4e49ecd61e4c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf59cef8-cc03-4003-90bb-0513f337d462", "sighting_of_ref": "indicator--f28b7b60-1ca6-4b5d-989d-c3370bd68238", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60ffe140-6ae7-476e-a1dc-2b9ab29039b9", "sighting_of_ref": "indicator--cf37e164-9627-4a7f-8f88-0ab46b23d194", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d23d1d4c-0a35-4135-be7e-ed9613d36c59", "sighting_of_ref": "indicator--265f9d31-accf-4e46-8576-7cbcdf3e291d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f55e762-a4ca-47ac-b8c6-63cf5396783d", "sighting_of_ref": "indicator--ce2d306c-c946-48f8-af73-063239b551ac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcce77fc-ebcf-497d-b232-50b6b89e78de", "sighting_of_ref": "indicator--cb28fb34-9e59-4e5a-9289-c038c388ced9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a38f498c-ba51-490c-a3d3-d7fb06f4bab8", "sighting_of_ref": "indicator--89a41499-f268-4e39-9a04-87d51bdd12f1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d7017ed-8783-40e6-9ea1-44d75eb92b00", "sighting_of_ref": "indicator--a4e19369-560f-4c7e-8467-9b66c8d24061", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--871f4c64-ecd3-4066-bda7-93159e27d4dc", "sighting_of_ref": "indicator--a4e19369-560f-4c7e-8467-9b66c8d24061", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df906978-59ba-45c3-8742-f71bc6a3270e", "sighting_of_ref": "indicator--f033e75e-f7ea-440b-864e-df2ad1ae0832", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--295faffe-580a-4d7a-bb5c-2df1e79c1c70", "sighting_of_ref": "indicator--ecae62f5-edd6-4663-a82f-48f72e7754bf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51459107-6f46-48fc-8e97-0c0a15da45c8", "sighting_of_ref": "indicator--ecae62f5-edd6-4663-a82f-48f72e7754bf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bcdaaeb-25cb-4980-9e92-6301af13187f", "sighting_of_ref": "indicator--ae7b0b90-0bf2-4882-a486-f32e190bf628", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--129d28b4-719e-41c7-9542-5c02b88fe62e", "sighting_of_ref": "indicator--db4774e5-2861-4034-bf6e-8e5e6948c506", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5630656-979a-4fb9-869e-fcca2b3200c2", "sighting_of_ref": "indicator--db4774e5-2861-4034-bf6e-8e5e6948c506", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc716ec0-fcbf-4719-9281-1b2c7b13b98c", "sighting_of_ref": "indicator--79aa017a-74a2-4ceb-9f6a-09553e0c00e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--036fae14-4543-4b96-bb1b-c165a247f2ab", "sighting_of_ref": "indicator--79aa017a-74a2-4ceb-9f6a-09553e0c00e1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1b84a39-ad64-43dd-9099-18d524fa290c", "sighting_of_ref": "indicator--ba091cfc-1e6c-4c7e-81ab-d863a2f447fa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--977d2962-23a6-4f67-b4ca-0f245787e953", "sighting_of_ref": "indicator--ba091cfc-1e6c-4c7e-81ab-d863a2f447fa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe91bb8b-5d59-44cb-951b-bab4db6a98b9", "sighting_of_ref": "indicator--1656db0e-e862-41bd-bd8c-da7056b0118e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93a59b83-06f0-4b6a-aa9b-eeb0d7799c5a", "sighting_of_ref": "indicator--dd5fc64c-898b-42f2-9c29-a6414cfbb506", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3130f5d-7ae8-43f7-8d72-2a1d8d4e308d", "sighting_of_ref": "indicator--7598fdfc-3024-4889-9794-dec4b70439c1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5a60754-0834-4c88-a3e1-d42fb2e4933b", "sighting_of_ref": "indicator--7598fdfc-3024-4889-9794-dec4b70439c1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54056fdd-0eeb-456a-8b4b-56734d01c4da", "sighting_of_ref": "indicator--07d4e4b4-0e80-438f-8d86-2d180a0da5ab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5808058-b5e1-4763-a84a-79c74350a9b4", "sighting_of_ref": "indicator--07d4e4b4-0e80-438f-8d86-2d180a0da5ab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--245bff63-d639-46fb-be7f-276827a49937", "sighting_of_ref": "indicator--7a8d87b9-2a4f-48a9-a194-af8184fb317e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42d1c729-45ed-4f36-a0fb-3d8a62eb2df5", "sighting_of_ref": "indicator--dfbbd2a3-fd3d-46bc-9908-b5521d0ccbb4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b471d9a-2962-4b51-9526-f2e5ad4d6f91", "sighting_of_ref": "indicator--dfbbd2a3-fd3d-46bc-9908-b5521d0ccbb4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--816e6fb1-9268-4da0-b0ec-929bb38e5f0f", "sighting_of_ref": "indicator--bced9e31-e25a-45ba-9ac9-1f1006ad1fc2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34373654-ddee-44ea-9c91-31166d205c3e", "sighting_of_ref": "indicator--bced9e31-e25a-45ba-9ac9-1f1006ad1fc2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db87590c-d081-4267-8570-06ff804eb3da", "sighting_of_ref": "indicator--29ab8ac6-af99-438f-b11c-93d5d2884f84", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--338a1615-12f0-4d7a-8040-c60abac0ae71", "sighting_of_ref": "indicator--0bdcbfd5-91ec-460c-a14f-2548b13018a6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b83ea7dc-7ff4-42d5-b7bb-960580238c88", "sighting_of_ref": "indicator--0bdcbfd5-91ec-460c-a14f-2548b13018a6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32662651-e113-40a2-a29f-345284a42cef", "sighting_of_ref": "indicator--58fda294-3054-419b-8469-4bfe9f9edf57", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d2d588d-8fa6-4dce-9ae1-0b3bbf79e54d", "sighting_of_ref": "indicator--58fda294-3054-419b-8469-4bfe9f9edf57", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51cb3f39-75f4-4d67-ab0d-9ad9dbbd7e9a", "sighting_of_ref": "indicator--60a006ab-a368-4887-8bfe-3d1d0f46b583", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56f38645-da97-496d-8d19-bc90b1e8da17", "sighting_of_ref": "indicator--a3a29f64-c31e-4928-8f10-a6d84a279df0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b72d92be-f6ea-43c6-8c3c-9f1d4bdc6442", "sighting_of_ref": "indicator--a3a29f64-c31e-4928-8f10-a6d84a279df0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f04b6b3-1b83-40e5-9a71-e6341fbe7996", "sighting_of_ref": "indicator--3ea5694f-012a-49e7-9229-43ac08f2324f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f418f94-ba75-4a57-a1f0-7aa2bcd22a7b", "sighting_of_ref": "indicator--3ea5694f-012a-49e7-9229-43ac08f2324f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f9aeef7-79c1-4a43-9e1f-e33652f58f49", "sighting_of_ref": "indicator--4583c694-bb89-41d4-ba8e-bfd4bb93670e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc3dd072-e56e-4cbe-8c95-4f1f2c61ad9a", "sighting_of_ref": "indicator--27e2132b-45f9-4e50-bb76-def0f6fb2bbe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88c06534-0619-45b5-9529-865a93ca06ed", "sighting_of_ref": "indicator--27e2132b-45f9-4e50-bb76-def0f6fb2bbe", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7425486-b5fe-4454-870f-5ce525b28af1", "sighting_of_ref": "indicator--c71996d9-ca9a-4fd2-9a11-5711ea14cd74", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05b13f22-8ba1-4a08-80f8-fc6d910fa982", "sighting_of_ref": "indicator--1b50edd7-441c-4bdd-9b9e-421a52dae0c1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2d07411-54e1-48e1-be29-b113ff6c6148", "sighting_of_ref": "indicator--1b50edd7-441c-4bdd-9b9e-421a52dae0c1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef99cde3-048c-4522-9396-190368382e7e", "sighting_of_ref": "indicator--d26ea1f8-054e-4975-8bbb-4138cd3c1871", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c444862-5cc6-42e8-a6de-914f3d3f4025", "sighting_of_ref": "indicator--9ac6a205-1b50-432b-a937-a6a1af421276", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b1abd1f-5371-4af6-91ea-dd60d20c0946", "sighting_of_ref": "indicator--9ac6a205-1b50-432b-a937-a6a1af421276", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d55fd220-5884-4f69-8be7-b65e3ecac0c5", "sighting_of_ref": "indicator--cef2c1fb-da6b-4fec-a930-618cd8e7e25b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--541ffc0f-77fa-44f1-828c-f9a10e586739", "sighting_of_ref": "indicator--cef2c1fb-da6b-4fec-a930-618cd8e7e25b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9cff51f-bdc9-4b08-8a4f-e177fb3bfd77", "sighting_of_ref": "indicator--bf36706e-c5ae-4575-b64d-a2a2caef3287", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--850a1be4-3958-4369-9806-8191e14ac36d", "sighting_of_ref": "indicator--fef57bbc-97db-40aa-9683-0cdc3a5cb3ae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4ca20df-200e-4ab0-8c12-7e121e5c49f3", "sighting_of_ref": "indicator--284308f7-377e-4dbb-903f-4a1be7fe4dc0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4afb6a30-f2ed-470c-b143-ea2768c3e2d9", "sighting_of_ref": "indicator--28f8777a-0d67-4bde-978c-a153b3a865ce", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8de50def-4fb5-47f4-887a-45df4f500572", "sighting_of_ref": "indicator--2cac54b1-c3a4-4e38-bf88-901a4d2cf121", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--559a8260-e4c0-4196-b0a4-b81314202e7f", "sighting_of_ref": "indicator--52fe11ed-6fcf-4c8e-b6c7-2679ba5e691a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3a857bb-b632-4ad4-9701-54a25a9b9896", "sighting_of_ref": "indicator--443a9bd2-c7ae-4f84-b208-97c029ce2e63", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2387c2a-de63-459b-9a11-6492b497f119", "sighting_of_ref": "indicator--68c7e083-99dd-401c-9721-96ec1b2b4f82", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--496fc530-46f3-48bd-8305-8ff56df48d33", "sighting_of_ref": "indicator--c77b725f-d7fa-470b-ba28-2171e0c4b140", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b3ab5b9-8b8a-4e88-a6bb-7f806972f526", "sighting_of_ref": "indicator--00c9376a-c15c-43fd-9b86-7445da40ddef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c64950b-e873-4afb-931d-56678dc3d5b6", "sighting_of_ref": "indicator--00c9376a-c15c-43fd-9b86-7445da40ddef", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fc93a52-aa23-41f1-8929-e74c6c3ff412", "sighting_of_ref": "indicator--2b72a176-6474-498a-935e-109ef7fe7bff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88d197f1-e441-47cf-a99d-120420a59622", "sighting_of_ref": "indicator--2b72a176-6474-498a-935e-109ef7fe7bff", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25477c25-9883-46fb-82e8-7d35c1ead12d", "sighting_of_ref": "indicator--5cc00e08-2812-48f8-99b3-0094cce46141", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cfbf3ce-de87-48c2-bc61-024a55e5fbb1", "sighting_of_ref": "indicator--5cc00e08-2812-48f8-99b3-0094cce46141", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d508d763-61ad-4b8a-9808-c5a07bfc1cb5", "sighting_of_ref": "indicator--a05d074b-abb5-4eb0-ad10-37993b00f3ef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf1e1efc-1ae7-412d-8d4d-bd0a451375b7", "sighting_of_ref": "indicator--223fc0a2-f0ac-4b29-abab-de86f69a43e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a4ee0cb-3fa7-4eaf-a7fe-d5f04516e837", "sighting_of_ref": "indicator--223fc0a2-f0ac-4b29-abab-de86f69a43e1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62bc0207-0317-4a9f-964e-05b84bd8382a", "sighting_of_ref": "indicator--d11827c2-9427-4c50-9ccd-5d45ec4abe97", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a008d4f-2a9a-4bfd-9b34-79bb2b3aa153", "sighting_of_ref": "indicator--016fee0c-8958-4a4a-ba96-7cee50363157", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c0b119a-cbe9-4645-9433-cdcdaa6c112c", "sighting_of_ref": "indicator--016fee0c-8958-4a4a-ba96-7cee50363157", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d01de22c-ae9a-4b51-bf9a-553cababac56", "sighting_of_ref": "indicator--4c2239ac-2479-4f46-9a50-0bca8bf828b0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38982beb-affb-423d-a3bc-5f4a4b595177", "sighting_of_ref": "indicator--4c2239ac-2479-4f46-9a50-0bca8bf828b0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7f0790d-7a35-4ced-8843-09dcb36d570f", "sighting_of_ref": "indicator--0d2bb406-be4c-485b-87ba-5303cb5ba896", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd61612d-41d9-465c-a910-fde40889c2c7", "sighting_of_ref": "indicator--0d2bb406-be4c-485b-87ba-5303cb5ba896", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61309d14-9b5f-439c-a88c-81bd9ec78959", "sighting_of_ref": "indicator--d9baa26d-49fd-4d3b-b727-2785d4015226", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6705d54-48e4-4a11-8847-b581bf071fb1", "sighting_of_ref": "indicator--d9baa26d-49fd-4d3b-b727-2785d4015226", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b1d90b0-12b7-4794-bc7f-352bf930da3f", "sighting_of_ref": "indicator--075fe4d7-0c23-4001-bc21-9001bbe7c96a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22c03d7b-8ca6-45d4-9ea1-7cedcea84ca9", "sighting_of_ref": "indicator--075fe4d7-0c23-4001-bc21-9001bbe7c96a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ea9bb92-5290-4e1a-aada-5bb1c38f96fa", "sighting_of_ref": "indicator--d4f46a2b-15ae-4e2a-b812-99ca766df61d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0ef9337-6afb-4e0e-a2eb-802891e17431", "sighting_of_ref": "indicator--d4f46a2b-15ae-4e2a-b812-99ca766df61d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adb01c49-1293-4f9e-95ec-34593f9495ba", "sighting_of_ref": "indicator--65974d96-f188-4503-b431-b22d4e9caed5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--599b71cf-4807-49fb-bd42-66ceedd91e1a", "sighting_of_ref": "indicator--65974d96-f188-4503-b431-b22d4e9caed5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--256c37c2-af56-4af1-83a6-5874154a39cc", "sighting_of_ref": "indicator--fb1d7cfc-cbd7-482f-9d9b-d7c06e1173e5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65236548-4094-4506-8e44-50492854bcd4", "sighting_of_ref": "indicator--fb1d7cfc-cbd7-482f-9d9b-d7c06e1173e5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd1376a6-5284-4365-80e9-812073cca5f9", "sighting_of_ref": "indicator--12d8f27e-d833-4fe2-82d0-727b181cfb43", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd65917c-21d7-483a-8944-aa86489ad0e7", "sighting_of_ref": "indicator--ab970d37-46e7-496b-b56e-24da95ddceff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c94185cc-ba8d-4da4-b048-63d15e657755", "sighting_of_ref": "indicator--ab970d37-46e7-496b-b56e-24da95ddceff", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c8b16c2-4013-4f20-822f-99e6a5dd838f", "sighting_of_ref": "indicator--f1280393-2cfe-42c2-a904-e51c495c7824", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21348ffb-fe9f-495b-a84c-7839fa70cb6e", "sighting_of_ref": "indicator--3b2f5d6a-61b2-426d-88c0-3067f5dec820", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6481de74-3ee5-49e8-8349-9684a4545b0a", "sighting_of_ref": "indicator--1c0c6787-bcc3-4f61-9720-7c3920933c77", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd0d75be-2589-445c-9e16-55fccb1f3af8", "sighting_of_ref": "indicator--7e130dca-d3bf-4bbf-b375-cf756df22cc7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afa8cbf1-f850-4b9b-bb93-2859f1894767", "sighting_of_ref": "indicator--a566d157-dc0b-4439-8fe5-c7fba34f4a1d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee4af780-f59a-4390-8654-1a86455191df", "sighting_of_ref": "indicator--13519a0e-a02f-4111-951d-51c206b19c27", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a62d8a8-2905-4ea4-b979-3e0b96d4d561", "sighting_of_ref": "indicator--3d15fedd-d4cd-434a-ab60-1f8e402c5bd4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1a8afef-6b01-4f8e-925f-9dd0a4df2ff3", "sighting_of_ref": "indicator--2f1304c7-a29f-4595-b8bd-7f1342dae81c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef97c462-8d2e-4132-b62c-8d86ea300a67", "sighting_of_ref": "indicator--0883f62c-c13b-4daf-84f6-25ee5959f347", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcc2ca69-2407-4091-9aea-bcffcd0694a6", "sighting_of_ref": "indicator--ffe405b8-302d-43f6-bdba-86dc2360882e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04f1576f-3301-496a-8ddd-c7625d683530", "sighting_of_ref": "indicator--d95be460-8fef-4f1e-91d5-2a4895af7b27", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aea3624-d16f-41d1-a923-58d19a731caa", "sighting_of_ref": "indicator--ac19a801-201a-4b14-a16e-e795793c416f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d549be44-b215-403c-bffd-ca00331304af", "sighting_of_ref": "indicator--8ee58868-6578-454a-b71e-6865e5ee4368", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3c73371-b69e-4594-8dc1-401169da911c", "sighting_of_ref": "indicator--b4f3b51f-eea5-423b-829f-f1fce6de4614", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb4d9122-9b21-4377-9d8f-e02fb84e4449", "sighting_of_ref": "indicator--aa344b7d-d358-418d-a2d5-493b2d885ee4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6584ef57-5c59-4e32-96f7-07b6e8d88c85", "sighting_of_ref": "indicator--61a97cd8-56d1-4414-a8d6-21ecc779ef5b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cb3930e-b3fd-4f2b-8378-26fcc08c1c9d", "sighting_of_ref": "indicator--338d431d-7e41-47e2-9d7f-7b35b44547cb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88d29cda-43cf-42b0-b608-a30cb88b7c13", "sighting_of_ref": "indicator--e52e4576-65fd-4b11-b6f5-1e33b05aab7c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59c17aa1-03d7-4780-a6fa-051eb2226785", "sighting_of_ref": "indicator--377d5769-97f1-45a8-a377-eb34175ebc9c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b213fee-1a0b-43ac-a959-4cff79c389aa", "sighting_of_ref": "indicator--377d5769-97f1-45a8-a377-eb34175ebc9c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62fcabc7-e547-4a48-9306-f49dc30cdf51", "sighting_of_ref": "indicator--354a275d-944e-43f3-84ad-f5728a87ff3b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cabebe57-b555-4a22-9e22-9265f8219e93", "sighting_of_ref": "indicator--354a275d-944e-43f3-84ad-f5728a87ff3b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54ab0f16-54ea-41d0-9510-22c739a24489", "sighting_of_ref": "indicator--252b1f85-8c44-4756-b71a-46e656ec30b3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32c0b3aa-eea9-4637-baf7-26efe4390463", "sighting_of_ref": "indicator--09ccafa1-7116-4d7d-a174-0e71548a34da", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af8a07d5-1484-4f4c-a7ee-0f5fa691d509", "sighting_of_ref": "indicator--09ccafa1-7116-4d7d-a174-0e71548a34da", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f54795f2-2469-4c24-a5a0-a8eb94d9c556", "sighting_of_ref": "indicator--d8d1730d-0148-4188-af1e-6b3d679d4799", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a38439ce-8368-47a5-afb7-f61a0e237715", "sighting_of_ref": "indicator--d8d1730d-0148-4188-af1e-6b3d679d4799", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e4dccf1-1a65-45f4-a678-3dbac3a2e5f5", "sighting_of_ref": "indicator--e58ebf49-8b50-4dab-b5d4-179a9d05d1c5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7510b85-406e-4e52-8d5b-9f4c381d07f0", "sighting_of_ref": "indicator--2dce3412-3b57-40e0-a4fc-08c6543d8dbd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22e11e85-c5a4-4273-8bf6-99aca949d3c0", "sighting_of_ref": "indicator--e898b6de-c26c-429b-8a2d-7c322d5234b3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68cce56f-fb8c-4daf-9dd3-28198bba3e56", "sighting_of_ref": "indicator--a025ce21-08e3-492f-bff1-58da0fa0715c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a9881ce-83b5-4540-9076-1a1dcadecedd", "sighting_of_ref": "indicator--d70e166e-d25c-48d6-91d6-0fd47364b59e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5736f68-284b-4756-ac73-3ee43c3261f5", "sighting_of_ref": "indicator--521f439e-7d40-4a0c-b298-f47493beb797", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5deaced7-55fc-4f12-a83b-51c418b528f4", "sighting_of_ref": "indicator--9e994ad6-0f86-4587-8a6a-58f28c0db4c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fde0c5e1-736a-41a4-acc6-4dacd04174a6", "sighting_of_ref": "indicator--9e994ad6-0f86-4587-8a6a-58f28c0db4c6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ba57474-1899-4d35-92f0-afa83c38062e", "sighting_of_ref": "indicator--63afbfe7-3701-46c7-9f1f-eb9a677fcb58", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d6fba6b-a947-4016-b352-10410da5a744", "sighting_of_ref": "indicator--b1db7a3b-9634-4196-947d-db370edb4da2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0819b5c4-7a5a-436f-85c6-4f333446d330", "sighting_of_ref": "indicator--72b722b0-b329-4ffc-914c-3f49bb0c66e7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--673dc872-5455-4ed6-af4f-67fe8bf9ea23", "sighting_of_ref": "indicator--83c65616-4788-407e-8801-412106dd98bd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41c0b0f2-aa33-4615-bfcc-a471376976e9", "sighting_of_ref": "indicator--83c65616-4788-407e-8801-412106dd98bd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3510987b-328a-48c3-941c-c5d359c0d5fe", "sighting_of_ref": "indicator--e4b1297e-fbb1-43ca-91a7-3ea6e5484df6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba02b8d0-f0a6-422f-9a6d-68992155c63c", "sighting_of_ref": "indicator--e4b1297e-fbb1-43ca-91a7-3ea6e5484df6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46a3774f-a1b3-4680-8c8a-336c1f33bd24", "sighting_of_ref": "indicator--ae214441-5de9-4661-8f4c-a337fa4aed15", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28e4ec22-5fb5-4f94-b17e-deb992bfe4e8", "sighting_of_ref": "indicator--fda3f5c9-83c0-4bee-b9c8-e82fd34ea0b8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b3a8934-62f7-48f0-beb1-23ac61ab75d0", "sighting_of_ref": "indicator--96353cd1-3d2c-4478-8d62-4910be0cf9b9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--504d0635-5fe3-4959-8d06-a337fb014a42", "sighting_of_ref": "indicator--d17a077e-d929-4fc9-8a36-20251728be99", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8711da33-822c-4afd-8bed-77d10d88e8d1", "sighting_of_ref": "indicator--ea8bed3c-ebe4-4635-8aad-0ece92d6e35c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--097802c7-0c4d-43a0-bf69-97d0c622efe0", "sighting_of_ref": "indicator--485008ea-950b-4db0-9f61-e2ed4966eb0f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9993218-b8d9-4bd2-ae9d-c8a19be2491a", "sighting_of_ref": "indicator--9df22b0d-c47a-433b-b8e7-0df368bdf582", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c33424fa-d056-40cc-afb8-3c217abcd3a7", "sighting_of_ref": "indicator--70d1b31b-45b8-4b34-9db0-109e728d8ce1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--275487f7-b9e6-4222-8370-d8a6c21376d6", "sighting_of_ref": "indicator--c3338e02-fb46-4789-992d-da8faec2ed7d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--981463f0-f152-423b-b548-97ccccbba236", "sighting_of_ref": "indicator--ee7b16b2-8460-4ddd-8967-5e3e42a35a44", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd978adf-9ad7-4369-8f9a-dd919fe11a2c", "sighting_of_ref": "indicator--41522016-a440-4579-b3f4-c59ed38461ff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3efdc96-0900-426b-b669-3354b4ac6cd0", "sighting_of_ref": "indicator--ba191ea3-30e4-49ce-8fd6-7402ab09cd41", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78243a43-aaaa-4c0b-8e22-fee5280d8e71", "sighting_of_ref": "indicator--ba191ea3-30e4-49ce-8fd6-7402ab09cd41", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ef7c708-eb82-4111-aee1-f5803f3153a0", "sighting_of_ref": "indicator--edbb2769-1c3b-46d4-8217-d4a55066acdb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2878059d-00b6-4f42-98d4-ed87447e2ed2", "sighting_of_ref": "indicator--4c13b554-e94d-4fa6-b854-3764c99d8f53", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e2b7623-2b26-43ed-9f82-8982de1d4ba5", "sighting_of_ref": "indicator--4c13b554-e94d-4fa6-b854-3764c99d8f53", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebcaaf10-426a-45a6-955c-d5437664f3b9", "sighting_of_ref": "indicator--6a4c69ca-9c96-480d-8c80-a08ad7775a8e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb5bb371-f322-49ca-ab9c-cc998f9b8a64", "sighting_of_ref": "indicator--a706fa2d-9fc8-43b0-bbb1-d4310e1f6516", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b598c9f1-4450-4ba2-a40c-1d647a5663fd", "sighting_of_ref": "indicator--bec6051d-b171-4393-a411-2ded3fb8ed97", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1e501ee-5f4e-4ce9-a86c-968113555399", "sighting_of_ref": "indicator--34d65e3b-b2eb-4fa1-972f-09c6bbc13eae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bc1deca-971e-46fb-9fa0-c62104293ece", "sighting_of_ref": "indicator--1235342a-94a6-4442-9225-f5f930435c47", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfa1c255-622b-4ca7-8dd2-5c0acc9a0a52", "sighting_of_ref": "indicator--2eaf1c71-e3d8-4f68-a8b1-261af73275ff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35130926-1319-4ec1-8ad7-4e87b176e3c4", "sighting_of_ref": "indicator--9a33cb3c-5e81-4f8a-a03b-c6d4f72da000", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c21d2b6-9580-4d93-be21-daf9027eb61b", "sighting_of_ref": "indicator--9a33cb3c-5e81-4f8a-a03b-c6d4f72da000", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f81a4705-ed9d-4f3c-a62b-3956a33e9484", "sighting_of_ref": "indicator--cc63d8af-dbb7-4cec-9163-6376045183d9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4c806a6-3a62-4051-8745-8a46791605ca", "sighting_of_ref": "indicator--cc63d8af-dbb7-4cec-9163-6376045183d9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10eba5c8-cf25-4ac8-ae80-44c68272a934", "sighting_of_ref": "indicator--ea5e095b-9921-443a-86a8-2db05f24358c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abc221c6-fbf4-4abb-ab0d-de59953e972f", "sighting_of_ref": "indicator--ea5e095b-9921-443a-86a8-2db05f24358c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53825b81-9a8b-4aba-9359-7d05f1a0d114", "sighting_of_ref": "indicator--5705f04a-4410-4045-9add-adbed55a74a5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a176ff6-24ea-4b4a-a26c-c1424701e05e", "sighting_of_ref": "indicator--24d21a57-341f-45ac-a479-5e84a50b0257", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85d808ba-2155-497c-81f1-6290fe6c33fd", "sighting_of_ref": "indicator--5425bc29-e571-4efe-9f25-ac11a1078402", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beedced1-b336-4c68-becc-9433daefae2f", "sighting_of_ref": "indicator--e845e370-b6a2-437e-868a-380dcc505c0b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adde4299-a0af-4cc6-b51c-fc971bf8b299", "sighting_of_ref": "indicator--044a5efa-13c7-4940-bd3d-51ca5addc1da", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10950372-92c7-4c28-b6b7-c9fc1f79ed84", "sighting_of_ref": "indicator--84fac8e9-f374-45f9-863c-15a356b445dd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be97e467-4b8e-4afa-aaa7-a93b561320e4", "sighting_of_ref": "indicator--468a41fe-6001-4831-bf36-f333bcd086b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76dba792-f182-45d9-8aa5-dcdde02a1e90", "sighting_of_ref": "indicator--b918f63c-d319-440b-b0ee-eed4afe577b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd0678ff-9f4c-46d5-9ff1-625d2131b0c8", "sighting_of_ref": "indicator--b39cfe8f-1d33-4901-aa6d-d4a551d47c24", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f5e2920-5847-44ac-9245-9de456236c63", "sighting_of_ref": "indicator--4237bdb3-9bc0-45cd-bc26-51b3ac52350f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17a6baee-ebb6-4abc-898b-b939e2e653ba", "sighting_of_ref": "indicator--c1bf9aa4-d680-4604-b6ec-c6b066ed2367", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6aed9d3d-d281-4527-bc02-649a5dc363e0", "sighting_of_ref": "indicator--47a0e6a6-3320-4ca3-9f70-26e9dc70a9b7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d4aa4b8-c6e8-4719-afc0-43af28668b11", "sighting_of_ref": "indicator--9857817d-2952-472c-ad0f-0ea0ff77ead2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64eb98e0-a40b-4718-a632-7a2847080aba", "sighting_of_ref": "indicator--32e92fd1-38c2-4f2d-973e-a4aadda85faf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32df3bff-0905-42ba-8ca8-8206f125f97f", "sighting_of_ref": "indicator--970bfe5c-00f4-4e95-a44d-42fdd2771570", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac8f0414-f078-4902-a8fb-93e40893bb1b", "sighting_of_ref": "indicator--b05533f9-0da8-4681-8952-b946528673fb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d19c1698-eb51-4cc2-aff1-c908fc3091fd", "sighting_of_ref": "indicator--f8c53bac-7848-4bad-b526-84011aced080", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de2787a4-cea7-4cb0-bcf3-2ebbb21645f2", "sighting_of_ref": "indicator--fa67235c-1706-4003-9628-0c468ea2c4f1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cea9622f-2a46-4b92-b2f5-c3cbeac2eb1c", "sighting_of_ref": "indicator--237fbc65-ca09-4316-9de4-b02b330b2065", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03cafa41-589d-4e6e-a6bd-38c3a4773fe6", "sighting_of_ref": "indicator--c7d5e78f-c0f6-410f-b7fb-c97177ebadb3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f5f05ae-44cb-4799-84a3-250b9f45ad0b", "sighting_of_ref": "indicator--5eef1a5d-a5a9-4880-ace6-bb47e2e1d4ad", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72854bff-b977-4c47-8533-433a5c90439d", "sighting_of_ref": "indicator--f5eba141-674c-411d-bda5-52a4d46c89f0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80423564-04dc-43f4-944f-f45859cacb61", "sighting_of_ref": "indicator--fde0ccf9-8a36-40f2-b070-6538a78e4c4a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37fc73ea-45fd-4c99-80af-2b616b5e8181", "sighting_of_ref": "indicator--34791432-d6e7-470a-ad65-6bb41a44fb0c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2169e78c-ab77-4dd7-acd1-f02c909006ea", "sighting_of_ref": "indicator--34791432-d6e7-470a-ad65-6bb41a44fb0c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f49b7ca-3bf3-46fa-8b3e-a3295acc9006", "sighting_of_ref": "indicator--1a7dd36e-b234-4590-aac8-2ada8c4318ec", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4df0d69-8430-4934-8fe3-6cb8d4887847", "sighting_of_ref": "indicator--533ffef0-c48f-493b-8e31-cfb74f8c2d3c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--477ab716-6598-4a36-9a4a-466f242bbefc", "sighting_of_ref": "indicator--368d54c4-f962-4d18-bed7-0b5288108cb4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbb17adb-2d6c-41d9-b559-f57ce5e9684e", "sighting_of_ref": "indicator--e59396d9-a254-4e3e-b5b9-7600d2451739", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0c48180-c858-4418-81f4-3b11b55b7461", "sighting_of_ref": "indicator--b231cd22-fa21-416c-b936-ebc5b8a55f53", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73cff37a-c6e3-49aa-bb4e-fb525fcb3d90", "sighting_of_ref": "indicator--6f93a9ed-02ea-46ad-943a-db5e749161b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a65c28a-d4e1-4c98-a4fb-a4ebd2f28f81", "sighting_of_ref": "indicator--3382a9aa-eeee-4ffb-a7f6-ea0bceff0558", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3fdf7c7-7401-432c-99c5-ac9c46dac70d", "sighting_of_ref": "indicator--e14ef516-f6a3-462e-935f-946972749c80", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66522968-f3f9-4791-95bc-082ad00d2590", "sighting_of_ref": "indicator--6941bfc7-b6a3-4d79-a450-6c0bf9cddc45", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d9abcc2-1eb4-4cb2-be60-3523f335a611", "sighting_of_ref": "indicator--3448c4e6-7e9e-43c6-bfaf-83d034ba9ea1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d364244-d947-4cd3-9e19-daa21d51f499", "sighting_of_ref": "indicator--28d56305-b81f-4125-a0fb-69a18c5b5558", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bacd3056-84e7-486d-b0bf-b73ab9f99fbe", "sighting_of_ref": "indicator--9e56ad94-f36d-4822-906f-555aefa15362", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00497b0d-ffa8-4989-bcb5-9c048b4ee2bf", "sighting_of_ref": "indicator--20650e22-e931-4b6d-9469-14c993718c05", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8022ea7f-0c6e-46f6-9197-bbe7dade0e6b", "sighting_of_ref": "indicator--ae9864cf-63c3-4c6e-802f-41fc28c62010", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67732ff8-99b8-4b4e-81c2-53aef322cbda", "sighting_of_ref": "indicator--875abcf3-ff62-4584-a716-3e9f40e717e7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e95463c-e033-469d-901d-9e183dad7cb4", "sighting_of_ref": "indicator--286d4f5b-cc9a-4c37-ab19-d5ea2701112d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19b52e8b-d43f-4cda-adc9-d845a802efe4", "sighting_of_ref": "indicator--398c2513-7c03-4e5a-8272-06a940c3eb06", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2273f26c-7047-4411-bafd-a136c56524df", "sighting_of_ref": "indicator--943d6563-7266-4a3a-84b8-03d4b8aee2ec", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb2df0bc-03ed-46b2-989b-d8c8c7fdb8de", "sighting_of_ref": "indicator--25317f74-ab86-462b-ae16-6c4d5222c5a7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1a8b422-f616-4814-bfa1-5775fa43cf5c", "sighting_of_ref": "indicator--d5a2f639-8f74-4720-b0e3-46b015d59d80", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2d3f44c-67be-4b30-8a22-ab203997e6d8", "sighting_of_ref": "indicator--01a57ea7-2757-4ee7-a408-76255423ba91", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cea3b86f-5e5a-425f-b1f2-f2ec7dc533d3", "sighting_of_ref": "indicator--8078e8b7-eb08-4dbc-9675-41991a22a3cd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cea5c70-63b5-4f72-ba0f-d71609fa0af4", "sighting_of_ref": "indicator--9bdef2ce-3682-4402-bfce-c6ec973e9eb9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c99008e0-5dfa-40c7-9090-7ed54848e915", "sighting_of_ref": "indicator--8e4074ea-ae78-4201-b341-ad0fc14fb509", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4608fac-7315-4194-8dfa-26e34b5e6803", "sighting_of_ref": "indicator--b1ba492d-fed5-4c65-8264-5d2302d16452", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cc49e22-0db2-4e8e-8d5d-ce776e55c87a", "sighting_of_ref": "indicator--71db581f-e1f9-4817-b568-aa9a77aa765e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65cb5c22-3c7f-4fcd-9ff9-0bc5d226bf29", "sighting_of_ref": "indicator--23d197a2-7cc8-4aa9-b238-7c615f4b7949", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be721efc-7a1d-49d1-9827-ac8ad3a440d4", "sighting_of_ref": "indicator--6d91d524-fb23-4ad7-b0a1-da68643f4840", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--561af322-9691-4c5b-9a14-b645358392f1", "sighting_of_ref": "indicator--de34277e-301a-4c5d-b2df-ed5d2cbc9dba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bc87659-baf8-4a16-b4c0-b3db87f8d2bc", "sighting_of_ref": "indicator--4eb843ce-23a6-4781-af2b-5d1dc63f921c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7910a09b-f4db-4de0-8223-085465a2069f", "sighting_of_ref": "indicator--fb70cac2-43c1-4890-b629-1355f650db22", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc063adb-2c6f-4e02-9e28-99601884c00a", "sighting_of_ref": "indicator--fb70cac2-43c1-4890-b629-1355f650db22", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6054536a-98ed-4238-85f9-9df6667921f2", "sighting_of_ref": "indicator--90f208b6-6a92-4c12-8cef-f21688931ec1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcf85519-41a5-448b-9873-a6b25ba170df", "sighting_of_ref": "indicator--507acd6a-7fbc-4b15-8570-d04b677c58b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--738e9c1a-2881-49a0-bbbe-aadcc13d4bd6", "sighting_of_ref": "indicator--1707f650-3f50-4ee5-94f7-5498f18f9624", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1694a026-4549-4ad2-b7c6-94f33d1b7771", "sighting_of_ref": "indicator--6a5e5f70-d53b-42f3-a110-23218330dfe5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--289010e9-46d9-43b2-927e-e87f053c26c2", "sighting_of_ref": "indicator--348e324b-d2e8-4b25-92b9-1e01cbd43da7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c60cb848-0808-4dde-89c2-8408b731bfdc", "sighting_of_ref": "indicator--d11fecdb-8d49-4075-8033-b197b6dd6c0e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c61db540-150c-4118-a1d6-2a42ebc1c647", "sighting_of_ref": "indicator--513b1c43-ade5-4942-8f2d-b26d8f1bcdc0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46fea95b-adbf-49cf-93ca-79d4c518af39", "sighting_of_ref": "indicator--3be79b83-673d-45d5-b0d4-59b77da9c79b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--601d509e-3420-4ea5-bf61-08a627bbce4a", "sighting_of_ref": "indicator--3be79b83-673d-45d5-b0d4-59b77da9c79b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e37565ed-fcff-4964-b1d9-69a1fb13b507", "sighting_of_ref": "indicator--d4647c96-87b4-474f-85e1-62f02b578b05", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4c2c25b-1c10-43ef-a4c1-29812000d740", "sighting_of_ref": "indicator--b828fb6f-37d1-45d5-b4a9-7709ceba8ef4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ebf95f6-4016-49f9-94bd-de1ac46598d2", "sighting_of_ref": "indicator--b2906b66-1a9c-4e53-a328-b30ffadc8110", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--239ebfd9-fbf7-446b-bc9a-78e4cb33cc68", "sighting_of_ref": "indicator--ff07c411-70fb-4086-ba55-f015f554b6b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c10f728-2d8a-437f-bfb9-473394356779", "sighting_of_ref": "indicator--64b039e9-f0e6-436d-95be-ec9b6f838063", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80ea0a49-bc32-4287-a3eb-7efe42eeec02", "sighting_of_ref": "indicator--8496e19c-f77a-4be3-bf08-553ec649757d", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abce9636-6e5a-4e0e-8460-b6ed64ee61f1", "sighting_of_ref": "indicator--f5290cfe-2b0a-4cea-84b7-b251f093b884", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63f80504-8a88-48d5-844b-0cc9251a6cd8", "sighting_of_ref": "indicator--5de75201-f674-42a0-b58b-166ba0fe3746", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6422b5c2-c2b6-4c0a-a3cf-5dd271427c2f", "sighting_of_ref": "indicator--4e2d3416-bfd6-4490-9808-60572c1f4564", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a56fd791-79b2-40ed-93e3-7f0e5f555972", "sighting_of_ref": "indicator--41af972e-2e2f-43b4-b8fe-c5fc2eed1cf1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--995990ce-f8ec-4929-a6d7-b3e932dbb8e0", "sighting_of_ref": "indicator--e4131ae0-4fa4-45bf-8f6a-690a217188bc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34be2f2a-7933-49ad-ac11-7ce9bd1d1925", "sighting_of_ref": "indicator--afc54c7e-dcf3-4030-ba38-5db0ba8149cf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9a00264-1d37-46ee-b894-7bc4fb526512", "sighting_of_ref": "indicator--e79fa6bb-42b7-4d27-b2eb-ddcc038804dc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33fd0603-3673-4278-9562-e891f6fb1fd0", "sighting_of_ref": "indicator--fe3777e4-1d23-4be2-97ce-c69b9b327a03", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe3250ad-4b43-4f78-9ae0-b1cec1bbb56c", "sighting_of_ref": "indicator--fe3777e4-1d23-4be2-97ce-c69b9b327a03", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e75f8aff-c48b-4729-aed4-0760f4c0a9d3", "sighting_of_ref": "indicator--bed8e47a-a210-4d4c-a9a5-b1bc00755990", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e926c617-1a22-4c94-904e-91d60f4f3ac4", "sighting_of_ref": "indicator--bed8e47a-a210-4d4c-a9a5-b1bc00755990", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1eecc63f-f847-42ba-9997-21fb3ecd259e", "sighting_of_ref": "indicator--c8a5d70a-c9a3-45ed-ab01-68aea1840170", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--325357c4-c242-4f16-bc3d-f7048a2e0a2f", "sighting_of_ref": "indicator--c8a5d70a-c9a3-45ed-ab01-68aea1840170", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab89ed5d-a685-42ee-934a-2b93bb40028e", "sighting_of_ref": "indicator--c5fbda0f-bd83-4b90-826a-b4d50fdbc9c0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96eb0b62-bcf8-4611-98ec-8542526b8d23", "sighting_of_ref": "indicator--f35939eb-3f40-45fb-a0c2-0767922335e7", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcef0346-2276-40bb-81eb-5014ed27c031", "sighting_of_ref": "indicator--f35939eb-3f40-45fb-a0c2-0767922335e7", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7cef240-83b2-43b4-aa74-33bf463c5fc6", "sighting_of_ref": "indicator--5cab0883-433d-493a-9d36-be5de2a88d55", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f847da46-62c5-4580-b2dc-257d0cac24e4", "sighting_of_ref": "indicator--6be30e5f-3bff-4e6c-bc20-1023fa7b1530", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f691996e-81ab-49b2-a26f-42cdcec83a37", "sighting_of_ref": "indicator--7cd963b6-d19b-4078-a189-8927384106f5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bda69d75-7363-4ef6-a9ac-1fc8e3d0e11e", "sighting_of_ref": "indicator--5f9331b8-344c-4e07-85cc-a275b1569c0c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0250f1b-9aa6-44b3-8a96-35bc3af0b802", "sighting_of_ref": "indicator--43380112-17c1-4351-86d8-70a723831585", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45f2b46e-cdd0-4222-ad13-88571b0eda0d", "sighting_of_ref": "indicator--0e42f056-34d8-4827-8057-7587a5a9982e", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09d5df59-eb29-441d-bae5-6f6b42853438", "sighting_of_ref": "indicator--0e42f056-34d8-4827-8057-7587a5a9982e", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a613fd4e-6e71-46c2-b7ff-47ef1540197a", "sighting_of_ref": "indicator--9d5e457a-f28f-4b7c-8887-49e82a1b62ac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36df4e6e-00c2-4cc2-8e7e-6f0a557799be", "sighting_of_ref": "indicator--9d5e457a-f28f-4b7c-8887-49e82a1b62ac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76472ae2-4d9e-4038-8354-ddc87ae69dd0", "sighting_of_ref": "indicator--a1904d02-c79f-426f-b370-e5b80c0292b1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f03e84c6-6109-4542-b048-b98eef005e6c", "sighting_of_ref": "indicator--9ffcc03d-c6d6-463f-bdfa-4dd2b0f01b0a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40a1a9e0-79ab-479e-a05c-272b15bf20cc", "sighting_of_ref": "indicator--a0a9777e-9d53-4af0-b145-a93bd2d8b372", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06d265d0-4d3c-4d43-9ae6-2ce35389810d", "sighting_of_ref": "indicator--b532779d-7c75-4211-8814-afa945ae5694", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2fdc5f2-35f4-4c57-9d5a-eebca6c17452", "sighting_of_ref": "indicator--18779310-88a0-481b-8c01-b068db691661", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6db98826-c2b4-4242-a476-b958cec50516", "sighting_of_ref": "indicator--7e530844-6577-4c11-8b1f-ff7a8e7dde9c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--940dfbd8-a66c-41d4-94b8-c6dae89532dd", "sighting_of_ref": "indicator--353f11d1-c56f-42aa-9f7e-3a7f12138b33", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--523e50c6-bad9-4a05-a87d-443e10dce4d9", "sighting_of_ref": "indicator--3dcd59bb-f869-4ba2-8a6b-8231b46612ac", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d07d41bc-7da6-4766-9112-04b234bacfb5", "sighting_of_ref": "indicator--af5983e6-5138-490c-a45c-56cf93bbb472", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f4a697e-648c-43c6-9fa0-d1db15634e0f", "sighting_of_ref": "indicator--606e8dc4-ff88-4a75-b6e5-7b6b23b568f8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e3153ce-0f3c-4e62-88a7-81e1b1ea414c", "sighting_of_ref": "indicator--fd340744-823e-4add-9f07-917e8a15cbab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b89995e9-70e0-4d4e-9e9f-93e5b89076d9", "sighting_of_ref": "indicator--6d6ca652-2c49-418e-b19c-22aeec9d6d26", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc8fe37a-440f-4f10-b3f7-eb2073cd59a2", "sighting_of_ref": "indicator--a1bf9ea2-b35c-4245-8fd8-5fa5d3356925", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbcfb48d-f736-4298-b8f2-d62d475f9de2", "sighting_of_ref": "indicator--6335718c-17bf-4075-9fda-3e9c9c28bbed", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96f4ff6c-902f-4d61-91ce-da22401f7fce", "sighting_of_ref": "indicator--3d3f0d7c-d314-4659-b598-c100ea937d17", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--559ebd8f-b572-4f9b-a7b2-8839ce770155", "sighting_of_ref": "indicator--71cc76a9-7ede-4d7c-a496-8bd58f3fd850", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbd0759e-007a-4e91-8a52-1ca23a678b7e", "sighting_of_ref": "indicator--30677f0a-e209-459d-9e57-02de7fd62ef4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f4efdbb-59fd-4abf-bf7e-d4a257ec76de", "sighting_of_ref": "indicator--08ef4d38-6f47-4fe4-9993-b4fe390e45a6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--798a65a3-d233-4ba2-bd26-ad446d4b6dcc", "sighting_of_ref": "indicator--185993c6-5173-48cf-a19f-568b69ada4b3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b81d16df-25df-453f-8b83-162960a9e69f", "sighting_of_ref": "indicator--1565b883-c6fc-42f1-9ec8-3a2d2283036d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44f8a3db-0aee-48d6-a733-714a34715750", "sighting_of_ref": "indicator--6555ed70-1f4b-4558-b1e8-27fc72886d56", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f9b3f5f-f3a3-4b79-a009-2b4526b8cedb", "sighting_of_ref": "indicator--3a682916-a66f-4eb0-ad7c-ad2bb5f9c63c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3ce5ca4-f19e-4904-8685-c538ba9a024b", "sighting_of_ref": "indicator--10b9ff7c-152f-4292-993e-de81d4e3a3f8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cf7c2c0-ef84-4e50-b7d6-b6d6376c7ecb", "sighting_of_ref": "indicator--8a9077cf-5f65-424b-9918-bedc6226871a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f7cdea9-aa92-46d3-a722-d59e2b6a94ee", "sighting_of_ref": "indicator--de4eeaad-8ed0-419a-8e5c-74be9301fc60", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--127ddb8e-0caf-4940-ada9-2e04912b9389", "sighting_of_ref": "indicator--77f319ce-6f06-4372-95cd-640695e2b4a6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e0b0c93-4012-434d-a7d7-72992eaab050", "sighting_of_ref": "indicator--4621b2a9-18c0-427b-90ef-4ddb2c34fcaf", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eb9a22d-3299-430e-9bfa-dd559605f5a3", "sighting_of_ref": "indicator--e3bb480a-8df7-4e3f-be41-008bcf5ee44a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1732383-ec80-4b07-aaf6-b6d17e9d555e", "sighting_of_ref": "indicator--e3bb480a-8df7-4e3f-be41-008bcf5ee44a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf98ebcc-9d0a-4001-a2f6-f163cccda62a", "sighting_of_ref": "indicator--c22dee42-9111-4b2b-8c5e-c320719644d9", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fb2ddcf-c085-43c2-96e9-cbc0db746d0a", "sighting_of_ref": "indicator--cc7cc18f-387c-405a-9ff0-63b90d45adc9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4abeb320-8359-40a3-a297-a228209bc5b2", "sighting_of_ref": "indicator--466f9a22-04b9-4f33-9d06-5b62e34572c2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b595f04-a504-49a6-a5ea-32fa7873568f", "sighting_of_ref": "indicator--466f9a22-04b9-4f33-9d06-5b62e34572c2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57aa5fee-b212-4225-9e23-a629e086edd2", "sighting_of_ref": "indicator--ecb8238e-b145-475f-9097-abc3b01008d5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e265f8a-cab8-46c2-a53c-f8e64795788d", "sighting_of_ref": "indicator--ecb8238e-b145-475f-9097-abc3b01008d5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d3901d3-736c-4979-ac09-97c889c3433b", "sighting_of_ref": "indicator--da4f13a8-4272-4e01-a869-35420d94865a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09446e86-666f-4756-9b86-016abe6c327b", "sighting_of_ref": "indicator--83163cd8-a43c-4d34-b776-bb8ca1eabc85", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b76f8519-a477-4c8b-9217-494cc9b22953", "sighting_of_ref": "indicator--2b0727ca-48f1-4bea-989b-ae4699a05f8d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3de33845-d716-456d-9b8a-3a723435496a", "sighting_of_ref": "indicator--2b0727ca-48f1-4bea-989b-ae4699a05f8d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--963c7d3a-3df6-4c4e-8d5a-ea7821538360", "sighting_of_ref": "indicator--9d551707-e70e-4dc1-a408-9c094fce5ec0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63b5c1fa-4d9b-4ef0-9e60-75b33f6640ad", "sighting_of_ref": "indicator--a426eeeb-849b-4390-bfdb-89c40b293948", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f1c954a-796f-489f-9677-903ede99b26d", "sighting_of_ref": "indicator--a426eeeb-849b-4390-bfdb-89c40b293948", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ce9b7aa-1332-42d8-af5a-afb98837d028", "sighting_of_ref": "indicator--c9fd3ad6-868f-4142-adca-b5c7b565b12b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--298bd4de-9669-4cb3-8f26-a0b1a69a7bda", "sighting_of_ref": "indicator--6e4a78b1-feec-48e4-bf07-90b3f577ee28", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--681e4262-2cea-477e-8343-72816d486f05", "sighting_of_ref": "indicator--07f814ac-f52f-4c2b-9d52-5473f4db0bf0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00f9f22f-1a52-428f-89da-5bf3556f4598", "sighting_of_ref": "indicator--cb870bb3-c054-4ef9-92bf-7f026f9183d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b37a4c6-8c58-497c-af59-dc7f6446cfba", "sighting_of_ref": "indicator--a4c0f586-49b6-4315-8822-d21d7e97b206", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6927610-4799-4b9c-8752-ee9b91f5670a", "sighting_of_ref": "indicator--7c934be5-8593-4533-bd9d-11c125ae5408", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58efbf85-3f4c-4c93-85e7-47332a26a220", "sighting_of_ref": "indicator--ac827907-bd6b-4623-8f68-62e5201ca8ec", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52c4442c-1c5b-4c8f-a845-f4a4f445caf8", "sighting_of_ref": "indicator--ac827907-bd6b-4623-8f68-62e5201ca8ec", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f41b632e-791b-4eee-a064-3a9b0bd40d23", "sighting_of_ref": "indicator--4f9c8c30-00df-403f-9b1f-23e64b73a2ce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef834677-4471-4bd6-a4fd-53f0cee0dd84", "sighting_of_ref": "indicator--4f9c8c30-00df-403f-9b1f-23e64b73a2ce", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de2a4644-bdba-4352-a015-1ebc7bebbaf2", "sighting_of_ref": "indicator--1f6aece5-96fc-42f5-bae9-1bfb4dfd9995", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b1d6b5e-bd0a-44d1-be28-2e438604b692", "sighting_of_ref": "indicator--751f7b5e-78b8-4995-867a-d55ae50c9844", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b18fdf5-839f-467b-af8a-ca9fc11f5bd9", "sighting_of_ref": "indicator--751f7b5e-78b8-4995-867a-d55ae50c9844", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78ff28e8-3d05-432a-9b01-948d0f87f130", "sighting_of_ref": "indicator--0a32b78a-db0d-4b94-be9a-82ea214f682f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb98a868-21a3-4ca5-96f4-d05e074380f7", "sighting_of_ref": "indicator--0a32b78a-db0d-4b94-be9a-82ea214f682f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f753601-0e50-4c82-b3d5-5dd219e13094", "sighting_of_ref": "indicator--fb30b8dc-10f6-4d2f-9f7d-4e552cd6c3d1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab1104da-92ba-42d6-a112-0a67c7f864e7", "sighting_of_ref": "indicator--fb30b8dc-10f6-4d2f-9f7d-4e552cd6c3d1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--718d3e54-8402-4902-8d2c-02028b9a8b96", "sighting_of_ref": "indicator--898a4367-0436-43f9-a223-81e6eb075c5e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d084b7c-ac81-40e4-ac8b-b23739b5f34b", "sighting_of_ref": "indicator--898a4367-0436-43f9-a223-81e6eb075c5e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56fce60f-c3a7-40d0-81c5-cb409ddba2d8", "sighting_of_ref": "indicator--4e01b8f5-a33c-4b1d-8554-02313b512666", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c5784ee-cc70-45eb-ab86-24efebf7d827", "sighting_of_ref": "indicator--4e01b8f5-a33c-4b1d-8554-02313b512666", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--922db138-8b65-4f73-85da-2779f76f8e9d", "sighting_of_ref": "indicator--3407e368-26c0-4200-bc0c-736bdef285b4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02f50626-4ed1-41a6-8b16-64d4a5de092e", "sighting_of_ref": "indicator--3407e368-26c0-4200-bc0c-736bdef285b4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eba7a9de-e082-417c-b9dd-a5ccdf89b0a4", "sighting_of_ref": "indicator--61f0005d-0e08-49d3-9121-42af44243844", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6737b7c4-ac1d-411d-80c0-3fc8a7cae3bf", "sighting_of_ref": "indicator--92be8578-2380-4083-b9af-ca0ba0fcd0d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc34a7e7-ff8e-457b-9789-2e77a8d62f45", "sighting_of_ref": "indicator--1b0fa374-9b15-4986-b308-3a88a191cb99", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b967f2d-44fc-4a14-a143-80f9b789d6da", "sighting_of_ref": "indicator--0a374bd8-7ce4-4cdb-9070-a4f012979b0f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0758370-63d5-4626-9673-f1e1c8c44aae", "sighting_of_ref": "indicator--15e20f8e-41be-4ab1-8505-61a043cf1eef", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e25c194-669a-45d0-b5fb-7ccba964b583", "sighting_of_ref": "indicator--15e20f8e-41be-4ab1-8505-61a043cf1eef", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a10e7eb4-0785-47d8-9a5d-48e28d4e5fba", "sighting_of_ref": "indicator--e636bfb8-a9bb-478c-a194-88a9caf71dbc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a98a39b-0c25-4cd7-9155-7acda070d060", "sighting_of_ref": "indicator--6c8e335d-3768-4912-8253-ce8abceb6fc5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dd931a7-826b-4464-bf22-84a3a6ff77b2", "sighting_of_ref": "indicator--13510a2a-4517-4b54-a1c3-a143027faef6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b2dcef2-ab02-4c49-b55f-ce3420424fdb", "sighting_of_ref": "indicator--20de7fb6-f196-4406-943d-3fd1f33628b5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--300e4ba6-8cbc-4e77-b8f4-039858bab5a7", "sighting_of_ref": "indicator--2c21faca-e138-4720-8817-dec925505591", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--962008ed-b5a6-451a-8fec-0fe791b0b765", "sighting_of_ref": "indicator--b023e351-b136-463f-aae8-e3a01ddae265", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efeb87ec-2a52-4912-8d0f-6d876f2b1240", "sighting_of_ref": "indicator--1c86e357-3003-415d-bd7e-0a0a46d22d19", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61cfbdb2-5173-482f-8fe8-d392e41b5dc3", "sighting_of_ref": "indicator--c54e8fec-24d8-4a61-9c08-e42821e3ae11", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ef75ccf-1735-4a78-ab92-253a2183ad4a", "sighting_of_ref": "indicator--fe26415c-3cba-4aca-881d-e816ed1190bb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c89967b1-5101-4f7b-97b9-773639b75b67", "sighting_of_ref": "indicator--fe26415c-3cba-4aca-881d-e816ed1190bb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f2543ba-984f-4ec1-9d3d-42feab278d46", "sighting_of_ref": "indicator--d101828d-82bf-4ace-91ee-774d3877b6b8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5f7c9fe-0304-43ce-b2e0-84a72d5ff82c", "sighting_of_ref": "indicator--e7df497a-1c31-43a6-af69-f030298e577d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--927db571-ba1c-4724-84be-9d0579916694", "sighting_of_ref": "indicator--e7df497a-1c31-43a6-af69-f030298e577d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c82d5f66-f882-45b5-bf23-7d236805d49f", "sighting_of_ref": "indicator--c37d7061-89af-4889-8858-3dc88bb1e23a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0fb9de1-de0f-44b6-a91a-6f38db59f809", "sighting_of_ref": "indicator--c37d7061-89af-4889-8858-3dc88bb1e23a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b10eadf1-720d-46ac-8799-969dc1d36dd0", "sighting_of_ref": "indicator--761233a3-db30-49ae-b67a-bc94b325743b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--177f0f33-37fb-4342-9530-214087a0a9e5", "sighting_of_ref": "indicator--761233a3-db30-49ae-b67a-bc94b325743b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21e565d1-a6e6-4c3a-baa5-2deb4125caaa", "sighting_of_ref": "indicator--bc4d65f0-3ea0-4cde-88c2-5fcaa23b461f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87ab92de-f499-4c9a-9934-ca0d98da8e41", "sighting_of_ref": "indicator--bc4d65f0-3ea0-4cde-88c2-5fcaa23b461f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae1d2c74-21fe-44ee-a1ed-61d669836bc2", "sighting_of_ref": "indicator--c9b988eb-8145-4a0c-b021-74a1459231b4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acb0df4e-53ea-4802-8e97-8ff33a836fe3", "sighting_of_ref": "indicator--fd3a8b43-0d01-466e-9feb-40f41dfcc9b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbacbb18-5ec4-4b63-b4f2-d03baca79909", "sighting_of_ref": "indicator--fd3a8b43-0d01-466e-9feb-40f41dfcc9b6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67adbf9b-cede-4ecf-8dbb-a7736961b5b3", "sighting_of_ref": "indicator--2092de39-96b3-4c9c-9ebb-d2f6284544d3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5321d19-5101-4a36-ac04-5310980e1e3d", "sighting_of_ref": "indicator--2092de39-96b3-4c9c-9ebb-d2f6284544d3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77e500ec-4124-4bd7-8ded-631c165b3a7b", "sighting_of_ref": "indicator--b28eaeb8-13c2-47e1-8646-bb75a1e35622", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6daf776d-6a9e-493a-b9a3-4fc6865509fe", "sighting_of_ref": "indicator--b28eaeb8-13c2-47e1-8646-bb75a1e35622", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4011a578-9f95-4933-95a4-eb379a4fa727", "sighting_of_ref": "indicator--c7b71e82-ab7c-408b-a513-2d91c51cb92b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f7c139c-3827-43f4-9f0b-a2fb89e42b33", "sighting_of_ref": "indicator--c7b71e82-ab7c-408b-a513-2d91c51cb92b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1751b4eb-140c-45bd-a8d4-2a7980c62793", "sighting_of_ref": "indicator--b30bf974-6310-48c6-83ba-3e82bb71b4c8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--551b2a7c-4e2e-4c79-ae41-3d711261aede", "sighting_of_ref": "indicator--b30bf974-6310-48c6-83ba-3e82bb71b4c8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f43a4bea-d4e6-45e8-88fc-24140725f0df", "sighting_of_ref": "indicator--e9eb1b6c-991e-44dd-aec0-ed0b83981acf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e8145c6-b287-45d4-91ec-c03e37c8d3dc", "sighting_of_ref": "indicator--e9eb1b6c-991e-44dd-aec0-ed0b83981acf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78a5b657-bae5-47d6-a750-7cd64add92e2", "sighting_of_ref": "indicator--051f847c-7aa4-475e-a00f-9500ed8db997", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0141749e-8bfe-4077-a55e-3db5bb242c43", "sighting_of_ref": "indicator--051f847c-7aa4-475e-a00f-9500ed8db997", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddb05eed-5832-4339-9710-592f07443d94", "sighting_of_ref": "indicator--0bedfb3d-c6df-4bf8-915e-5855dfe8824e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3431a478-d16e-40b9-b8b4-e109c79f241e", "sighting_of_ref": "indicator--0bedfb3d-c6df-4bf8-915e-5855dfe8824e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfd956a5-8303-4644-be25-ccf70f045eba", "sighting_of_ref": "indicator--757feefc-e414-40ae-a89d-3621d921f9ba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4e35f9a-cc8a-42b5-8b0a-94c4820a1fbb", "sighting_of_ref": "indicator--757feefc-e414-40ae-a89d-3621d921f9ba", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be950923-cb77-406d-98d8-01e0eb0a17e2", "sighting_of_ref": "indicator--f54ceb11-c597-4836-97aa-9f8df05933e5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09f5852c-6229-4814-b61a-6c1c7f94e67c", "sighting_of_ref": "indicator--f54ceb11-c597-4836-97aa-9f8df05933e5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eb92425-46ad-4fea-926e-8fd7451df4b4", "sighting_of_ref": "indicator--72095bdb-0939-4890-86a4-12ca42278b83", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9987a865-f032-4e11-889f-45c976c7e991", "sighting_of_ref": "indicator--ff717afd-e6ad-4579-b8e8-c2e0cbf7dc04", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ca1765a-3e93-481d-8d63-e1f1365fdc88", "sighting_of_ref": "indicator--8a5df5e8-f87f-4281-a54f-e817c581b024", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6de522c7-4dba-4ba3-8495-02d1816857df", "sighting_of_ref": "indicator--a05fe2c5-c4a7-42c8-a9d8-2f5cd9e4244a", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3df72df9-1059-42d7-8eba-f670df22db08", "sighting_of_ref": "indicator--693b18b1-f55c-45f5-917b-c96dafa8b68a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8ecf1d2-3c97-4759-b6e7-c88a47d0b5ad", "sighting_of_ref": "indicator--27925bab-4453-4cf2-abdf-5776e474becf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--854d1140-68bb-4aa7-947f-ee8ef57df315", "sighting_of_ref": "indicator--0fbd210d-d2e0-4a9e-9ae0-fe9bff02bc2b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a491f18-5cf1-4f5f-8553-31b7ee0ebba6", "sighting_of_ref": "indicator--5234521c-d93c-4499-9c85-cfb640720b2e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7418d84d-1e44-4ba1-b853-8b84eaef04f9", "sighting_of_ref": "indicator--7205bab5-96c9-4681-a03b-b7d93d63d658", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--700e503b-f636-4b05-84b4-c8873fb797f0", "sighting_of_ref": "indicator--7fda2553-87fe-42ce-94ae-1eba7b1b5950", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--842dfad5-80f0-47af-bb45-75954bed52e0", "sighting_of_ref": "indicator--899959b9-9882-477f-8d59-afd99d4fc760", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a4ad920-3d4f-4041-bc2f-21637e835d9f", "sighting_of_ref": "indicator--9cc18b46-7ddb-4aa7-8dc5-e3971b1bfeba", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8b6f416-a654-4daa-a07f-3ed35981b8dc", "sighting_of_ref": "indicator--11a18b74-6d18-4f2c-be1f-770ccbc1de28", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f76d316b-6d1a-4b51-a2ad-86a0422c76fb", "sighting_of_ref": "indicator--1859b310-e3c2-4161-94f5-97222669f9b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f668deeb-f6e9-40ce-8e75-bcc1256f85b6", "sighting_of_ref": "indicator--7280af9c-6fcd-4f83-821e-b1969bc9488d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb9abe19-c6e3-4299-a94e-4f12ae6d7eb2", "sighting_of_ref": "indicator--0bc8d39a-b168-4c2a-8457-b32acf61f996", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8df4f85c-f633-4353-9cb0-8a2391b31ab2", "sighting_of_ref": "indicator--7e9a0e1d-ad21-429d-b925-d600679c8604", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca4ec797-dd7e-4513-ae20-296f70fdf796", "sighting_of_ref": "indicator--0936f79b-2640-40f6-a7eb-384a35651970", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff087c22-1052-4b4c-a7cc-2d1b6b826528", "sighting_of_ref": "indicator--30a39ae0-7a64-49b7-bdd1-73a83ab0d589", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d59ae8b-a7f5-4b99-854c-e1e2f4a5f497", "sighting_of_ref": "indicator--b5ef40b6-a2f5-4bed-9b22-c13c07d81b0e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52b4c237-d2cf-45a3-a438-cee64da2c7cc", "sighting_of_ref": "indicator--5f0f341c-8afa-4982-ab1c-379ac16e83e7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02a95455-74e1-4482-9b3d-3bc0d4e010fd", "sighting_of_ref": "indicator--5a96756a-fb74-44a6-be45-730995e413fe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49bd93a5-2016-4c9c-bb51-5f0542034561", "sighting_of_ref": "indicator--6bfb2f91-d944-49b2-9dbb-311bea33f8b3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2a50f52-20c5-4822-9f75-d272409b8596", "sighting_of_ref": "indicator--19b4c83b-a400-4262-b24b-d9b406ba6f0c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6584819f-5d4a-4d8a-8609-c8a4e4ab09aa", "sighting_of_ref": "indicator--19b4c83b-a400-4262-b24b-d9b406ba6f0c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc00a969-d263-43d7-9995-904253535f25", "sighting_of_ref": "indicator--3f7fa2bb-8b76-406e-ba67-1ce8c179daca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b71db026-da21-4804-b59c-8636fe4e3bec", "sighting_of_ref": "indicator--77956576-3dc1-44e8-9bfa-a1b1f5feeeab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--404f422f-311a-454c-850f-a99affea6e45", "sighting_of_ref": "indicator--a64def3d-fafd-4385-ac24-05d269dca642", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4031e3f-e10b-4f45-8224-d73a25cbbc05", "sighting_of_ref": "indicator--15888acb-854f-42bc-9111-94ab00d286c3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d600407-0cbd-46ab-a96f-5582932a0f62", "sighting_of_ref": "indicator--136bdc35-a9ba-4f4c-b19b-dce8845142bc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edd6bee5-dc22-42d6-866a-236f00b252e2", "sighting_of_ref": "indicator--ef235141-0882-4f07-af88-cf4aad192a38", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--741a6290-9b85-4a24-9ecd-a10c7e3c277c", "sighting_of_ref": "indicator--f6034255-a797-4d19-9b13-9bcd1f1d1a2f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9801275e-bb11-482c-8444-4d024aff49c6", "sighting_of_ref": "indicator--b22dc229-0b8c-4dc2-aa37-c6f44ec33ead", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e887f94-8b53-40e5-a303-835a692e0b9f", "sighting_of_ref": "indicator--4e28b169-1941-4d9d-9f3c-9b9c35bb31ce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92d3e85f-28ce-40cd-9c3a-726d43ff6f36", "sighting_of_ref": "indicator--77c87022-64d4-46d0-a88f-2599210fe993", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b76de8da-9e7a-4a8c-9158-a86a878a52e9", "sighting_of_ref": "indicator--76c8682d-eb06-489f-9c48-3da3443fb1a3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c7c7463-c4f0-4557-8b31-cabccb040f63", "sighting_of_ref": "indicator--205f7ad8-0fa3-401a-bfd1-3f7f97824711", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--135d625c-8020-436d-8383-49c6fd71e66a", "sighting_of_ref": "indicator--26b5cf9e-0999-4b57-8477-528c2d91d4a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a36adaf8-d63d-46ef-969d-9919a65c4886", "sighting_of_ref": "indicator--de055a6e-781e-46e2-be46-94da3ddc406b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--868da075-7a82-4566-8eb4-ee880a6fee0a", "sighting_of_ref": "indicator--d833c44e-9d2b-4fab-bc47-4c7ebd97412f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1440a4f6-5ee0-4a72-852b-900d164cdc13", "sighting_of_ref": "indicator--5e56f304-45a6-4c03-b342-5e017ae8ba82", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--526fdfea-f1cd-466a-8935-c68b875b7a6b", "sighting_of_ref": "indicator--f6441f93-b96a-4bde-9872-b165bc7d1528", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd9e761d-ecf3-4966-ace6-cb3b43fa11ec", "sighting_of_ref": "indicator--cd5d28a0-0e68-48d8-9187-4c89f2fc63e5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9f5a25a-091f-4a6f-acd7-de4a25019e73", "sighting_of_ref": "indicator--afd4ed5b-fbff-42c7-81b2-2dc1f643fd05", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--480ec8d0-5485-4380-8a0e-1a9b2950435e", "sighting_of_ref": "indicator--3b93c95c-774b-4ade-834f-1a31a2643965", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--896554a0-2138-4dcd-ab0b-4b6423ecf0b9", "sighting_of_ref": "indicator--3eab13ef-be98-419e-9079-e9f7dc145145", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf695a87-ddb3-4000-b912-4218146ad8d1", "sighting_of_ref": "indicator--4a5f4309-f7c7-4832-95f9-e50a38ac3af8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30b8451b-da46-49aa-b1ac-3397428ce943", "sighting_of_ref": "indicator--610a5544-1edc-4fd4-bc78-97211c36c7c7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4040e081-05f0-49f7-b190-e914d6465b30", "sighting_of_ref": "indicator--d1c5a2fa-ba43-4bb3-bb33-7e24855359c0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a83f8089-04a9-4e7f-8b19-51f13989f5fd", "sighting_of_ref": "indicator--621a789d-fdc4-4ac8-a732-989820e78bf9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e889b92-a32e-48b2-8f49-73aaba384303", "sighting_of_ref": "indicator--f4ef6274-73b2-436f-bff6-f9eb8caa8680", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8398397c-40cf-4473-bd5c-533bf40486b3", "sighting_of_ref": "indicator--841e92df-7464-413f-92b2-31462bece2e0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61a0ec3a-4529-4d81-a4cb-29a135c165d5", "sighting_of_ref": "indicator--5f7091bf-5753-4019-8be8-d558e0bbdc8e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--577a7dad-eb45-42f8-9bb7-99c59cc5443b", "sighting_of_ref": "indicator--1ac9261a-042a-4f54-9923-5a31082215ef", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a391d43-e1dc-458b-9d46-d1f1431fbedd", "sighting_of_ref": "indicator--6375344e-eb21-4a82-b8fd-72d1ac0f1be5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f2a9870-3596-4a55-884f-fd08cae8366a", "sighting_of_ref": "indicator--128c5dbd-74c0-4e7f-9b1c-393bbd908f35", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--594ec68a-aa45-49de-96f6-ad31ac5221fb", "sighting_of_ref": "indicator--ccccd2f4-e056-448b-aba5-3ec96c942878", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8b839ff-924c-44fe-ad37-75a5fe601b83", "sighting_of_ref": "indicator--c5e38149-cc03-448b-9f81-75cb8fa4582a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--133a1e68-476c-4787-bedb-62fcdb774d5b", "sighting_of_ref": "indicator--4952a93f-bf9c-43a9-a6eb-c9f3336b438b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca66fe1e-21cf-400f-91f6-3123d4a811b5", "sighting_of_ref": "indicator--be93b073-ebe8-4524-b4fe-233aba136bab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca62310c-74f1-4f46-835a-6c15b831c073", "sighting_of_ref": "indicator--c16ab0c5-a7e0-4a50-b74d-46e9c9434e2d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9268125-e4ec-43c6-82cd-890b2173b994", "sighting_of_ref": "indicator--7fda945c-7fcd-4bfd-8547-3b7b756df01a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9feef238-5cd2-4ff8-b6c2-aaef74accf0e", "sighting_of_ref": "indicator--687aee26-156c-45de-a7c5-78a52fe77f92", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a78537f1-41a4-49ae-ba3f-a41f43a57f1f", "sighting_of_ref": "indicator--0455fe80-a975-4de3-a650-867287f29c59", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa3f767e-760f-49b7-9818-ca9a5909b4a5", "sighting_of_ref": "indicator--881f08d1-fe44-47e6-a499-900e88a1c64b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a79d382-8a07-436a-b992-18be17f9ace7", "sighting_of_ref": "indicator--5d115586-27b4-4a03-9479-7bdc66b5294a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--672a543f-c833-4530-87bd-3292894284b3", "sighting_of_ref": "indicator--9732ad86-cb49-4ce3-b3c7-bdee6e31db3c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faf1046c-82d2-4911-9db7-0c4869d5f21a", "sighting_of_ref": "indicator--b5cbf01b-4845-490f-adec-8a66b7b05cb3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dd647df-e9ec-4988-9873-95ff035aafd7", "sighting_of_ref": "indicator--86ec5162-230f-466c-bab9-cae200b46b8b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2860be5-dc93-4c35-9d82-a0f0ef94b59f", "sighting_of_ref": "indicator--2a9f9ecc-3c99-4614-a2f5-b040a1825f7d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5e7336b-6f02-4653-9fec-a7e39f926f47", "sighting_of_ref": "indicator--44eea611-88a1-4b7c-ae99-bffe7a984af4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c02181d5-0969-412f-a7a3-d0d5f147088c", "sighting_of_ref": "indicator--e8dc00a7-a533-4c9e-837b-4989cbbf3d71", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a7e4388-4b41-413c-8f51-518d9ada4dfc", "sighting_of_ref": "indicator--812b9ff3-2dcc-4d32-a647-9848b25bf10a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4722059-cf4c-42fe-b0c6-23501cfd1be2", "sighting_of_ref": "indicator--552262bf-e30f-425f-a52c-c5e67fdb3255", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c41bd658-567d-42be-a695-5605a2fa660b", "sighting_of_ref": "indicator--842f3f0e-a337-4d84-bbeb-2e740f51f397", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--543d8ffd-1bc6-4334-b393-c18311c7cb44", "sighting_of_ref": "indicator--4866e506-f7df-44b6-b6ed-6c4cb1159304", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94eb55b7-e3af-441c-8ae0-d7889c0f653a", "sighting_of_ref": "indicator--c665ce33-6de7-4f3a-a61d-7b651046e600", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc8fe35d-144c-4318-b15a-ad36d9970c18", "sighting_of_ref": "indicator--8d882a41-b308-4a8e-9a2f-d526bc399207", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--def45b60-e0ff-4ef7-8e41-baf1a4022f08", "sighting_of_ref": "indicator--ecf81182-6fb7-465f-ab2f-8caa9552d175", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5571cfed-3cac-4346-84d5-899b70873a5b", "sighting_of_ref": "indicator--8be05856-36f2-4849-8ee4-8753197d0584", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26f6064c-9cab-4ec8-9d20-460f64a9d9b2", "sighting_of_ref": "indicator--2f7baec0-9eca-4b34-ae97-d4d59bc9c77e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40ad6394-ec42-489c-a444-95eefb0edffc", "sighting_of_ref": "indicator--39cbb1fc-a62d-4bec-b471-964b50bb1880", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd6ffeb8-097f-495f-871b-4fdcc757f879", "sighting_of_ref": "indicator--4126a76b-1b45-4343-8224-462272bb5b5b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bcf36f4-338d-4726-a0ce-1a6867903e83", "sighting_of_ref": "indicator--83c0b2f9-0353-46ef-8379-2fa67af0e162", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38913654-9152-47d1-b191-169ee389ef31", "sighting_of_ref": "indicator--a5872d07-050f-4025-9998-1622df34ef3f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16ad4947-cacb-46b3-b7b7-d07a5231e4ec", "sighting_of_ref": "indicator--e7a86871-2dec-48c8-b809-7d00c2083808", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--670f04b6-efcd-4428-a1ed-2888118bb312", "sighting_of_ref": "indicator--9748ac0a-34be-41af-a13e-ef4a0e019b2f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75d3453a-300f-448b-82b2-0337a3fd5c6b", "sighting_of_ref": "indicator--877d0a2d-0b36-40e2-baf7-f2c4c0ee8919", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96095c07-7e81-441f-980c-1b214b6bbac2", "sighting_of_ref": "indicator--4593f5fd-c566-400b-9e2d-909261c56f4f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66f6570a-875c-4972-ae6c-8b87a88119b6", "sighting_of_ref": "indicator--3e8f518f-335d-435e-97a6-ba90cbf7d682", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df69e8b5-284c-485e-999d-eb1577c5a60b", "sighting_of_ref": "indicator--f09d0a00-65e4-410f-831f-91d14bcf8590", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4abe8909-895f-4f2b-bfbd-71281962720a", "sighting_of_ref": "indicator--1ad82a20-d101-4cf8-bac0-876f2c48e5c6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8f95298-bb71-45ca-8746-a03ab8863803", "sighting_of_ref": "indicator--1ad82a20-d101-4cf8-bac0-876f2c48e5c6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cdf9026-e87f-4055-8ecb-2bc07b58cb95", "sighting_of_ref": "indicator--1e9cfaac-8655-4885-9f14-b80c084f3497", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e5b9bb5-3d9a-4e90-b54e-b4af2d53b9a1", "sighting_of_ref": "indicator--2b85444a-a6ac-4e1e-a706-d947cb2b1102", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e71476a8-8dea-45c4-8190-5304b2a6c501", "sighting_of_ref": "indicator--2b85444a-a6ac-4e1e-a706-d947cb2b1102", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ad4f763-9f6f-4e41-a517-f1fc909b3e1b", "sighting_of_ref": "indicator--7b086658-95c2-4371-b3f5-504860578452", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d1771ef-5cad-41ee-bd01-a6e887f0f170", "sighting_of_ref": "indicator--7b086658-95c2-4371-b3f5-504860578452", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--837e5e51-1af8-44a8-824d-621d54c234b2", "sighting_of_ref": "indicator--13ac4d61-24ce-4bde-9d87-4f0cc96a593b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9056fd3-bcee-4bd6-8aeb-4d5a07c9784e", "sighting_of_ref": "indicator--13ac4d61-24ce-4bde-9d87-4f0cc96a593b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d76d3fb9-7db1-4a3a-8723-dc4a15618382", "sighting_of_ref": "indicator--679252ab-3d4c-46ac-bbc1-5a87a68a76c1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d958746-810a-4f7d-b709-f2c2b207a948", "sighting_of_ref": "indicator--c837e305-38c2-48ec-93d7-9e065ef186dc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fd6dce3-5016-424a-839d-8e784a079a52", "sighting_of_ref": "indicator--28612105-3519-4043-ae10-37880cb52029", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8317dc1f-c709-4508-ba08-d5a4cf156e7a", "sighting_of_ref": "indicator--28612105-3519-4043-ae10-37880cb52029", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e9416a6-ed8f-4631-a8aa-784594f827ce", "sighting_of_ref": "indicator--28612105-3519-4043-ae10-37880cb52029", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01a80e21-542d-421e-9342-f520a2bac54f", "sighting_of_ref": "indicator--017720cd-6337-4bd0-a42b-3acde46f14bd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f0ba80a-ea64-46b4-8e73-89f803c36c41", "sighting_of_ref": "indicator--017720cd-6337-4bd0-a42b-3acde46f14bd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a6942df-670f-48a8-9fbf-c03543b5f3d7", "sighting_of_ref": "indicator--017720cd-6337-4bd0-a42b-3acde46f14bd", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ff9f708-392a-471f-8944-d2e4ea386eeb", "sighting_of_ref": "indicator--e30f0b6b-202f-4ca3-9bdc-52a4f7639895", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--068e1820-2faa-4c01-bef5-857bb6ace70d", "sighting_of_ref": "indicator--e30f0b6b-202f-4ca3-9bdc-52a4f7639895", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53d6870b-f1a5-466f-8765-2a116c506fe0", "sighting_of_ref": "indicator--e30f0b6b-202f-4ca3-9bdc-52a4f7639895", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dea2729f-6a11-40c2-8d02-f4b7f0bebfbb", "sighting_of_ref": "indicator--21d71e34-3763-49b1-8872-d1f2e47bc26e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--571edd0b-cc4b-4448-b6e1-6e495272fd4d", "sighting_of_ref": "indicator--21d71e34-3763-49b1-8872-d1f2e47bc26e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b42a0e4f-8470-40d2-8f86-e244fe1db4f2", "sighting_of_ref": "indicator--21d71e34-3763-49b1-8872-d1f2e47bc26e", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4abbf69c-ea23-4189-b1a4-18f992c941c8", "sighting_of_ref": "indicator--ad1aba45-936e-45a1-8f33-6c379b210fe4", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6696f5af-424d-477d-a8a0-fe76f5fd14bf", "sighting_of_ref": "indicator--ad1aba45-936e-45a1-8f33-6c379b210fe4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43415129-6e97-43f7-943b-167b3a68c7c3", "sighting_of_ref": "indicator--ad1aba45-936e-45a1-8f33-6c379b210fe4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a680f86-3d50-4afb-8aed-ad4bd7991025", "sighting_of_ref": "indicator--30ec6769-7a23-401e-8a2e-de96cd6f7be1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd6ec52d-5066-4022-88b5-a81bb1dfd2a0", "sighting_of_ref": "indicator--30ec6769-7a23-401e-8a2e-de96cd6f7be1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba4bf80e-fcfb-4582-8d73-390da247496e", "sighting_of_ref": "indicator--8a549b5c-e633-4c35-9ef3-e02a96df7078", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a49a5cd6-ed20-478a-8efe-cf9814fc7211", "sighting_of_ref": "indicator--8a549b5c-e633-4c35-9ef3-e02a96df7078", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--954a213d-e8ef-414c-90e6-421cde86c63f", "sighting_of_ref": "indicator--8a549b5c-e633-4c35-9ef3-e02a96df7078", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2fd7672-6aa3-4f26-98da-b427aedb73ae", "sighting_of_ref": "indicator--9118491c-3545-495f-89d8-e74ae74e4cd7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--328dd1e9-65d5-4fb8-9d4b-a3dd6c7a8400", "sighting_of_ref": "indicator--9118491c-3545-495f-89d8-e74ae74e4cd7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb88f85c-7433-4996-87ff-0ee599d8f0f4", "sighting_of_ref": "indicator--9118491c-3545-495f-89d8-e74ae74e4cd7", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2259974a-c0b5-462d-99d6-26a89c3b3d12", "sighting_of_ref": "indicator--8c896c45-e9ef-4a1b-9f10-345ede57c862", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc52c6ea-4f2d-4f8c-abc0-ce92fca03530", "sighting_of_ref": "indicator--8c896c45-e9ef-4a1b-9f10-345ede57c862", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba7ddd41-fd03-4e07-a7ad-f7911808276d", "sighting_of_ref": "indicator--fa9ac5a8-66a2-4cb9-90ea-2072590deb7c", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fff2f543-3b83-4bea-87a8-a4396f0cb356", "sighting_of_ref": "indicator--cbfcb5df-c19b-4a38-8973-6e11842ba1c1", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6817eb9-d7a4-4586-9a21-c79536ef55cb", "sighting_of_ref": "indicator--e8b4c6bb-5937-4f0c-9bd0-7fbfc9470427", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbde26a9-3043-432e-b44d-37d1f99fa1a2", "sighting_of_ref": "indicator--e8b4c6bb-5937-4f0c-9bd0-7fbfc9470427", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1adf0298-5250-4d4a-85ee-3a9ede9bfe36", "sighting_of_ref": "indicator--e8b4c6bb-5937-4f0c-9bd0-7fbfc9470427", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28d7a731-9818-4f84-8eee-f9da3c92989c", "sighting_of_ref": "indicator--af372c6c-987b-4f87-a8ea-f19330e9d878", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57cb8225-c3e1-42b8-89da-1d170564b3b7", "sighting_of_ref": "indicator--af372c6c-987b-4f87-a8ea-f19330e9d878", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6780850-3b21-4777-b46b-c7b3cd006ca5", "sighting_of_ref": "indicator--e3c55dab-9a8c-4d80-a812-497f502c04e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6aea4da-5a42-42d7-9ffc-9b248060e5dd", "sighting_of_ref": "indicator--e3c55dab-9a8c-4d80-a812-497f502c04e1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3510351-5e63-4f4f-aa42-2d1e9e31025a", "sighting_of_ref": "indicator--358cbd3f-9684-4f82-b35e-ce26affa50ff", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53ccc7ae-5bf7-4c7b-be2b-7bb5a5b79987", "sighting_of_ref": "indicator--358cbd3f-9684-4f82-b35e-ce26affa50ff", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67599d3e-1dca-469b-a955-555f4e2cd6c2", "sighting_of_ref": "indicator--36a74141-c2b6-4a7b-80fc-879251237939", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b890f638-6a84-4a62-a09e-963487ed6ba8", "sighting_of_ref": "indicator--36a74141-c2b6-4a7b-80fc-879251237939", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e208b7e4-9086-4b93-b732-babed729f144", "sighting_of_ref": "indicator--6d90ea7d-76b7-4538-9c80-731ab832cff6", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--973305c6-a432-4796-8a4f-4e3c95645b9d", "sighting_of_ref": "indicator--a1bdf1fa-faae-4400-ace9-badc8e88d15c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f42214f-f242-46ac-a6ea-2b0ac5eb37d5", "sighting_of_ref": "indicator--efd7c2ee-80fd-42bd-ba39-6de1299e6712", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54affae4-0f93-4d66-82c8-7f230846942c", "sighting_of_ref": "indicator--e7e1eaa3-2774-41c0-b090-9b71ec0ff13c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a67e261-5ae1-42c4-93b3-999b4e78d152", "sighting_of_ref": "indicator--8d630f2b-1ab8-466b-ac08-c38d7d963cbd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b4edb9b-e2fb-439e-859e-d2057bd017ba", "sighting_of_ref": "indicator--d670bf9a-95d1-454c-96e3-e17398fa95ca", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--796defad-a552-4d95-8266-bb36008db77a", "sighting_of_ref": "indicator--4cdfc9e9-468a-4f7a-9ec7-19812d73a090", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a887ae9-d0b3-44c5-8626-98327d6f09fe", "sighting_of_ref": "indicator--4cdfc9e9-468a-4f7a-9ec7-19812d73a090", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd66e985-60e3-4e7f-8ec1-8f918650f77a", "sighting_of_ref": "indicator--c8e35cbf-4432-4b84-9cff-88e9ea36d3db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--692f2deb-8371-4ff7-861e-f3eb4e497613", "sighting_of_ref": "indicator--c87c47a7-9a65-47a1-a4bc-c3a35f025ea6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e1f2ba3-5f64-48e9-a222-80335e94834d", "sighting_of_ref": "indicator--c87c47a7-9a65-47a1-a4bc-c3a35f025ea6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db14bbb3-efa1-44e0-a170-da34f60e689d", "sighting_of_ref": "indicator--759e51db-d1c8-4b91-bb7b-3c1ac45dcd6f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--459fb78f-3f55-49d0-a488-526437d8ca00", "sighting_of_ref": "indicator--759e51db-d1c8-4b91-bb7b-3c1ac45dcd6f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df0a7d23-38cc-4af9-a9e8-10166cf7d4b0", "sighting_of_ref": "indicator--247f5453-69be-46b0-b0bf-8c173aa28768", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72a91906-68a2-415f-b923-8043a39a16d9", "sighting_of_ref": "indicator--247f5453-69be-46b0-b0bf-8c173aa28768", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3533e4e-b8c7-457e-a54b-0011d47e4ea4", "sighting_of_ref": "indicator--a901b6c2-03d4-4040-8761-e2a463f7fbd3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8605368a-f82c-4a2d-a951-d1ae4de14ce7", "sighting_of_ref": "indicator--f0b952a2-3fdf-4509-9d40-7fd300b996fa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd0a3f6b-c4fa-4fd4-bd1d-7c301b2ceb28", "sighting_of_ref": "indicator--f0b952a2-3fdf-4509-9d40-7fd300b996fa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a1d6c4c-6ec4-4998-89c9-66b0f00724c8", "sighting_of_ref": "indicator--4e1750d4-03d5-4af0-bd1c-7db6e302e506", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27f0de04-251b-48f4-9ba9-58afd4fa3fa3", "sighting_of_ref": "indicator--4e1750d4-03d5-4af0-bd1c-7db6e302e506", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--585b8880-93f4-4d61-9951-f888bd7370d7", "sighting_of_ref": "indicator--edc2cf0b-1026-47f7-aec1-d9608a00b8c0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a26d18d-612a-425e-9d85-2bc7ec0b3ac9", "sighting_of_ref": "indicator--b84842a9-a3c9-4756-9c8a-14b39cb3fc24", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffd0dc86-7839-4c0c-b819-d4537b6192e7", "sighting_of_ref": "indicator--787e5470-76c5-4dec-b34e-2abe294cca77", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1eefe01-8196-4b48-965b-227dd896a65e", "sighting_of_ref": "indicator--a00edeb0-af2e-49f8-953f-2f6bf920bd0c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5f37672-e539-4d84-8039-52a6579683dc", "sighting_of_ref": "indicator--27834796-57e7-4e8f-aacc-e21a17a90ef3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--647303a6-92d4-46ac-80d9-9f8a65ce719e", "sighting_of_ref": "indicator--6c8d7ceb-ff1d-4130-9e9d-cbfa7bacffed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25250522-01af-45cd-b76f-d9bbb372718a", "sighting_of_ref": "indicator--6c8d7ceb-ff1d-4130-9e9d-cbfa7bacffed", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8eaf674-89d6-4c38-81fd-cab8ff2ff500", "sighting_of_ref": "indicator--a0ee727a-8596-440c-ae29-2ecaa0ea7633", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4f080a0-9041-46d9-bf10-419fff61d409", "sighting_of_ref": "indicator--f661a781-9c0e-4974-b574-69e4fdd996a5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91c146b9-ec60-4478-93d9-6b06389748bb", "sighting_of_ref": "indicator--f661a781-9c0e-4974-b574-69e4fdd996a5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6dc3210-f311-4f2d-8bd2-6ecf21938b89", "sighting_of_ref": "indicator--30da26b1-1ef1-4354-a6ca-b0eb9f104815", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ef7da69-56ef-42c7-b351-ccfc7e2ec293", "sighting_of_ref": "indicator--30da26b1-1ef1-4354-a6ca-b0eb9f104815", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf93e879-7993-48e9-bcc0-0e511cf53632", "sighting_of_ref": "indicator--1d039686-9c78-43f9-b38d-ee4ba65e91e4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a742bb6-cf61-49b5-95ef-e3b088b9d2d4", "sighting_of_ref": "indicator--c15f4379-a383-4500-a713-336497f51685", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bdbdd83-f946-4847-8722-a4089bb57aea", "sighting_of_ref": "indicator--31c2d0e4-526d-45a9-b437-bb3e9806c3c2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dec95aac-1182-4783-abf2-1715e534df82", "sighting_of_ref": "indicator--31c2d0e4-526d-45a9-b437-bb3e9806c3c2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e4b9d5d-f966-4ba2-a862-a1f61eab6449", "sighting_of_ref": "indicator--a0d198cf-2dde-46c3-ba51-9b885f90d4e5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2670f785-5d31-4eba-a084-0071e7ccc501", "sighting_of_ref": "indicator--a0d198cf-2dde-46c3-ba51-9b885f90d4e5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--574d5ac4-bd29-4aaf-92f2-be71d8e3e993", "sighting_of_ref": "indicator--a4a52507-b0c9-43ee-a468-f269709d325f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5878dd2e-69b7-40ae-b4f9-dada60f92ec2", "sighting_of_ref": "indicator--de586cbd-11c4-48bf-b743-c715df7384fb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f0794c4-2aab-4651-b433-7b80253c1354", "sighting_of_ref": "indicator--de586cbd-11c4-48bf-b743-c715df7384fb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14896460-9035-4237-955a-0ddfb5fdb122", "sighting_of_ref": "indicator--eb905c68-cd99-4fbf-bedd-1f35fee6e0cb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31009ce3-47b5-4d4a-9145-674406592f56", "sighting_of_ref": "indicator--eb905c68-cd99-4fbf-bedd-1f35fee6e0cb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e650b8b-bbf4-48d5-bf7b-6dc05a647ea7", "sighting_of_ref": "indicator--3ae4d162-de9a-41ec-91a6-d1d0d0707160", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eb7eff8-2f27-4d83-beae-136dc89a31a9", "sighting_of_ref": "indicator--0a42b3ca-7e0e-4059-8ef6-087bd57b7e91", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96489c81-44fb-493d-b948-1c3562ed3ec0", "sighting_of_ref": "indicator--06b69e5d-7d55-4020-83b3-31e2285325c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27a3ae2a-285a-425a-adb3-2b817dcc5e34", "sighting_of_ref": "indicator--06b69e5d-7d55-4020-83b3-31e2285325c4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec82c688-2ce1-4d03-81e8-7fd1aaff44e6", "sighting_of_ref": "indicator--26a13a40-2bc5-4471-ae07-963f5d3a0f1f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c50d97f2-335f-48b2-97f2-ddfe7e5e055c", "sighting_of_ref": "indicator--26a13a40-2bc5-4471-ae07-963f5d3a0f1f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--defccd58-436f-453d-9f5f-23809f15d0d3", "sighting_of_ref": "indicator--c7b0ed45-c18a-4f9f-b7d5-2c712db442be", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51791a25-864f-4b70-a1ed-232097743ef9", "sighting_of_ref": "indicator--054e9269-3a25-4c02-870b-f91b2cd034c3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fc4fc87-f427-4055-a0db-dedf4e9e0195", "sighting_of_ref": "indicator--054e9269-3a25-4c02-870b-f91b2cd034c3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63592685-83b0-4384-8371-ce0a3ecf27b2", "sighting_of_ref": "indicator--c9bb2fd3-2f68-49a8-9199-75c90adee955", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a015b32-abb2-4d12-8771-aa6671770189", "sighting_of_ref": "indicator--8eefc1a7-ebc9-49f5-af98-539cd1a5a953", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c688019-ed74-4d3f-a7a8-29c9e30b8899", "sighting_of_ref": "indicator--a61db3b2-1b86-4854-8e8d-e9b39833bf86", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b171ffb6-70ea-4d7c-9605-7b13a00d3273", "sighting_of_ref": "indicator--a61db3b2-1b86-4854-8e8d-e9b39833bf86", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc5fde4f-e710-4fef-8ef5-77fda38c6a55", "sighting_of_ref": "indicator--f753ad74-144b-4e5f-9cfb-8ec418e4d26f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6f06383-826e-4fdc-a9b3-c7044b9cded4", "sighting_of_ref": "indicator--f6fc6822-63ed-45d0-8021-6b4c67dcd40f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f36d222-9db8-483d-9706-bc13cbee346c", "sighting_of_ref": "indicator--8d874103-da06-471f-97a7-bde083957bc8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09c23ac4-98e2-4273-9ca5-0d09c48477a4", "sighting_of_ref": "indicator--134a22b6-482d-400a-85d2-3c7dafd49f11", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86d2a669-5c28-4388-8bde-aa2e3efb7928", "sighting_of_ref": "indicator--9879504f-b564-45e5-ae61-eef8e5d9ebbc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b1ed7c5-bee7-40ce-991c-21b3b5d72e32", "sighting_of_ref": "indicator--0e79bef3-93ed-4b40-bc1d-08c4cb89e5c1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8622b437-7ee2-4605-adca-9e93059f74d6", "sighting_of_ref": "indicator--6520e377-8e8f-4206-a0bc-c7089e477fa1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00aaf8d8-4572-4635-9ee1-bce2bcac85d2", "sighting_of_ref": "indicator--15e31c0c-2cec-4ca9-bcc2-254ce0bd3144", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c2200c2-dc3d-4aa4-bafc-5dc903e08d02", "sighting_of_ref": "indicator--e6a24f48-ef2a-4fa3-bcde-d4bc168f6fa3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ba61f2d-ec43-4445-8b4c-5ff33780e1a2", "sighting_of_ref": "indicator--7af0edbc-a941-463b-bce1-fbba9902b025", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a669b8e7-0047-4758-8e68-f6a8569201ae", "sighting_of_ref": "indicator--ae04c7fe-fdcb-4760-9d93-c908de8b5de5", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12cb62d2-6f20-48af-87d2-fe3ea00d19d3", "sighting_of_ref": "indicator--7c5bc298-95d1-4624-99fe-138477cc6031", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2dd8762-9732-4a7b-81b0-fe2fb868f19e", "sighting_of_ref": "indicator--7365ec0e-01ec-44a7-a6d5-6728aa892cd6", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7397cfd3-eaa8-4798-bdac-cd523c5b30ac", "sighting_of_ref": "indicator--dacd001b-7803-499b-982d-eacd61818fa9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--719cbd59-8d35-485f-b25c-ea2d2dd1a380", "sighting_of_ref": "indicator--92614552-d959-4ad7-bf04-76b6cd557fe2", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--facb0a41-da85-4aea-b529-e6a826e17139", "sighting_of_ref": "indicator--32189ba1-7f8d-4d63-9d82-4915d151d0d7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e53f74fe-8069-4cbd-814a-1b4f0ad968c6", "sighting_of_ref": "indicator--47faa61b-83b3-44fc-b5d0-a27c1b728469", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7b73567-edb7-4ad5-a07d-09bf5d33a0cf", "sighting_of_ref": "indicator--29b51828-9f8f-4f99-b7b7-25ad58b6e920", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6840fecc-33fe-49e2-8eae-25e518af5c73", "sighting_of_ref": "indicator--29b51828-9f8f-4f99-b7b7-25ad58b6e920", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3410d854-8aa4-4a0c-b78f-2f3c5b65b2d2", "sighting_of_ref": "indicator--9b4dd6e0-f27c-4d15-99d5-e247215f9f6e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--207c9e11-a7a6-43a3-ba15-fbded30447dd", "sighting_of_ref": "indicator--53fe4077-eeb0-47c4-8226-1f492a20815d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abcaee1c-66aa-4261-94e2-7c76898faa8f", "sighting_of_ref": "indicator--53fe4077-eeb0-47c4-8226-1f492a20815d", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68acc6f8-17d3-46c1-a098-3dca9b77d17c", "sighting_of_ref": "indicator--641abc2b-f76e-4ad8-94f9-880cf27a32fe", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ffef71b-bcf2-4f1f-8620-7deb3c40c377", "sighting_of_ref": "indicator--564aa57c-1813-4b2a-955c-9e0055e3b28c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdaedbd4-9ed9-45d6-9c40-48f6da2617f2", "sighting_of_ref": "indicator--55debbef-1270-4565-a983-d2b0f0078ffc", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--945f5bbc-d057-4a51-994c-0d07e1c54c2f", "sighting_of_ref": "indicator--53591e88-1d9c-4894-95df-bc7acc5230ad", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86d12afc-3803-4e41-8152-f392b02e7707", "sighting_of_ref": "indicator--fa0de050-49af-4112-8a55-ff28759b5ca0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4ac4415-9471-41a4-89bb-472b0f756894", "sighting_of_ref": "indicator--fa0de050-49af-4112-8a55-ff28759b5ca0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a7a5238-043b-45b1-8024-b47d092ffad7", "sighting_of_ref": "indicator--87d19749-fdc3-4aa3-b2d4-5648da80fc37", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0e9a6fa-51ac-4ec2-8e08-632c425535c9", "sighting_of_ref": "indicator--94b11708-9915-49d6-b466-ada67aacd008", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1421b711-576f-41c0-9bd3-8bdf9964f645", "sighting_of_ref": "indicator--85db5294-00ec-4677-adcb-ed5d89571234", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3e7c6fe-548f-4080-8be2-7d0e649b75aa", "sighting_of_ref": "indicator--85db5294-00ec-4677-adcb-ed5d89571234", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77b0fb0f-2bb9-4437-8d13-68f5f28ef7a9", "sighting_of_ref": "indicator--f6d6fa97-e7b1-47cd-82f4-aebbc5f4da77", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19ac0852-9c88-491a-a49b-c7f2a16c3c8d", "sighting_of_ref": "indicator--0c38b7d2-570d-4c1d-b440-75e9c6a06a34", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1429c433-db5e-4a74-a9cf-49d9dbe40dc3", "sighting_of_ref": "indicator--0c38b7d2-570d-4c1d-b440-75e9c6a06a34", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9a32ae9-f9e9-4ab9-a954-a171f3a80fa1", "sighting_of_ref": "indicator--9738d205-0a6d-4e51-8aeb-330f66fb7777", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acc6ffdd-cfb1-4558-8aa0-b74f52965d93", "sighting_of_ref": "indicator--9738d205-0a6d-4e51-8aeb-330f66fb7777", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84fc1f0e-1144-494a-aaac-fa9eb1bbbb0a", "sighting_of_ref": "indicator--9ce52dac-9e36-4cfb-b9d9-34937d18972e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab9c78a5-e317-4d85-b4aa-5c69dda7b08f", "sighting_of_ref": "indicator--de23a4f3-002d-4fdf-9128-edecd4b9377a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02df90d8-b9ec-4fd8-bfd1-03841ee9c2a8", "sighting_of_ref": "indicator--37d1e6a9-2449-40c6-87d4-43b8f23296c3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f4fbe0f-9386-4d00-bd63-c95fa2764ea4", "sighting_of_ref": "indicator--e1cee7cd-afd1-4d75-bd4a-1d5bbbb10137", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a66370e-89f5-403f-9526-603e269c84d3", "sighting_of_ref": "indicator--3e38bcfd-2c73-49b8-a5db-62aaae872e6a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--513311e0-94b5-47d8-a5d1-33b0ed165585", "sighting_of_ref": "indicator--d2cbad84-e817-4553-8ef9-74f1245ead76", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec577da3-ef0e-4f16-9ea6-04592860a2c0", "sighting_of_ref": "indicator--cf9cfa80-995a-4594-beb0-e260a556f961", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d973da7f-7c5a-466a-9a2e-f7b857a3ec0d", "sighting_of_ref": "indicator--11540a4a-1c83-4f9f-83f5-29b9eeb3fd2c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ee460e4-4e71-4a6f-bc2a-ea7c01ecbf26", "sighting_of_ref": "indicator--bed32624-6393-4ff3-a52d-bc8cbe29681c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74036467-aa8b-4925-bddf-cfb9cb9e150e", "sighting_of_ref": "indicator--4a5376db-1598-4110-95d0-7dc4f5f8ce44", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5383e09e-d078-420c-aca3-0e165843f21a", "sighting_of_ref": "indicator--bd9b993e-d70b-489a-931f-1d8fed61ca63", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0383f17b-9028-4964-bb27-11afdf14c844", "sighting_of_ref": "indicator--578c283d-2c50-4880-9790-07354ba6059d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b74883ec-df33-4660-9452-be8acf1d3ec4", "sighting_of_ref": "indicator--b3eb51e3-9541-4fab-a5d9-ae36e4821619", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ed2e13b-608c-4944-9c82-57cbdba8ad6d", "sighting_of_ref": "indicator--5e1816b5-4f66-4f96-8110-fe3e489ac2a0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea4de900-4da0-422e-b81d-da20eb1568c2", "sighting_of_ref": "indicator--73234575-3ed2-4a1b-96af-73e19f5028b8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1fb30c4-1e61-4b3c-8191-508206433711", "sighting_of_ref": "indicator--a58685eb-45fb-400c-8ad8-4946964e0ed7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08f1b0e0-3b82-45e0-a09b-a7763262ed5f", "sighting_of_ref": "indicator--a6c73366-c2f3-4a92-9169-aeb83313d3ba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5890c798-46aa-40cb-9e40-3db2f6c433c5", "sighting_of_ref": "indicator--16eabc71-66dc-40f2-9855-08a4aee088a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--064d1909-6369-4d64-ab34-8ea458218ee0", "sighting_of_ref": "indicator--92e2d36b-89f1-42fb-955e-d59862cf97eb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39bdadd6-4775-48f9-ad47-6f47abfda717", "sighting_of_ref": "indicator--676a2cc3-670b-49fe-830e-633ff8058c34", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e361b8a-c87e-4ccc-8a16-ae6e01793abc", "sighting_of_ref": "indicator--97e4a6f4-c030-4a04-8b5a-c64449a6c348", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f6669b7-7762-4e35-b4a5-8e4f62e435bf", "sighting_of_ref": "indicator--05973f5d-f536-4ad7-8876-d79c2e827063", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7aad87c-14b4-4a77-b45f-93128bd2c1c4", "sighting_of_ref": "indicator--1301d1be-044a-498b-b8e8-27128cc39597", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--064bb2c4-5ab2-40f7-87b7-086401345b05", "sighting_of_ref": "indicator--1c44a614-863f-4e96-a996-16030b581a40", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf7509b8-637b-402b-8cc5-d866d6adef55", "sighting_of_ref": "indicator--332c14e4-9b34-4a40-b5a4-b9b8aa6e41ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06c957db-c754-4b4d-9f77-e5b5fe62c60c", "sighting_of_ref": "indicator--d189775c-1663-4165-81be-0159d84beb43", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cb4c586-64ef-49c3-a078-0ad98ac52b97", "sighting_of_ref": "indicator--a11bc446-8da7-4c2e-9da4-06d004647ded", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50e96e98-c81f-4d4b-aa69-c9ed71b45085", "sighting_of_ref": "indicator--dd9140da-a24e-409c-89d3-f3c7681f190d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c4471dd-9944-47d2-9446-65fb030a987b", "sighting_of_ref": "indicator--dd9140da-a24e-409c-89d3-f3c7681f190d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73976713-b4a0-4527-99c1-018120a0855c", "sighting_of_ref": "indicator--c6e993fa-8f2b-4f5a-bc10-bf20c40795e7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4061e5d8-c82f-4085-8fc4-8d5fe08dd147", "sighting_of_ref": "indicator--33572c60-5415-4d39-a32f-ef6bf530bedf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5accbef8-1a99-4761-9fd2-e60fc3e8c29c", "sighting_of_ref": "indicator--505dd22f-bd6a-4e62-b684-9fe9b0a5d36b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50e7bb77-bc7f-4117-88a4-76e81f94beb2", "sighting_of_ref": "indicator--c8f7b070-5869-45e4-bc87-50a573f57544", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c661cfd6-05bd-4eaf-8911-9f9ac8c796c8", "sighting_of_ref": "indicator--1c6e1b3b-26c1-4ab7-b94e-74cef096ed3a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65be5363-facb-4570-863f-608547fffbc1", "sighting_of_ref": "indicator--5ffd1355-7375-422a-af5f-ef321b29f780", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3efd94a6-c8f9-482a-b904-2dbaea58da83", "sighting_of_ref": "indicator--b3ca8264-62ed-423f-a304-47ead4ec9e3a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ee1a657-06e5-469e-ba4b-dc2fe877e089", "sighting_of_ref": "indicator--b3ca8264-62ed-423f-a304-47ead4ec9e3a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8bee268-df5a-4464-8965-ac9ad3ce3c4b", "sighting_of_ref": "indicator--0abd5ed9-8d36-41fe-8509-fc8a23acdbde", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8977d9d-a58c-4bd7-8d2d-8ebc112f97b4", "sighting_of_ref": "indicator--a8db20e1-e8c6-40e7-959c-79eb86ad4649", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35a0820f-ff03-4dbc-9695-808b9fb17ae2", "sighting_of_ref": "indicator--451b52c9-49c4-40b8-a865-e151127ca6a1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed7a10f8-96d6-4548-9fee-274493777bb4", "sighting_of_ref": "indicator--6c55bcc6-8470-4982-ba3c-0a4e6598bf95", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8e79b44-9515-408a-8fe3-3d4469d8e1c9", "sighting_of_ref": "indicator--fd030a86-ceb6-4f4f-8537-157a3cd303a0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--874f2144-e863-4ce8-8803-ba6816c36320", "sighting_of_ref": "indicator--fd030a86-ceb6-4f4f-8537-157a3cd303a0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81290a93-4138-4025-9a06-aef87f62000d", "sighting_of_ref": "indicator--7f0aa286-d1ba-47fd-b643-12340a4eab07", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--384fb57a-cc38-4234-9fc7-2307064b2a10", "sighting_of_ref": "indicator--18e45c34-2fa5-45ce-8fd1-9e83edbb3cfa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e928333-e148-4977-ad99-4c0e125519ea", "sighting_of_ref": "indicator--35086ce3-01a2-4232-8ca8-975b2f914d14", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0b19994-394b-47d0-bcaa-7f4317210e9f", "sighting_of_ref": "indicator--1c6a733c-900e-4607-a187-e2aa7821bb4e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e97075f5-bbe2-4fd0-af1c-ac8d547efb3a", "sighting_of_ref": "indicator--58e6fc30-8a00-4feb-b203-20bde0878fe8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fe7df33-a1e3-4e4b-8ab5-a628e99a903f", "sighting_of_ref": "indicator--f838b57e-0dd0-4dea-80b3-5a1725870272", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c41aa43-5e53-4201-9add-a6540f19ef77", "sighting_of_ref": "indicator--899a6328-89b1-48ad-868f-65cecc390686", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8ec5e96-fd90-4e90-bce8-1d01882ab1d9", "sighting_of_ref": "indicator--bd249c89-8ee1-4ca1-ae0d-b104d93de28f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d1993a9-28a7-4342-9d6d-fe7f1686d55d", "sighting_of_ref": "indicator--b3fe8110-3e2c-451e-ad4f-1abfe3f151d1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f348abf-4daa-4e4b-9f26-8916516fbe85", "sighting_of_ref": "indicator--eadb481c-4279-4f3d-ba94-7985ee8f810b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--300f1fce-9e9a-476a-b165-6134f415cf29", "sighting_of_ref": "indicator--808a5adf-af01-43bf-81f4-d35933141897", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efdf6275-c8f2-4a00-b012-b1048bfca257", "sighting_of_ref": "indicator--5ec55806-95d3-4023-a195-bf19ae9c3b0f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e89f08c5-e3d9-4879-9ce5-e1fc6e42f51e", "sighting_of_ref": "indicator--62ca6617-6fc9-4f68-9c46-69da3ba96b73", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05beea2a-671f-4aaf-9541-cc02624c39b3", "sighting_of_ref": "indicator--62ca6617-6fc9-4f68-9c46-69da3ba96b73", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5659f680-0b67-4d58-b7ce-8463abd20f99", "sighting_of_ref": "indicator--cdadfa6f-cda7-47e0-b8a4-158feaec888a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c208169-8fc4-49e0-a9d7-84bfa62d287a", "sighting_of_ref": "indicator--d6af5bff-61ba-4681-aedc-401973d1d117", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a75d166-470b-4ed4-891f-42137db3572f", "sighting_of_ref": "indicator--41b46a3a-20d9-4521-9957-94f5f9b766ef", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdb6d62d-51e8-4cac-9c68-8fd461401968", "sighting_of_ref": "indicator--577a7979-15ca-466f-a141-a8f4b7ea4446", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b700529-3730-4467-ad61-5d4ebc899f95", "sighting_of_ref": "indicator--efeaf84c-75dc-4cf4-aeba-dc6cbeafdb46", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97f5da22-201f-4da5-8c92-49198ec452e7", "sighting_of_ref": "indicator--97d0c359-7d45-459c-8bb6-9e929ea0347f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2491472f-e4b5-4b20-841b-0087dbdd9f90", "sighting_of_ref": "indicator--428a4578-3c68-4451-81bd-b99004e5e165", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a3f5917-6248-4d7e-9f1f-7a3acac22e77", "sighting_of_ref": "indicator--5b62f9a5-533f-47b7-92c7-fef4c81f244e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89e8507b-b8b7-45ea-8f56-426d3abd38fa", "sighting_of_ref": "indicator--3b7cba2f-18a0-4863-9ef7-ce7f376a00fb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55d5280a-30d5-4fce-9ec9-ac7d07160b17", "sighting_of_ref": "indicator--2cdac179-bcd6-48fb-b83d-9b868491ac6f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a5ead95-2f1c-4393-9d68-add0ab868495", "sighting_of_ref": "indicator--8b9be3d1-fff5-4598-840d-a315274a9180", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55b8a3b2-d1b4-4022-878e-0b03f05814f7", "sighting_of_ref": "indicator--2c909c29-f054-4c37-94bf-9872a4773ae3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74deaa70-6aab-425e-ae2a-ac8176dddf10", "sighting_of_ref": "indicator--67d3a64e-5d1c-480a-9675-3efbeafac269", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14ed1d86-ca10-450a-8a70-eef63a436530", "sighting_of_ref": "indicator--d00f06dd-872e-4d2d-bed4-266b9899d934", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82f034af-ef1b-4387-a35c-973c66a81703", "sighting_of_ref": "indicator--41e1c2ad-9350-4e27-99c6-2931f89757b9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90a777b2-2bb9-4722-b99b-2c0f9c40fa25", "sighting_of_ref": "indicator--c3aa98b8-ebb9-456d-a447-6bed384be92e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3553901c-650d-449d-9162-14946cd91ec4", "sighting_of_ref": "indicator--76d78cc7-8137-4383-83aa-0c50e8b53dc8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3d828e1-5494-48bd-92ec-c5ebd27b212a", "sighting_of_ref": "indicator--373ab179-a9d8-4f11-891a-e0a950a00406", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c01124b8-12a0-41cc-80e0-dadad1b5ee09", "sighting_of_ref": "indicator--affc6048-e35b-49ea-b538-eee2129783d3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a329f1de-e8c9-48d7-b4ab-cd08feb23fa9", "sighting_of_ref": "indicator--e8a83ae2-7d9d-458c-b257-5c9d9b65a716", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cfc0c92-9628-494d-80e9-f6bc808650d8", "sighting_of_ref": "indicator--82b62d93-01a2-4d5b-927f-c99a9396302a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7fb4b0c-a54c-433d-9432-713c19367005", "sighting_of_ref": "indicator--944acb58-f15b-46e2-8392-d29a40659351", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d32f491-2939-4dea-96d9-4fe465672d84", "sighting_of_ref": "indicator--97fadebd-0491-4dcb-848b-b24a5774bb61", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20a5342f-2ef4-4bcd-b1cc-990fe31c74fb", "sighting_of_ref": "indicator--ec72a8ac-4916-4f1f-beb9-9d3d3f3de780", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8a7cf41-bdcf-454b-823b-eeef81fd7f21", "sighting_of_ref": "indicator--695c339c-6b71-449b-9fe2-513d937908bd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7aa130d-3afc-4fcc-a596-6c9c18262c8f", "sighting_of_ref": "indicator--7d8ee32b-2ab7-4fee-9f17-976ded76a750", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4aa2f212-a208-4e15-a8a9-241f0cdab13f", "sighting_of_ref": "indicator--bc7efb7e-b467-498e-8975-06ffdf7a127e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b7b62ac-fef9-4ad1-a21f-0989fd0c0255", "sighting_of_ref": "indicator--34577bee-537a-41a4-bf18-b6e504d2d101", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--106a0e4b-20fb-44f2-9aef-fc711734619e", "sighting_of_ref": "indicator--4bc71f99-fd53-4279-a9c2-dd3f635b0d38", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99ffd8c8-e096-443e-8f52-e9d93288c351", "sighting_of_ref": "indicator--5cfc349c-715f-4195-869e-fc608a23de9e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43d69e98-465c-4104-ac42-5fa340fbf582", "sighting_of_ref": "indicator--145cd8ac-473c-4dad-8998-d3a0f501113e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--caee95f3-aa8c-4e11-bba9-d455877726c9", "sighting_of_ref": "indicator--a7c2a1a2-1560-4c9e-b69c-a58d104ec045", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--030cc71c-7a69-4533-b5e0-cd6ce6622e8b", "sighting_of_ref": "indicator--5a05efbb-26fe-4d03-93ac-62a709d9b50c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8400009f-64fd-477e-9b38-2193cbb0085b", "sighting_of_ref": "indicator--44ac4578-513a-4056-9063-6af2a481100d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0b3904c-4193-47b6-847f-8528385baf07", "sighting_of_ref": "indicator--0910fcd0-a1ae-4137-b8d4-9601351b54c9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfe3ce28-2761-4f3d-a40d-b1e899c93225", "sighting_of_ref": "indicator--8ee7fb34-d734-44d6-be52-514e4b6ef109", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f74f0f5-2514-41ab-bced-2113c3666c41", "sighting_of_ref": "indicator--718d3540-17ba-440f-b976-1cbe59757c0b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc9fc362-4e6d-40b1-97bd-f0ef0e11ee66", "sighting_of_ref": "indicator--493ebaa6-db30-47a9-8c90-a126281e6d98", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b125fcf-6ef6-45fb-a221-14489ae37ff9", "sighting_of_ref": "indicator--e35220b4-5ba3-4bd8-addd-507ff48ec8f4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0e77515-97bb-4a7b-a616-fac552b44724", "sighting_of_ref": "indicator--a62fe4b8-ba61-4dda-8904-be459e20802f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3bc905e-3658-4f6e-80ae-abc2fc90b2d4", "sighting_of_ref": "indicator--283f5367-f7dd-4248-849a-a13050c8f07e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3d2e436-bb53-4da8-a2ba-3ba244d99102", "sighting_of_ref": "indicator--4513a855-e49b-4ea9-8104-f8e818254832", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f48f843d-f2d4-48f7-b25d-b72b7e89528f", "sighting_of_ref": "indicator--8b71d552-6096-4c43-ad74-0abb22152cee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--669f2dd2-5166-48fa-945d-87bbd8c8ca55", "sighting_of_ref": "indicator--a422eb66-6ea5-4f4c-a03c-e8caaaa8591f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb444e89-134e-4f45-a535-a682580496fc", "sighting_of_ref": "indicator--2b1caf7a-e721-40be-9368-311676103b88", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6842c1ed-3094-415c-ab1c-30d59cb2bc68", "sighting_of_ref": "indicator--076107c6-4fcb-46a6-b85e-737ab12d2f48", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f426097-ef1f-4874-89ae-53d13cfcb1b5", "sighting_of_ref": "indicator--36cfeb16-74a8-4941-9986-55aab2b8976b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ea5ee93-8d7d-4d02-8b3b-e9df772ac6de", "sighting_of_ref": "indicator--abe8d3fe-6d04-452d-8de6-11c5350677ed", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7583b806-af75-4832-8807-f19052c41f36", "sighting_of_ref": "indicator--a50c0627-86e1-4c1d-8c65-402dd218c620", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--011ef53e-f1f2-4bf3-a5c9-2041a56329a6", "sighting_of_ref": "indicator--910a5c2f-3213-4055-a022-3981f3a7af8d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5653ece5-47c4-4934-9009-ca6a8d95a211", "sighting_of_ref": "indicator--5bd94096-f6df-4257-96c1-79f49d2aa55d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d831913-3d18-4252-acbd-1cea67fc14e9", "sighting_of_ref": "indicator--ad5ac303-882b-4adf-9908-2e91ac74c212", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--266980f4-d0da-4339-aed9-178b297b73d0", "sighting_of_ref": "indicator--e05ea35d-06e5-44b7-834d-677d0df39a0e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73226a43-2c22-4e72-be09-3389061ff2a1", "sighting_of_ref": "indicator--4eec8021-cc05-4d1b-a76f-77cb65da8a32", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23b11ee7-6da4-4282-8eac-a6c2d15c546d", "sighting_of_ref": "indicator--195422dc-3ec6-41cc-9df0-69d93ddb4ee3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc34e71b-5132-4f2b-a881-86c3537aedb5", "sighting_of_ref": "indicator--1d607e83-b6e8-4ba5-b48f-216caec18c46", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c690084c-52ac-43ee-9e8a-438766414904", "sighting_of_ref": "indicator--c5a5bef3-f44c-43b7-9ddf-2c747614312a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c987b117-3995-4568-be92-1a93a702cf1b", "sighting_of_ref": "indicator--2b5aa3e3-6d1c-43d2-af95-5740f8400183", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e6be4ae-0caf-4864-9a01-be78dbfe333c", "sighting_of_ref": "indicator--f49216ea-c1fd-4ddb-a483-658786b2b903", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf892a24-8e17-44f5-9006-882b1e48496f", "sighting_of_ref": "indicator--7aef1bff-32ef-443e-aa38-e8c8f2794c5b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a123ba8-b2f7-4a26-9154-1c3a7d81152a", "sighting_of_ref": "indicator--7acdcaa5-3393-4c32-ab0f-e991f63bf8e3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84a563aa-d404-4b3a-aa18-ff312831e7e0", "sighting_of_ref": "indicator--42a6d602-ad96-4717-ad36-c934032586bc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a5b65a6-555a-4b1e-9c56-19ff427b5854", "sighting_of_ref": "indicator--12a8d845-2d1f-4bef-89ac-ef1d5a0b5b3d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf12b8e9-f0c0-4eb9-8ad6-83d70df32159", "sighting_of_ref": "indicator--5a1209eb-5122-4767-8a94-295cfbe41ee9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a461a91a-59b8-4cd1-a6f6-072cbf6b143a", "sighting_of_ref": "indicator--71c5d082-a45d-4da2-9616-e980ac12e4b6", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--606bd977-8fd9-4e92-ab24-140ba9b09874", "sighting_of_ref": "indicator--e6198b76-d7c1-4a2b-a9b7-40c65bcb6e69", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c8c7557-1412-46db-a7ed-438e52c01489", "sighting_of_ref": "indicator--184e5967-b533-4b43-81a4-600dc85b052a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc781f12-2d18-4c7f-b140-12c2baa8be7a", "sighting_of_ref": "indicator--62984575-2582-4375-a78f-686a0c0f474e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3985be0-5e79-4c7b-8adf-f1895d80c0ab", "sighting_of_ref": "indicator--c908141e-4c26-450c-bc52-d55adb173ad1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b35428a-ac66-43df-89ba-660a709843a0", "sighting_of_ref": "indicator--119a8007-517a-4763-b9e3-9ec11679faec", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d18fae23-2ac1-41f5-b3e8-b582e8e151e4", "sighting_of_ref": "indicator--a0e8df2e-4044-4581-878a-70032a0c6e1b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--370081cf-d3c6-4786-b393-c61c3f61d3f8", "sighting_of_ref": "indicator--db2ac6e6-0239-46a3-9d64-879e1f798faa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a9b131e-deb1-4e0d-82b7-5d6a20d67f12", "sighting_of_ref": "indicator--ac4f004c-e84f-40c9-8fcd-e6e05724dcc7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2132f7a3-5d7a-41d4-9d6b-4f3518cc6e7c", "sighting_of_ref": "indicator--e9f60518-d725-4fe8-a605-fdde6bc2d988", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04100187-6584-42ee-acd5-0a2d035b01d1", "sighting_of_ref": "indicator--da468712-f135-44ab-9c09-6b1e0caa0bc3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adab3e06-2e60-413f-8d62-f04dbb4aa5dd", "sighting_of_ref": "indicator--33424fc2-9728-43d6-aea7-79ced37e872d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23d32eb0-b1cd-4b20-b4ee-9c5850a8b6ac", "sighting_of_ref": "indicator--19a9b3df-b500-4974-8d84-f078996c5340", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d5405cd-563f-43f5-9491-9126b122581c", "sighting_of_ref": "indicator--81bf63c1-b619-4feb-b91a-0079fff1b850", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a28ff604-ae02-481a-bc55-91253939845e", "sighting_of_ref": "indicator--24f76182-4c78-4337-a6ad-e4d59a8ed0d9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b39dadcb-6ff5-401b-b2b4-ec60e932d205", "sighting_of_ref": "indicator--36377e7c-c396-4226-a907-c16ff6a8a2bf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71672899-4eef-41e6-8331-17e6d4f79df9", "sighting_of_ref": "indicator--8c275956-aef7-423e-ac7b-7e63373f6021", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93f3dbb7-96a7-4dc8-be19-6bc784caabd1", "sighting_of_ref": "indicator--b32f9907-04c8-46a7-962d-80a4d57d9258", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c7c5790-60f5-4277-a48e-7229ea0203dd", "sighting_of_ref": "indicator--5e77ea06-8370-4eb5-a47c-c997569ea7c4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f8e2316-f008-403c-95b8-e9b5d3cff0fc", "sighting_of_ref": "indicator--b10f6924-efd7-4c8f-ba10-f99df4f3d2d9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c159fb3f-6a0b-48b7-9c4a-4059f843d490", "sighting_of_ref": "indicator--f7f85f69-9e71-48fb-92ba-fe5b43bc5189", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1006c494-0e80-439c-b0fd-0e8a40e9b6df", "sighting_of_ref": "indicator--e0f8748a-056f-4147-9117-e3c2aa645e82", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37fec7d4-c162-4113-9c09-9fafd5280b35", "sighting_of_ref": "indicator--dedd187f-ee5e-4e57-8161-a5c3efb398bf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2347751-ad74-4755-b097-a61e6423321d", "sighting_of_ref": "indicator--acd0306e-500b-43eb-90cc-57f362934703", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07d0df94-b162-46db-8697-3f138ca4c428", "sighting_of_ref": "indicator--5fe110f3-c497-4d6f-b8c6-4e3c1a955055", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f537273d-9c21-43d6-8071-c1677bb52c2a", "sighting_of_ref": "indicator--82522880-1a11-468f-9df4-693535ced80e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4f634e1-93f1-4c19-9458-0a881fd7f1ff", "sighting_of_ref": "indicator--2238d693-11d6-4430-9aec-eb56d36af03d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ffaf9e4-13ef-46c1-af26-85aaab7b0365", "sighting_of_ref": "indicator--c65247e8-bd48-4265-996b-ab8bc61d1246", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d26b8755-cca0-44de-9e9f-8123688f17e6", "sighting_of_ref": "indicator--bdcf5f33-cbfd-4eeb-b499-4dfde0de1f1d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c906d70-be22-411a-9454-e1e6f3926e1e", "sighting_of_ref": "indicator--bdcf5f33-cbfd-4eeb-b499-4dfde0de1f1d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d20ef88c-f67f-472c-9ca7-c0a1bb42ac2f", "sighting_of_ref": "indicator--914e819e-b25d-4289-b6c3-298b5287e8ee", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a90a4a6-b796-4108-bbaa-87ccbadf3c67", "sighting_of_ref": "indicator--914e819e-b25d-4289-b6c3-298b5287e8ee", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcabf187-c7a2-44ae-bc77-a971126fe788", "sighting_of_ref": "indicator--85851fdf-2a11-4c3f-b849-c7e89f5c8672", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88c5fffa-8d6a-4456-994f-65af7d5680ae", "sighting_of_ref": "indicator--46b52a46-2cec-4667-bf99-b1338806aaab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1337b01-7449-4901-967a-0f88b1b31e9e", "sighting_of_ref": "indicator--28121f27-8a46-4130-949b-a277c81234ac", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff8c398e-1755-4ff7-999a-6a46e7e539da", "sighting_of_ref": "indicator--94809466-fbd9-4940-87e2-b0d36a0a7462", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bee75e7-45e9-48c3-8625-7e78f072be61", "sighting_of_ref": "indicator--b7a63bd3-b382-4946-99d7-03d6559a73c1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--704589bd-c7b3-4651-b78c-e573842c8e3f", "sighting_of_ref": "indicator--813fba2b-4922-450c-9230-8459fa38ad33", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd22203c-e4e0-46bc-bb22-18946b3c5e07", "sighting_of_ref": "indicator--07fa59dc-c669-4f60-b5c2-66d98dce2cf7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77959c4c-9a4f-43e0-b50e-ca7dda3727df", "sighting_of_ref": "indicator--81ebf62e-5e24-48a0-a7de-31f3fd194f28", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce7d562a-d7e6-4a2d-89c7-bbfd14d2a353", "sighting_of_ref": "indicator--532eb5ca-b645-4954-b632-02e0bd08b362", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5843df03-0bab-4f67-8080-e692bb917a37", "sighting_of_ref": "indicator--2bec5381-bdda-4c83-af4a-1531cee99002", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b14706a-ae91-41ce-8f4d-7c229adb4546", "sighting_of_ref": "indicator--5654c60c-a831-4d48-89fa-8d716ea648d4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d2771f6-7e16-4d80-b240-542a59b52f54", "sighting_of_ref": "indicator--5654c60c-a831-4d48-89fa-8d716ea648d4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13d27a35-2946-4c2b-bcde-01acad0c0e25", "sighting_of_ref": "indicator--4e036ed0-b447-430b-97bc-061f35d479b7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6b1bd69-f15b-4c36-b72f-2c5234900c61", "sighting_of_ref": "indicator--4e036ed0-b447-430b-97bc-061f35d479b7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a31bc971-2df9-4bd5-b5a0-ba4d988f4565", "sighting_of_ref": "indicator--71467201-899d-4e4d-be7b-84a3db585bda", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7eba8a82-b552-43d8-afec-f9f5f6b7a375", "sighting_of_ref": "indicator--71467201-899d-4e4d-be7b-84a3db585bda", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44e2658b-ab50-44bd-b033-a59a4131e270", "sighting_of_ref": "indicator--9a229830-d1f7-493a-8b54-269086a24dab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c70f159-fe14-4d02-9762-c3059df2f2da", "sighting_of_ref": "indicator--9a229830-d1f7-493a-8b54-269086a24dab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75e1ef7f-2f56-45c1-bf33-210b90ece718", "sighting_of_ref": "indicator--5913b310-e246-4ae0-886b-fe1ab9d1cfce", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccd8d20c-689d-4bd5-9fdf-c3e4d3cc17f5", "sighting_of_ref": "indicator--4b211b57-a758-4ef7-a09b-bb1902d58c03", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b50e14b6-9e7f-422c-b2a7-558af71eb6bf", "sighting_of_ref": "indicator--c5dc2c8e-b153-4fc9-be1c-209a3d91d670", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04b2da6d-ae3b-4efa-812a-79d65093d299", "sighting_of_ref": "indicator--e853bff3-b624-4b32-bf3b-bebcd4b7538b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83176d50-5c2c-4cbf-a7be-4f1e4c00d313", "sighting_of_ref": "indicator--e853bff3-b624-4b32-bf3b-bebcd4b7538b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97b58a7e-82ba-4a57-8730-e651e0e6b708", "sighting_of_ref": "indicator--95a924fb-7089-442d-8b48-c99ef4afc302", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f3f8bcd-0aac-47b9-a35e-5f8740486275", "sighting_of_ref": "indicator--95a924fb-7089-442d-8b48-c99ef4afc302", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9af17b1e-b8a6-4297-bf1a-57860bd071bc", "sighting_of_ref": "indicator--bd9502ca-c581-4caf-9d8b-93b8d6dc3b90", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39c9b8e2-2c1b-4db5-9b05-a63f8bd8d85c", "sighting_of_ref": "indicator--ec5129a9-72f0-4eeb-b2aa-2a6021ded3bd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--310fc142-76aa-4594-8231-63d7bcc79b8d", "sighting_of_ref": "indicator--ec5129a9-72f0-4eeb-b2aa-2a6021ded3bd", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d33d892-df65-43c9-bea4-76b32b9f4cff", "sighting_of_ref": "indicator--cf7a3454-3403-4aff-9940-d5fd61364106", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8af7372a-d433-4656-805b-ad99d33e0d1b", "sighting_of_ref": "indicator--cf7a3454-3403-4aff-9940-d5fd61364106", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dddeff7-d769-4e2c-88dd-82c3b09eddad", "sighting_of_ref": "indicator--618cbc80-22fe-4ff0-9b68-28521f545b8b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43c51379-6f7e-4c90-84a1-85f2d7bcbec6", "sighting_of_ref": "indicator--618cbc80-22fe-4ff0-9b68-28521f545b8b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b8736fe-468c-4dbf-9eb5-9a165f105eb1", "sighting_of_ref": "indicator--2b2557aa-4691-4e72-b70f-c79938a7fbb8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c8498d0-bdac-4cc7-9860-dbd24922e102", "sighting_of_ref": "indicator--2b2557aa-4691-4e72-b70f-c79938a7fbb8", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31a0f6c9-1aa7-4085-828d-0cc7b87b9524", "sighting_of_ref": "indicator--ff3012ec-22b1-4fa9-a115-2b890e69a994", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--127a7ee1-f4d4-49e7-ba10-da9dbf96e4ce", "sighting_of_ref": "indicator--7519455c-96e2-4e02-bef4-9cdfb3894e77", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e56dc32-a98b-4594-85ea-94a7719a5437", "sighting_of_ref": "indicator--9bae04f7-2023-4b62-b622-3c9c8ca3fd3f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12ad1bae-4938-482a-87ee-d1fad3f07f90", "sighting_of_ref": "indicator--7a001b99-1ff4-4eb9-b475-f2bcfdf79348", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--018fda27-7c9e-4d78-870e-e0f56d80bfde", "sighting_of_ref": "indicator--7a001b99-1ff4-4eb9-b475-f2bcfdf79348", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f10888c-0f14-4583-9427-fe9ac512dcb2", "sighting_of_ref": "indicator--ea0e44f6-cf23-4fff-8025-d92ac2da803d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--387196da-7e34-4007-bc0f-4c21d89c00ee", "sighting_of_ref": "indicator--ea0e44f6-cf23-4fff-8025-d92ac2da803d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ceff117-4870-43b9-b152-12ed4580385a", "sighting_of_ref": "indicator--899089fb-d1e0-4896-9b94-3aef20782094", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d33daf4-116e-426f-97e2-4005230bd6cf", "sighting_of_ref": "indicator--899089fb-d1e0-4896-9b94-3aef20782094", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1b07017-d42b-475b-a76d-6908af984ca0", "sighting_of_ref": "indicator--5b7e5fc8-79af-4092-b7b6-76bbd8cbfa8e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4300f5b5-8d96-4cee-a54a-8ff6ea775abb", "sighting_of_ref": "indicator--1971861d-b4a5-4f79-ad43-dca3f9497a25", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1def6b6c-c1f9-4faa-b636-8c52c8749267", "sighting_of_ref": "indicator--e6568e3e-f5d8-4637-95e8-0a5248cb1bb7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6a1df17-f8b9-4967-8911-b9ec8a0ce63b", "sighting_of_ref": "indicator--7b4e8725-6cd5-4a91-a9ca-7771c30e62fc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40ce2574-3931-4c1a-9d64-dd4fd871b022", "sighting_of_ref": "indicator--7e909fa2-2556-4386-aae5-3fa4f5ca38aa", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eae1f99d-c978-4b04-841c-5ae2105b51f2", "sighting_of_ref": "indicator--28f12937-d175-4dd9-947b-1e6728b1dc50", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1c9a4c0-360a-455a-9712-a4bfa67aebfd", "sighting_of_ref": "indicator--61a49b18-25d8-415c-8442-5937ef6e3b67", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03276c00-d760-4b81-b301-ff9648dec1df", "sighting_of_ref": "indicator--5a91d30c-2b7e-485a-8ac8-b883a701c9e3", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ab784ef-693a-4c22-bdce-1c919330da9d", "sighting_of_ref": "indicator--5a91d30c-2b7e-485a-8ac8-b883a701c9e3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78bc2fd2-54e3-4f12-9c1c-b78d80b14058", "sighting_of_ref": "indicator--cff96eff-4c54-4c4b-a6a6-8e9fff57bff4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b590f0b-4d1a-4f5a-9113-336c29765d72", "sighting_of_ref": "indicator--f0e2b0bc-2ac8-4f56-a2e4-b33af5909aa2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06c075a1-2958-4a9d-89a7-a667190c251d", "sighting_of_ref": "indicator--f0e2b0bc-2ac8-4f56-a2e4-b33af5909aa2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8d850a1-a206-4b39-b6f4-d9c11e30d6b3", "sighting_of_ref": "indicator--3c948240-c551-40c9-b0a1-61705aa4a12e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7197f990-5ea8-48bb-a713-f75dff3cfdad", "sighting_of_ref": "indicator--273cceef-29a9-49d8-b280-bb5422f1d6cf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d8616b1-bf54-4471-9758-58d33c063a8e", "sighting_of_ref": "indicator--48d5d86a-2021-4726-b042-32deb8744839", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a5a7876-00a3-4705-ab9b-698bfa061b4a", "sighting_of_ref": "indicator--aef0384d-56e6-470d-9e12-3564081e7297", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5f989ea-743f-4ed9-9cfa-7a04a1c730cf", "sighting_of_ref": "indicator--7f47dc74-7334-49a7-bced-88d43fdf8993", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--199ee338-8962-4d8b-9330-a16003f9a250", "sighting_of_ref": "indicator--7f47dc74-7334-49a7-bced-88d43fdf8993", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d70d02f-1740-4fcb-80c6-5be4a6f5395b", "sighting_of_ref": "indicator--b6fc5236-d856-45ce-8fd8-400913b546cb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bef2850e-5d27-4de8-b114-f3e28b2b682a", "sighting_of_ref": "indicator--b6fc5236-d856-45ce-8fd8-400913b546cb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ead244ac-6838-41fd-ac96-3d60f0be77e4", "sighting_of_ref": "indicator--a13660d4-f4c5-49ef-ab11-a9345b18a478", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ceaf8094-1fe7-4fc9-b476-82c713ece1ea", "sighting_of_ref": "indicator--a13660d4-f4c5-49ef-ab11-a9345b18a478", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c74475c7-64db-45e5-8ef6-357e0962960f", "sighting_of_ref": "indicator--7389e4bb-1eb3-4c24-8472-02e91f1fdfc0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2c0f430-9d16-4b86-aa7b-8ef97fb6984c", "sighting_of_ref": "indicator--7389e4bb-1eb3-4c24-8472-02e91f1fdfc0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0ea9801-7bd8-4e6f-8d24-016cd59f228e", "sighting_of_ref": "indicator--4ecf7f81-054a-4815-89d0-6518c50db040", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--700ebb65-55a4-4b7d-8d4c-b28a88ed5ae3", "sighting_of_ref": "indicator--4ecf7f81-054a-4815-89d0-6518c50db040", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed98fa07-2d6a-45e9-9b8a-cd3e0ee118f2", "sighting_of_ref": "indicator--98dc94f9-8fbc-47ae-a83f-163bec82a1cc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc05432f-0814-4317-825b-ab479fc27252", "sighting_of_ref": "indicator--da78536b-f94d-48e7-afce-4168aed54e8c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10c948ce-ca38-4f1a-9199-81122a6b21b0", "sighting_of_ref": "indicator--55ced0bd-f357-411c-98d9-4dd8f7a19032", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59c81c48-08a5-4da9-ae54-5b2a0dc05094", "sighting_of_ref": "indicator--55ced0bd-f357-411c-98d9-4dd8f7a19032", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03645d75-5e7d-4765-9c05-02af127517d1", "sighting_of_ref": "indicator--2b9fa672-42e3-468d-b23e-8d3ea24b03f5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34fc127d-5b01-4a76-b9ce-584bf662bdd2", "sighting_of_ref": "indicator--2b9fa672-42e3-468d-b23e-8d3ea24b03f5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--379c6d08-2c17-4f53-ab7b-81a0a611bf62", "sighting_of_ref": "indicator--d25bbd94-2f48-4f9b-9a02-c8d413dd26a1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bf76918-1f57-4266-9ac5-9a419ca0841b", "sighting_of_ref": "indicator--d25bbd94-2f48-4f9b-9a02-c8d413dd26a1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5866cc4-eb34-4629-a0cf-786eee567736", "sighting_of_ref": "indicator--c4478ebe-0f81-43e3-8b8b-a2a3c5543df9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbc12c99-39e6-431f-9348-d8c09bed8aa1", "sighting_of_ref": "indicator--fd31c2dc-1f6b-4505-814a-3e341a2bb840", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67eea933-cc5b-46f8-8eab-4b904ae1a315", "sighting_of_ref": "indicator--bc1d82f3-7138-448a-aa87-12c6de27e5d0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d970366c-ed75-4010-bff2-a92e7569ea0c", "sighting_of_ref": "indicator--bc1d82f3-7138-448a-aa87-12c6de27e5d0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc4e2520-432c-4957-9dc7-7b03ea8e50d0", "sighting_of_ref": "indicator--75217e58-0827-4d46-84cb-38c60b517739", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95981432-d027-455c-87a5-eb4c8782a6f8", "sighting_of_ref": "indicator--75217e58-0827-4d46-84cb-38c60b517739", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c48aa9f4-c9c9-4859-bb78-3da04aac631a", "sighting_of_ref": "indicator--eaf6ca2b-0aa3-44c3-a30a-8e56172ff1bf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2025905-099b-4a8d-80b0-260d1a40381b", "sighting_of_ref": "indicator--eaf6ca2b-0aa3-44c3-a30a-8e56172ff1bf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce51eb82-6070-4b7c-88ba-0c47801c5e3c", "sighting_of_ref": "indicator--d5e616a3-70f1-4322-9964-8e876b51db91", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20fe2d6d-07f2-43fe-8381-5bb7455f0e4d", "sighting_of_ref": "indicator--d5e616a3-70f1-4322-9964-8e876b51db91", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a5d81b0-089f-4e7a-8e26-91596d9e4bc3", "sighting_of_ref": "indicator--13916576-5033-40ae-bc83-2a9e11ac09f7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4eecda3-8fc7-44de-99c5-8f1f0592095e", "sighting_of_ref": "indicator--13916576-5033-40ae-bc83-2a9e11ac09f7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49c02087-3905-4919-996b-686292e1bf57", "sighting_of_ref": "indicator--67588208-d947-4f1d-a2aa-f64774d5715c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9ed10e8-9174-4509-8625-caceb957852c", "sighting_of_ref": "indicator--67588208-d947-4f1d-a2aa-f64774d5715c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--258b5f5b-83c8-49cb-8a88-d6f8459a9ea5", "sighting_of_ref": "indicator--1eb48640-3310-4f9e-ab37-132421b66b4b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8859e98-d3bf-4a85-a1d4-7edeb49469e4", "sighting_of_ref": "indicator--1eb48640-3310-4f9e-ab37-132421b66b4b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc69b927-c707-4b7b-b212-9b7500b4c749", "sighting_of_ref": "indicator--31d00249-a963-44ea-b2fc-eb7ba4a6328d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--883d728f-358a-46b0-ba31-5fce2a5606cf", "sighting_of_ref": "indicator--1697dfd9-b8b1-499a-a7d8-e2260093340c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35508da7-ac45-473c-821a-eb4703bb2f40", "sighting_of_ref": "indicator--1697dfd9-b8b1-499a-a7d8-e2260093340c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d75f71f3-5c69-4357-997f-5660cb466fa2", "sighting_of_ref": "indicator--068d5c94-99ac-4833-9a1c-852d134853db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09d8378f-f0a5-451d-96ae-6beba1588f8e", "sighting_of_ref": "indicator--068d5c94-99ac-4833-9a1c-852d134853db", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05729bf5-d5bb-4c58-a446-ae3daa3ed738", "sighting_of_ref": "indicator--9edbbf61-7f48-4a8d-947d-cd383f4d8385", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b23376e-8c7a-467f-8bf5-31597a0efbf7", "sighting_of_ref": "indicator--18673712-eb66-4725-8067-021d76972e47", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8996bd70-f28d-424c-9d28-75f42f3419a0", "sighting_of_ref": "indicator--c2e2b597-e1e0-40b1-9ea1-e60b138bf159", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a39cf7ae-e9a5-4078-953c-304b92c82273", "sighting_of_ref": "indicator--984c042c-ed27-4262-90bf-053ef08d4cb4", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba001d9e-e518-47a2-a6b5-4bbe7a26c1a0", "sighting_of_ref": "indicator--984c042c-ed27-4262-90bf-053ef08d4cb4", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cfbb2d8-bd35-43a1-9146-dfe04de3cf9e", "sighting_of_ref": "indicator--c99fd023-2c54-486e-b348-1f7810a4af68", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--919cf718-e102-4f25-aa70-b9ca1fa5506d", "sighting_of_ref": "indicator--a67d062f-9d0b-405c-bce2-61ce65bf4108", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf098f72-252f-4db6-a60c-a754acedca3c", "sighting_of_ref": "indicator--206c5884-d182-4b89-81d1-5cacbd6bb971", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0e20c09-1726-4cad-9768-a7155fb2a263", "sighting_of_ref": "indicator--206c5884-d182-4b89-81d1-5cacbd6bb971", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--810aa2c2-3dde-4aa2-bf98-cdc68d6130f8", "sighting_of_ref": "indicator--dd42e9e3-a6c7-4a80-b8cd-a7795d2d8dbb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e44335d9-2e3d-4020-a240-88639e461e0b", "sighting_of_ref": "indicator--dd42e9e3-a6c7-4a80-b8cd-a7795d2d8dbb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa9c8df7-4a83-4198-a2d9-7b8068286a3a", "sighting_of_ref": "indicator--2a56a4c1-20fe-4d2b-8817-39075112243e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75481e9e-d60e-4d5c-9eb5-37f757ff1639", "sighting_of_ref": "indicator--128ef0eb-0221-4881-8326-7115115e5bcd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65b1361d-4c03-4b40-900d-7a16e8e14280", "sighting_of_ref": "indicator--2b3081c0-3652-4b62-a74e-d42227ccd3d7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cdaa0dd-3fe0-4edd-8969-209a17ab3b1d", "sighting_of_ref": "indicator--3b5c551d-6d45-4d92-a504-1e32a3ecfa2e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c674f9c-fc78-4df9-949e-7ede6727e589", "sighting_of_ref": "indicator--ca706730-11a4-4076-b4b4-952e94167cf3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e22aee1-45e2-454a-a6fe-d1ba02f8ee5b", "sighting_of_ref": "indicator--eec2122f-c063-4763-8022-09334c05f328", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8b6703d-ad23-4a00-9b55-8be09aa27bd2", "sighting_of_ref": "indicator--f440fbd2-d863-49d1-8485-d187ff41f38d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53beb0fa-990e-4311-93fd-ac58e70d9858", "sighting_of_ref": "indicator--abf4df01-8805-4dcd-b237-372e65138f78", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--091b22d2-9e8c-4bc1-9ce2-ed1714c6992e", "sighting_of_ref": "indicator--cb440cd1-9e7a-4237-b5fb-b4bd66ddd460", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a261f792-d59d-405f-a9e9-1ea7996a1c88", "sighting_of_ref": "indicator--cb440cd1-9e7a-4237-b5fb-b4bd66ddd460", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab6345b5-f612-43bf-b25e-c1376cf4d9f6", "sighting_of_ref": "indicator--ff0f5c6e-e20f-4616-b5eb-86190d99dc2e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f82145bd-9cb4-4496-8720-b79d7e1dbe90", "sighting_of_ref": "indicator--ff0f5c6e-e20f-4616-b5eb-86190d99dc2e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28b705a7-20d7-4d01-ac47-740651473742", "sighting_of_ref": "indicator--88916748-964f-44af-bb91-6d56a7c9a4fd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3ec4d04-73f0-4451-9252-2486396d8158", "sighting_of_ref": "indicator--d8889173-14e0-4b4a-8e8d-baace9e059e7", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4566839-7922-40b8-894b-fddaa17dacae", "sighting_of_ref": "indicator--d8889173-14e0-4b4a-8e8d-baace9e059e7", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1310941d-4758-4553-b4fa-0e7855c81125", "sighting_of_ref": "indicator--9b7a47a0-7638-4e0f-a758-de98e5a57f1f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ccf79d5-6867-43e5-8ef3-cff86e610f72", "sighting_of_ref": "indicator--30e2a21c-6629-4167-9168-934074ca4a24", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9754e088-8497-4fce-88a2-ac7643b20865", "sighting_of_ref": "indicator--1fe5f049-2efc-49f6-b474-4d75ea3b3b1c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84cfeaba-fcfd-47c8-962d-41472606ccec", "sighting_of_ref": "indicator--bf98c5a0-59cf-480f-8122-7ec132c7e3f8", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24083d26-fad3-4896-96ee-7273180bdd42", "sighting_of_ref": "indicator--bf98c5a0-59cf-480f-8122-7ec132c7e3f8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66f0c6dc-7e1f-497c-9505-709ff7f56bae", "sighting_of_ref": "indicator--49a4186e-87bd-42cf-8f04-ac080ce832be", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4153f04-cc43-45b7-8080-0d4bdef6ff66", "sighting_of_ref": "indicator--4d19de14-0dca-4af7-a54e-a198190ed974", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75534411-0605-439d-b491-6d8a2a278fd8", "sighting_of_ref": "indicator--4b834f49-79fa-4da6-a803-d754a0d9772a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f332b5b8-2542-4b4d-b9ac-f6c70405d67e", "sighting_of_ref": "indicator--df0d9117-9038-40b0-baaf-a33eb4fdbf4f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73237b62-ca9b-4cd3-bfaa-bbfef8ed2bb9", "sighting_of_ref": "indicator--df0d9117-9038-40b0-baaf-a33eb4fdbf4f", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adb8c8dc-949d-4e01-bf8f-09f2ea8c0262", "sighting_of_ref": "indicator--654e98b7-a491-4280-aef6-fec05f2693ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdce3865-42e6-46aa-8337-74f932bef9b6", "sighting_of_ref": "indicator--e24be342-ddf1-4471-8ba9-7eab5fdd1e5a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--290de602-d6ca-46da-b9ae-626bef08461a", "sighting_of_ref": "indicator--bdc437f3-7a34-441e-883d-b797f5ca480b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74baadeb-6ceb-44cd-bf59-960b8b11779d", "sighting_of_ref": "indicator--bdc437f3-7a34-441e-883d-b797f5ca480b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8902cea1-a3b3-4471-b07c-b661a8273b98", "sighting_of_ref": "indicator--5bb0601a-88c7-4ec3-b253-19594fc64b82", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42658c48-29ba-4cba-902e-bd423cfc3e7b", "sighting_of_ref": "indicator--9b166cf5-0b79-4aeb-9118-7fc44dbf2b69", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e661dcb-faeb-4e03-8de2-06c8ae70e355", "sighting_of_ref": "indicator--9b166cf5-0b79-4aeb-9118-7fc44dbf2b69", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ba4ecc7-a3e5-4b93-af20-dea72057e08c", "sighting_of_ref": "indicator--2950e4fd-35ec-4bda-b6e5-fc63e715ff71", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0bd4179-c1c2-465f-9815-bc031ff1b494", "sighting_of_ref": "indicator--3b3db813-113a-43c6-94e7-2b06242b1bb5", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f19f55d2-86eb-421c-9c18-5eb78b3c4255", "sighting_of_ref": "indicator--3b3db813-113a-43c6-94e7-2b06242b1bb5", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d515334-9b10-4edb-be31-f53d59ef1dda", "sighting_of_ref": "indicator--a29da333-7708-4326-b83a-d9af62d2336e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f696ac18-3649-4a65-87d8-c7cd34583be3", "sighting_of_ref": "indicator--7282e50f-ca97-46ad-b500-7c224fe7cc67", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--655e930b-9541-49af-ab2c-470cd44940c7", "sighting_of_ref": "indicator--7282e50f-ca97-46ad-b500-7c224fe7cc67", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00002c59-15ee-41c0-b07c-557bf0cbc044", "sighting_of_ref": "indicator--3354a102-09f8-4a70-94d4-5534669044e2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a22c8f99-7967-4a2e-b140-35538be0b26b", "sighting_of_ref": "indicator--3354a102-09f8-4a70-94d4-5534669044e2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8f10698-e0a1-4d17-be04-5c7c22f4ebc2", "sighting_of_ref": "indicator--a7ff44f3-55ad-4d31-8686-7b4bab8564eb", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--421e6d16-8c18-4eea-861e-72063d3d5c9c", "sighting_of_ref": "indicator--a7ff44f3-55ad-4d31-8686-7b4bab8564eb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c57e05e-8127-4b87-badd-081df9de6381", "sighting_of_ref": "indicator--4db53a66-56de-47a9-839f-33bab002704b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a452c327-4ccb-4e6b-9008-2e20f32d4f8d", "sighting_of_ref": "indicator--aa20be42-ced5-4c4f-bc6e-390883086dbe", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6f76ef6-240d-4332-940e-829aa82089a9", "sighting_of_ref": "indicator--61add5e1-a1a7-4481-8125-9a51b1181c8e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0549325b-701e-4f75-b670-9e18aac8d8df", "sighting_of_ref": "indicator--ea37deec-5e22-444d-8b0e-3640f3758195", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce1822e7-8c76-4311-ab6c-9eff6d94ac94", "sighting_of_ref": "indicator--65356f19-57b4-4b92-aed6-2dcded6fec9a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e4dd64d-6f7a-4507-b8b5-6a479a7b3b0b", "sighting_of_ref": "indicator--65356f19-57b4-4b92-aed6-2dcded6fec9a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ed7b24d-1789-4d5c-9891-0dca12df790b", "sighting_of_ref": "indicator--ace0feee-1e2b-4af5-9894-44ee0b479fa3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0a7160d-c4f9-44ed-aae2-574227ead7f4", "sighting_of_ref": "indicator--ace0feee-1e2b-4af5-9894-44ee0b479fa3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c1bf1e1-f0a9-4760-a776-5270276f7c59", "sighting_of_ref": "indicator--0f2be384-ff2e-4f53-99bb-93a8db8b1a08", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dd7057b-6ff9-448d-8654-d5aeea16068f", "sighting_of_ref": "indicator--3bf2e06f-9458-4b54-993d-018d0a900702", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cf96a8f-6ee6-435b-b4ca-7dc4e76f91be", "sighting_of_ref": "indicator--447d3c3f-58e3-456b-a399-f838a17419cf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36f7774d-b10a-4dd1-9dd2-06837329e65c", "sighting_of_ref": "indicator--f6573b3c-7602-4cc4-8dbe-6b30bde72ca3", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecccefba-c979-43b1-af57-fc54b80cc341", "sighting_of_ref": "indicator--baeb50ce-3e95-45eb-8ff1-567882a30f9e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b22f925b-be59-4ce3-b1db-5dbe23c65138", "sighting_of_ref": "indicator--c97df6c4-993f-468b-89dd-db27debfab95", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50fe52b2-c80e-48c5-86e1-1bb942ab89f1", "sighting_of_ref": "indicator--ef75b245-7cdb-4c5c-924f-1bad2dbbcd1c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e04d1226-7b5b-4b45-8c33-025489709735", "sighting_of_ref": "indicator--07fa0516-d047-4b38-a590-cc6c96bd02d2", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa54b124-9f36-4490-8009-9f145b5610aa", "sighting_of_ref": "indicator--cc871691-523f-4236-8854-35b65d920881", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9fde8be-aff9-4302-ac39-3e9f19deecb3", "sighting_of_ref": "indicator--cc871691-523f-4236-8854-35b65d920881", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c7cff41-bf9d-428a-9394-96abad1db142", "sighting_of_ref": "indicator--c855ffad-2219-4b75-8b21-7769596e14a1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0e03e74-8ffe-4936-a3fb-80752f49634e", "sighting_of_ref": "indicator--abe6bc15-eaf1-461c-b4e3-838506c87528", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b33af57d-37ec-4d92-b21d-babfb4116191", "sighting_of_ref": "indicator--abe6bc15-eaf1-461c-b4e3-838506c87528", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44303562-c34f-4c16-a6a0-c98984f20566", "sighting_of_ref": "indicator--10bb5b25-2dc9-4470-aa34-e0425e558a68", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72cd53dd-e9f7-4987-8ba4-9a8c5ddb16eb", "sighting_of_ref": "indicator--10bb5b25-2dc9-4470-aa34-e0425e558a68", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--524880b0-83fd-4c5b-a9ee-0bbb8bb0d10c", "sighting_of_ref": "indicator--f8a20b9f-a2bd-4577-b546-1d98c56905ab", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2831510a-4c73-4158-a644-e81b64169b1e", "sighting_of_ref": "indicator--f8a20b9f-a2bd-4577-b546-1d98c56905ab", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f92bee1-eeb0-4fbd-af1e-58d2044123f0", "sighting_of_ref": "indicator--7d9705aa-0f38-4780-a821-d574b9abc49d", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e11b127e-7b15-49a1-9cdd-57c9af53b45d", "sighting_of_ref": "indicator--7d9705aa-0f38-4780-a821-d574b9abc49d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aeb72d22-290d-49ff-b98b-d7bd950e32be", "sighting_of_ref": "indicator--01b5eba4-3dd7-441c-bbe5-c395436e6c09", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--514e4ba8-7071-4bba-bbaf-5187e36b7eb4", "sighting_of_ref": "indicator--1a1a9444-f79b-45d4-9db8-48ec8aed29db", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1871bfa-77a8-4085-8891-9fb7222435d7", "sighting_of_ref": "indicator--1a1a9444-f79b-45d4-9db8-48ec8aed29db", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9e91f6a-5d3e-4f4b-856f-d4e490be044c", "sighting_of_ref": "indicator--2ca99571-54e4-497a-8d9d-5db7278c3103", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00f7a395-9d39-4a66-8cb9-060fd292a3cb", "sighting_of_ref": "indicator--57e6fb41-379c-46e5-87ea-5e8a484c34e1", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7018f821-9fda-44e2-8dd3-b5391525a765", "sighting_of_ref": "indicator--57e6fb41-379c-46e5-87ea-5e8a484c34e1", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42ee3f17-2a9b-4d07-a51a-2c5b69f31d1c", "sighting_of_ref": "indicator--cb3868e5-142c-46b3-9979-5979768ad99e", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de60a150-f01d-4cba-9c9f-a7b1053e717b", "sighting_of_ref": "indicator--c0fc486b-26d0-4f1c-91d1-2605ef2c6113", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a732b525-0b4d-48bc-9ad4-5a00f1ddb3de", "sighting_of_ref": "indicator--c0fc486b-26d0-4f1c-91d1-2605ef2c6113", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b7d9775-a4db-4f61-ae40-06805882115c", "sighting_of_ref": "indicator--bfe8710e-881a-4d94-9dbb-9f04cda955cb", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7af474f7-ae5b-47dd-a318-22052733ac81", "sighting_of_ref": "indicator--dbe387ae-be31-4550-865e-0258e6fefee0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acc2e1b4-63eb-4a8b-86f4-9d81a9bb9256", "sighting_of_ref": "indicator--5f52831c-0848-4dec-8d9d-a16cf4f9b56f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f32acb3e-ea5b-47b9-87b9-a85ab3681eb1", "sighting_of_ref": "indicator--4eef4727-a509-4870-8434-b874a9f2272b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1a25614-6107-428b-bb3b-de0a2c231588", "sighting_of_ref": "indicator--fadaa391-7f3f-4593-984e-720962503c40", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04c247f8-dd25-45bf-82ce-045a4c6716c8", "sighting_of_ref": "indicator--df5f0431-da93-4d0e-a593-9fbf12d9a4a0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f4a868f-9269-4225-89f1-91ff46b9b87a", "sighting_of_ref": "indicator--df5f0431-da93-4d0e-a593-9fbf12d9a4a0", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2d93059-2ef4-4953-9bee-ba470ac7dabc", "sighting_of_ref": "indicator--e890106c-148d-439f-834e-96a6029ac0c2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40c36413-9a49-4ba5-b837-d6e43b8e917a", "sighting_of_ref": "indicator--27a5ad67-5c0b-48ab-a21f-e63285807c31", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e23dcee-ea07-4112-bb17-f10076cd273e", "sighting_of_ref": "indicator--27a5ad67-5c0b-48ab-a21f-e63285807c31", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eb486e8-e139-48e6-b688-533db240e6bf", "sighting_of_ref": "indicator--d0342153-9874-4d6d-9df2-ce1e4c6272bf", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a83a0c28-1b00-45e7-88ea-923d9dd15793", "sighting_of_ref": "indicator--d0342153-9874-4d6d-9df2-ce1e4c6272bf", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63193ad0-6dcc-4745-88e4-23b1bbe34bc4", "sighting_of_ref": "indicator--d2a86654-49e2-4cb8-a439-f3f96e304131", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d15202c-7155-40e7-bb27-44a5eb906e93", "sighting_of_ref": "indicator--ce47fec9-f2ae-41c0-ad7b-5253383395ba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62f66131-6acc-4b3d-82a7-2060db87685d", "sighting_of_ref": "indicator--b8e6b208-6a98-47fd-8aed-65818c2c930b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--595311f3-02a7-438c-b8aa-89dbb5b936cc", "sighting_of_ref": "indicator--bb95993b-d339-46d8-b5bc-ece7847b1d75", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3169bb36-ea52-4157-ac0d-134167856445", "sighting_of_ref": "indicator--bb95993b-d339-46d8-b5bc-ece7847b1d75", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85c62b4e-fcc6-4822-9eaa-5f8289c07055", "sighting_of_ref": "indicator--e966f139-46b0-460c-b7df-647724aa6472", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83083b35-3efd-4f01-b255-6bc1ff1d6a1a", "sighting_of_ref": "indicator--65268c8b-c44d-4a61-91da-d475fa004707", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36864d80-ebd0-4bfe-a448-309b5e9ce417", "sighting_of_ref": "indicator--07b2391d-a74f-4b77-82bb-591636c1bb72", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fefee7e1-60f5-44dc-989a-29d97dc462b9", "sighting_of_ref": "indicator--07b2391d-a74f-4b77-82bb-591636c1bb72", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6841a45-bd6b-4561-83e1-3d514b526c8b", "sighting_of_ref": "indicator--bb44eade-96c8-4885-a00b-107bae9a7ddb", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f3daa75-056a-4787-b094-e487c6c1a8ed", "sighting_of_ref": "indicator--9d4b5cbe-3515-4174-9a18-439f7265db43", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce431c34-bbf3-4040-827f-973f32678b26", "sighting_of_ref": "indicator--9d4b5cbe-3515-4174-9a18-439f7265db43", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f5fd01a-7770-4a35-a53a-aecb1a744df1", "sighting_of_ref": "indicator--758ae638-f7da-4d43-96da-2b872ba3cb53", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--065a9d6d-5f33-48a7-8994-3c26429e27d5", "sighting_of_ref": "indicator--2863751f-8f2f-45b7-9b7b-642807fb0e98", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae2e272f-ae61-4bba-99b1-e5a41f848253", "sighting_of_ref": "indicator--2863751f-8f2f-45b7-9b7b-642807fb0e98", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4d1077c-8abf-4fe9-8c47-5770562931fb", "sighting_of_ref": "indicator--2863751f-8f2f-45b7-9b7b-642807fb0e98", "where_sighted_refs": ["location--42737d5e-a4ef-4603-bb2f-8145b63c785e"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5312dfbe-12e5-4ebe-839b-b09c5ca9ec49", "sighting_of_ref": "indicator--f03f455b-b2b0-4099-8acb-5d90c4cc77b0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c14cf4c-1e94-4d92-a750-e1ae29befc42", "sighting_of_ref": "indicator--ce47bcd8-d031-45a5-bb0c-695fc31481db", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--559a3c72-5ffb-4972-8c5d-f021ebc4a6a4", "sighting_of_ref": "indicator--44fe4509-e7ea-479a-b09c-4440e8b04aba", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ce56e0e-62c8-4505-9332-388640da40f1", "sighting_of_ref": "indicator--617e1114-9636-42cb-99d8-c0c15c3fda5d", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d194e41c-b14f-4412-8dfc-a0239ada2280", "sighting_of_ref": "indicator--71e433a4-c844-44ae-9aa7-86105556a7b6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29e8000f-60e7-4c33-a0c3-6a4eed285151", "sighting_of_ref": "indicator--c34f200a-d57d-46ff-859d-898a5975870c", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cec734b-a000-4d77-bc67-248f21272fa5", "sighting_of_ref": "indicator--247586ad-b17e-41e0-8631-484ff671bb04", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--574cbe8e-afe5-484c-bdbf-8dd27c3bf0a7", "sighting_of_ref": "indicator--247586ad-b17e-41e0-8631-484ff671bb04", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83ad5384-89c1-47ca-8fcd-d956a24887b6", "sighting_of_ref": "indicator--2df9bdc5-7986-4bd9-b20d-da15cb74838e", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--404917f2-77ad-4ec0-955c-596e450d28ed", "sighting_of_ref": "indicator--253c48fb-9511-4016-9784-5b198d314639", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d5c31be-dda0-4432-99d1-548fd35e8b32", "sighting_of_ref": "indicator--18958c05-b1de-48c9-8f51-886f1add0dc8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48596ead-79d7-4a40-a27f-93fbdd8b3264", "sighting_of_ref": "indicator--3be75c45-35c6-4026-9555-c735c014752e", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80307bb5-44d7-40e3-9746-5c8924e4e3c4", "sighting_of_ref": "indicator--74c2f239-ac3a-49df-8743-c944bc9df990", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48b42782-f7cd-4496-9098-7d882a02607f", "sighting_of_ref": "indicator--74c2f239-ac3a-49df-8743-c944bc9df990", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad7ac0a6-95d2-4733-ad2b-47da7c7d437f", "sighting_of_ref": "indicator--bc6cfd24-9120-434b-88a2-d39d1b34bb17", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4be8c2fc-5695-4365-af28-22d3f8b50b93", "sighting_of_ref": "indicator--bc6cfd24-9120-434b-88a2-d39d1b34bb17", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--118aa5a1-4ad6-4b5f-b92f-0f04a59955d8", "sighting_of_ref": "indicator--2dd184fb-3996-4415-ad9f-ff278290167a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfb5e8e5-722a-44d4-bec8-9ddcada8e53b", "sighting_of_ref": "indicator--fea46a7c-76cb-4b5d-91d7-bfaa29fe2739", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1051da7-83af-41b4-933c-effca5ddec31", "sighting_of_ref": "indicator--c99c7146-4227-4a97-9f89-42522d9485df", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fb978b1-1c6f-4c62-80af-55b26b8ae269", "sighting_of_ref": "indicator--d08e300d-6f55-49fb-a6af-0d6efeb0217c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1830c7c1-a28b-44e7-8aca-3888496c3862", "sighting_of_ref": "indicator--d08e300d-6f55-49fb-a6af-0d6efeb0217c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96dec8f4-bb35-43db-8bef-2981482d3de9", "sighting_of_ref": "indicator--f2db3365-d49e-4839-afc2-c7c7d858c20a", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36d9dbe9-cd94-4a77-a7be-3a2fce81b1ed", "sighting_of_ref": "indicator--438a0995-79bb-40a7-9bdd-10e454b073d2", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a96085c6-c6c9-4070-967f-5e8e9fd93b6c", "sighting_of_ref": "indicator--438a0995-79bb-40a7-9bdd-10e454b073d2", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25060693-b7cc-4b9f-ad89-ab2cc1ff637c", "sighting_of_ref": "indicator--4499dd79-1d0b-475a-a6f6-d88f8c9d0db9", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--819968c9-899e-4371-9da6-0109e55d8bbd", "sighting_of_ref": "indicator--4499dd79-1d0b-475a-a6f6-d88f8c9d0db9", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59effe21-6d83-429e-8422-ad86d8f4e407", "sighting_of_ref": "indicator--4b786112-fb14-4312-a997-8cd83f6eec46", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef42b710-9cc6-4c2f-8f87-b08a463c7168", "sighting_of_ref": "indicator--5875dd3c-2b12-4ec8-8849-07496d766051", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19e46701-cabc-4ce6-8bb9-85113f2fa28a", "sighting_of_ref": "indicator--2f89274d-97c8-4246-97b3-8c8a19ee2901", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8768f381-a86c-4584-9dd4-4dd3ddef70bb", "sighting_of_ref": "indicator--be5c412c-b85b-4be2-8b9f-b4ae34ce2ff0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b1f0ada-043c-4ea4-a507-57b8db22c319", "sighting_of_ref": "indicator--06c1caf5-8070-4976-b1b3-fcb7786c7807", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4905bab-033b-4daf-8264-8b19231e0ee0", "sighting_of_ref": "indicator--441813c0-2eee-4086-a364-f6154c9c1235", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--817876a1-3050-4ae6-8682-53727ae27609", "sighting_of_ref": "indicator--441813c0-2eee-4086-a364-f6154c9c1235", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--756d73ed-8326-4314-a1b9-7b39b3ffe259", "sighting_of_ref": "indicator--5a4bcd4d-d72a-444b-982c-ba346a2fa226", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75f5c9a4-1e92-41c2-84fd-147be5a14825", "sighting_of_ref": "indicator--5a4bcd4d-d72a-444b-982c-ba346a2fa226", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1826570-9247-46a8-b26a-2808323ca419", "sighting_of_ref": "indicator--b7ff34d2-7a94-4988-a115-d15990ccfbdd", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30463af7-ef8b-4f32-950f-024ceb357123", "sighting_of_ref": "indicator--e97da60b-50d1-4bd6-82b9-06ecb1c7e102", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd5bbe4c-d64e-42ec-8d03-6f709b69e5ff", "sighting_of_ref": "indicator--d7053df0-7571-40b0-8e45-a80ef21524d6", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acd17fad-836a-4adf-ab02-aca5ba62f40a", "sighting_of_ref": "indicator--4cbf5e90-52ff-4b64-a8e0-c07fa2b1dd54", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbea9b58-8751-4ba9-9183-12d9fb730ad8", "sighting_of_ref": "indicator--c66ac3d5-0967-4d36-80ab-84c7c1040683", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70fdaee3-e3d5-4d15-91f0-8095c38f7771", "sighting_of_ref": "indicator--1b059f89-35db-4ae3-a818-fe13abf391d8", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0e64fdd-3436-4ed1-96bb-a09051b60b38", "sighting_of_ref": "indicator--ae1da7bc-980b-441d-ab25-e79806aac49f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42854821-52d9-4591-b0f4-18ef3b51cd0b", "sighting_of_ref": "indicator--2ee9da86-406b-49ce-86c9-7190e4fc5e1a", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9fbab08-4ccd-478d-abc3-c590e6365e93", "sighting_of_ref": "indicator--724b9455-f564-4f72-88a8-b4ddeeb66758", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13d7e051-2671-4ebb-9a64-1014d20213c4", "sighting_of_ref": "indicator--724b9455-f564-4f72-88a8-b4ddeeb66758", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--786103a8-04be-4839-bd5b-4cdd98a07cb8", "sighting_of_ref": "indicator--84229662-8741-4dc7-ac4a-6fa8df2761b3", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01cabfd7-1a78-45a5-8c4b-3f2de9afc682", "sighting_of_ref": "indicator--12dea424-00fa-406a-b834-3450cb9f7350", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81378e25-07da-4b8c-9b49-5b85aa74880f", "sighting_of_ref": "indicator--403d8ffe-7ed1-42fd-ac5a-3dde2cdf1cc0", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aadd3bf9-67db-4ce3-8e81-391a07115c34", "sighting_of_ref": "indicator--8f457f20-a6e5-4e0a-9e43-18b15a6f7577", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db2906fe-1637-4307-891f-df92e44ac49e", "sighting_of_ref": "indicator--1d690d4c-1540-4bb0-9af1-270304ca6b43", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3e74657-46e7-45f4-a409-40d5ef0f858a", "sighting_of_ref": "indicator--e7e3ac7a-aa99-4631-a11c-f3fddeec9d86", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dca16ea-b18e-46da-b8f6-da5b385ac51c", "sighting_of_ref": "indicator--26da69f1-fbe3-43a6-888b-5a56f880eafa", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca099c12-b52d-4976-add2-7146fe6071c4", "sighting_of_ref": "indicator--fa7fef24-63d9-41ee-8e4b-7c40c9926c7c", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2150678e-06fc-4041-a880-4f7df4428da3", "sighting_of_ref": "indicator--8946e5c1-e71d-4747-bf85-3cfe54e3d687", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29288cee-4785-43b9-882b-ae5944e773ef", "sighting_of_ref": "indicator--edcd0e2f-114c-4762-bed2-7e77ef76471b", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--975ff9b1-d1eb-4700-9f65-a34f5e58f36b", "sighting_of_ref": "indicator--edcd0e2f-114c-4762-bed2-7e77ef76471b", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--305dd6c5-aeee-4dc3-9902-f777bbe4a2be", "sighting_of_ref": "indicator--44b5b3b3-bd4c-4600-b8a6-99b90a48e524", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0521cde-4675-4271-97a2-e17edcc40433", "sighting_of_ref": "indicator--44b5b3b3-bd4c-4600-b8a6-99b90a48e524", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29c69461-6b4a-4887-8a9c-6a35187177e2", "sighting_of_ref": "indicator--c8b1dbe1-3d18-4a47-a434-063eb005e018", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f94ff9bd-65be-4b71-8ba6-b167331732ea", "sighting_of_ref": "indicator--be31c058-6fc7-4eff-9c0b-1d9bd7dbe66c", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e55eeff-9730-48a3-91ab-749ff1cfb3e9", "sighting_of_ref": "indicator--843c4341-8886-4ee8-baf7-f2e171557c44", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7d2f87f-cab0-4568-b058-595fcfbcb267", "sighting_of_ref": "indicator--df7818c4-3596-444b-a265-f8c67d02fa43", "where_sighted_refs": ["location--9954538f-a3cf-4ef8-995a-3546ca26d271"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc44d235-eecc-471c-a76e-4ba0926724db", "sighting_of_ref": "indicator--df7818c4-3596-444b-a265-f8c67d02fa43", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a081156-6938-4fc2-94e7-abd5daec7bc6", "sighting_of_ref": "indicator--b5866c73-ac45-4957-9d24-a1051c08fa17", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--380cce1b-4e58-4e3b-a670-497566e9f2e5", "sighting_of_ref": "indicator--2e0e46d5-2457-4b12-83ac-29ec0ba62590", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cebf5de5-3c50-4c01-9cfb-87ac78ecb597", "sighting_of_ref": "indicator--fd0334ba-698b-40a8-b7cb-def9d2418cbc", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a52088ff-d47b-4e8c-b842-43f8035df9ec", "sighting_of_ref": "indicator--fe11a9db-34b8-42fd-ae5a-e5fc825e2805", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcecd640-b13b-4bd6-8539-6d3ef366c938", "sighting_of_ref": "indicator--4bb792e4-e89d-4d35-8640-5885544bcf8f", "where_sighted_refs": ["location--971a7e46-31bd-4660-aa30-3d7ba1e547a4"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e338d47-74b3-48fe-b348-4101932f4e41", "sighting_of_ref": "indicator--8d913575-0177-4cfe-92af-6b104b451cae", "where_sighted_refs": ["location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--181bd4f9-88b9-42df-a9f8-b601f8f39cdf", "sighting_of_ref": "indicator--eaaae791-423b-4ce8-b77b-133b7264119b", "where_sighted_refs": ["location--d32673b0-3320-4c44-8036-01ff8dc92922"], "first_seen": "2026-05-24T00:00:00.000Z", "last_seen": "2026-05-24T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "report", "spec_version": "2.1", "id": "report--5e5968f6-9e04-4f12-845e-d479dad3b4c9", "name": "Threat Report for 2026-05-24", "description": "Daily threat intelligence report — honeypot bruteforce, web exploit, and anonymous proxy detections.", "published": "2026-05-25T11:00:02.083Z", "report_types": ["threat-report"], "object_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "location--9954538f-a3cf-4ef8-995a-3546ca26d271", "location--d32673b0-3320-4c44-8036-01ff8dc92922", "location--971a7e46-31bd-4660-aa30-3d7ba1e547a4", "location--8d85ac89-37d8-4a7e-bdda-0ea68fdefe98", "location--42737d5e-a4ef-4603-bb2f-8145b63c785e", "infrastructure--c073622e-2a7b-47ac-835e-d0af097abf36", "infrastructure--a9a47473-74c9-4301-b094-333152e652ff", "relationship--f287d83e-e7c7-4f63-a9cc-1493bf8e117e", "infrastructure--1a847c3e-be27-420b-ba1a-137be3986120", "relationship--bb519c7b-abfa-4639-a4f3-bc879f36569f", "infrastructure--ff1eba30-a336-4d64-a63d-585e6970284c", "infrastructure--6a11e054-e409-4cc1-86ee-a6dc3cc91c31", "relationship--bd2616d0-2777-4955-898f-14a7e53c6a35", "infrastructure--14b2169e-26c9-4d97-8826-1efc81f57011", "relationship--eddf462e-da71-4495-adf8-199122ec51a5", "infrastructure--e9544fb2-f188-4bd7-b8a3-814ad28a2234", "relationship--2c96a10f-6b09-4abd-9e7e-a9fa8bd9cd97", "vulnerability--0658f8c7-3aad-4b1a-a6a9-1721ccbde1ea", "vulnerability--c49bc997-a777-4d72-a03d-4f7af0e75fd6", "vulnerability--530d0aee-6039-42fc-9da7-d36f84529692", "vulnerability--63210108-760c-4b1e-81b9-da8400b84cfa", "vulnerability--271a0d64-6d2c-431f-a3ef-aef8b38ee0ed", "vulnerability--c526e552-61fd-4157-bd2a-33ee42d7f0a2", "indicator--fd1d81dc-b04a-4116-a458-28c0c88ec0bc", "indicator--1a668263-6430-4ef3-96ed-fdc92474b02f", "indicator--dcc099ef-8b77-4b9c-a7be-c308d1a50a44", "indicator--2949edc1-a59d-47af-b293-0b88314fb303", "indicator--96e193c7-b63a-4dfa-8546-5f26ea9ac232", "indicator--6f6df09d-6153-42e8-b87b-fecd3dd1737a", "indicator--1c9be048-3ad3-4672-8808-2300fd4d9aba", "indicator--601445fd-5141-4c91-a096-a837b0b84745", "indicator--c17242e3-3721-4b0a-8c8c-ca8438d40123", "indicator--ff2ddbae-d0e6-4290-b31d-fe0a8743ae12", "indicator--40f03bd1-69b0-4ad2-9a6d-63eeaf837b16", "indicator--0fc6b229-92ba-41ad-ab46-6d8264027816", "indicator--03a3d38b-38a2-4240-a057-188be2ddece6", "indicator--eb7b22f0-61e8-4276-a5cf-d072e33dd701", "indicator--3a0865b4-6334-489b-b75e-1311639d0ab5", "indicator--fe42ac7a-1940-42bf-9255-86a978c75f1c", "indicator--de12f650-db02-4a48-b988-9d4685fe0bbc", "indicator--673af9a6-2786-4dc8-82a0-85ac05d0fd8f", "indicator--035a529c-9cac-45d3-b0c6-6ef9467964bd", "indicator--0a1f1e45-2fa8-4c2d-94b0-641f47482a96", "indicator--77307512-f6d5-4241-9aaf-1a70111b35b4", "indicator--0a987ca0-8be9-4943-9568-3824cce3c1f1", "indicator--c6a262c4-97c2-4537-bb6c-1aadfafd2a55", "indicator--6e4d7d45-99b0-4c64-b50f-6f26c4d968de", "indicator--71d21fc6-97eb-4d75-9c3d-749de1d9d7ba", "indicator--c8e642dc-0868-45b2-be4e-1b9a92bec321", "indicator--9eaf1021-0dae-41f8-b4fa-88f139f07df0", "indicator--2578127e-8215-4c02-b710-d1a8e9bafcae", "indicator--e28a2651-a783-42dd-88c0-7b9854e8e2f2", "indicator--22a77a61-d860-4030-bff6-7586dc2ad930", "indicator--e74d319b-64ad-4d66-8252-604794ef0eac", "indicator--d64a7be0-7708-46b0-9b0f-a200ab3dc5cd", "indicator--423d36e0-6222-42b0-9b42-7353683f6a5e", "indicator--03760a35-e850-45de-bf72-08b457c64e6d", "indicator--26e24bac-8f1f-4310-82f6-d7d4f9b9b8b3", "indicator--5c588ed4-a97c-4e62-aa79-f67b70b65888", "indicator--18e58771-8d82-48bc-8651-cb9d6f76d785", "indicator--47b94e2c-97c9-4613-a385-8bef1e2fb857", "indicator--a23590a2-aee4-47f2-a0cf-0acd737d8020", "indicator--deb1f0cb-2c7c-46d9-92bd-15970e841678", "indicator--bd2372a6-70fe-410c-9383-d6ee8d385465", "indicator--a5662590-e172-4f6b-91f8-9d445777cf09", "indicator--9d04e17b-1686-4b19-a9a9-08f64db752dc", "indicator--81e8315e-49b2-48cd-ad83-4fe2a315bb57", "indicator--c15f0fe0-20ac-4d92-a8e3-a7d518a2acbe", "indicator--cff97bf3-ca52-471d-b12d-829c9a4983ec", "indicator--7d961493-8aec-40a0-9ccd-5173eedc7aec", "indicator--91de531d-deba-4b4e-bbdd-e8218bd519ee", "indicator--930b5405-148d-4b37-b601-225b7bb0c069", "indicator--4c54f0b0-46b4-4022-9f68-66cf1d4bbde3", "indicator--f68e7c6c-5852-4219-b795-c0fad57a5532", "indicator--c2ba24af-0752-4f97-a4b5-955c74a0eb8d", "indicator--9fda8889-b2c1-484a-bbea-a7a536c93131", "indicator--763e3939-addc-4ffb-b119-4d17a9c58f6e", "indicator--9ac80931-cc99-4f7e-a43e-acd3d08eeb39", "indicator--d7c5639f-5b09-4475-a3e2-b6e570280b49", "indicator--29b9f82b-7a28-4585-b551-b457821c4d38", "indicator--8ea0e5e5-1da0-417e-8fa3-2ddbba9a413f", "indicator--42e674f3-9770-4fd7-a58b-6ed997b5aac3", "indicator--6cae7ff2-1ec2-4396-841b-3b5ff13532bd", "indicator--79adc963-772a-4f9f-bf77-00ff02f6a7a2", "indicator--665a7781-3708-41f6-a34e-0230e5de9bb3", "indicator--73c0302f-c634-4f3f-a5f6-d9be3cff77f7", "indicator--d8c4b1fa-14cf-4d23-9c54-9945ffa78a7a", "indicator--da63f796-62e6-4dfe-8b1a-3213be686ec3", "indicator--84e435af-9bc1-46e0-bc6a-5157a791b1f5", "indicator--5206525d-5519-4467-9075-f27442c68232", "indicator--8da1cf30-1b3e-473a-995a-fc56bddc5286", "indicator--99bfc58f-f594-489c-a678-8c6c6480898d", "indicator--060ab6e5-8edf-48ca-9b24-d3bba6d376a9", "indicator--8b36b6a1-23f0-43cf-9766-77a46ddfcc69", "indicator--e4d99c5a-5779-48ce-91ce-c93c75ba00b8", "indicator--ff9c97a0-0e3f-44c4-831d-3e26b3ffe209", "indicator--ff663a53-1890-475f-b3c6-4dcc68dd5a6e", "indicator--47e35ad9-ae09-4c77-be17-66b4e4d3aac1", "indicator--6a0596f5-5ddb-40aa-ac2d-3a6941353416", "indicator--447eb5ca-9ee7-4f1e-a65e-5ffb39224846", "indicator--74429804-bbfb-45b6-b4e5-5ce3e5f48771", "indicator--9e341d10-ad21-4ec6-8688-41d7897eb4dc", "indicator--f5c7176a-23db-4a63-a59c-e4b3ce9ca2e3", "indicator--352e0be3-a0e6-4ce9-9ec1-734d7a808b8d", "indicator--5ca90fc8-c06c-484b-b18e-21808cab9bd6", "indicator--e11d721d-a3fb-4fce-86d5-59a05208f00f", "indicator--3b2da704-e88f-4d4f-9fbe-e2cf1bc36ef4", "indicator--64853283-e49a-4f9c-b32b-9b498241a6b9", "indicator--28a81b1c-6dd8-468f-a1e7-936087f0ebbb", "indicator--12ec7ecf-9d3a-44e1-8f7d-279b7596599e", "indicator--ea2bf0fa-7c25-45b3-ba18-b432fedd6929", "indicator--a46a43a9-bd97-48a7-b5cc-ec711dd1dfb6", "indicator--acdaed5a-12e9-4cca-829c-7ef87308e248", "indicator--1002b6c2-50f4-41c9-8472-84971abd4bd0", "indicator--0af69f67-b3bd-4987-9394-c747eef611e2", "indicator--909aa7cf-3dc1-4719-9763-cc0aaccb83ab", "indicator--7e268074-ee09-4edb-9a63-b03d51f23d7c", "indicator--762a50fe-4701-4e47-866a-0869c7d0d740", "indicator--75642237-ac3a-4846-a99d-ddd9b68e414e", "indicator--51bef104-1634-4095-9ba2-e3893d5b8c96", "indicator--f21c6465-384c-4d1e-b4b4-4149263ffc0f", "indicator--820ecd18-ef94-4214-ab26-6e9af5455b57", "indicator--f1b461c0-63a0-4a58-81ca-45cf19fada05", "indicator--dce25de5-46db-4663-8875-68266f775eda", "indicator--de305e26-1cb4-449c-99cc-7cc4a42acb74", "indicator--49a43ed5-f345-4e66-8252-0e39fc1b8d82", "indicator--e962cf7d-60c7-48e6-af4b-2f77da14b910", "indicator--42375d65-faa7-434e-aa22-30e9722ec1e2", "indicator--1cd6387e-59cf-4337-b774-064292dd6cf1", "indicator--8a686fef-f136-4728-befc-3bb02339d6fb", "indicator--8c4e01c0-91e3-40a7-b24e-bd28948a6ebe", "indicator--9f60c446-5e20-4e9f-8d7f-d0c726157e3a", "indicator--9f400370-f194-4310-8c3b-d3bcd67720bd", "indicator--ad298266-addc-4fce-ab1d-9b69dbc5b136", "indicator--81795fd5-62d4-477f-9763-4a1d2c3e5c55", "indicator--39dd25cd-9723-4044-8c5e-2c856e88456f", "indicator--0b9c2031-9990-48dd-ba07-5728a7281383", "indicator--2afffd9c-dce0-4c0a-bbeb-14ded431fb1c", "indicator--e5230633-3828-4348-9230-637074fcf99a", "indicator--46e52017-e87b-446d-9d7b-12a8c610b66a", "indicator--6fb196ea-1b1f-46bb-97cc-b0282053945f", "indicator--748b3ea1-8417-4458-9283-cd7cdecec765", "indicator--ece0927a-b04c-46c8-a8af-6392776da05b", "indicator--6c88dc95-dfa7-40b4-bd46-73ab116d6c2f", "indicator--e3a91950-d536-4cdd-abb5-a09c32ce755d", "indicator--c5417281-4213-498c-b03a-8c82e27b6ed8", "indicator--19b53619-463f-453e-a9bd-a79ff65bd989", "indicator--72fb2ece-b5aa-4d00-b2c1-e42d7f92063c", "indicator--55a4bef1-a81c-4969-87d9-c70eba9babd6", "indicator--bfe62f3e-f1a2-448a-87a4-1e05b80860f4", "indicator--767bc6ee-8476-4a1e-bca6-66535fe6e220", "indicator--3c9a6e5d-1b8b-4721-9657-17eab7ac55c0", "indicator--18b552d0-8d2d-4a10-8d1c-342c9cff4403", "indicator--3300a66f-8424-4992-8847-3f80374fbd40", "indicator--fbe279b6-1362-4c53-b830-87ee126f14a9", "indicator--8204f04b-2c21-4599-8bdc-b68732cbb3c0", "indicator--52b42a84-e7b8-4d4d-9efb-d8be2d7b1cf2", "indicator--22c4bab8-101c-459c-abdd-e3485dc887be", "indicator--5fda7c9f-2dcf-44d0-bfd6-6ef667f5c447", "indicator--d62e0a42-4a3c-429a-b113-ab7bd625b7b3", "indicator--188e66e2-e431-448e-9cc3-d5d8ba9d3e35", "indicator--51994511-e14c-4a66-83a5-72c8474bbfa9", "indicator--ac33d884-fba3-422b-9753-781edf7a7251", "indicator--cf9ad39a-2088-47bc-ab2f-bf3d52dfdb0d", "indicator--68d33f3e-1e87-4f1e-add9-7000324a3b26", "indicator--4371e7ea-6a95-49f9-ad56-b24266dd10f8", "indicator--418306d9-7ed1-4a78-8679-00d314839b97", "indicator--eb554435-991e-4e04-936f-a1527f218c6a", "indicator--8ced1407-8cf9-45f2-bcba-5bb7182aa7cd", "indicator--75868b4b-b4ec-48d0-80d3-fc355f7adca5", "indicator--0b89799c-70ef-4f9c-b164-76fbd09b4515", "indicator--a58b5637-e88b-443d-b09b-cb64d6427cb3", "indicator--33f50308-625b-4cb6-9e5f-6027030a05c8", "indicator--bf81f9a3-91cd-444b-819b-ffba67748e91", "indicator--9fb20120-b51a-4431-9747-62a510fe6113", "indicator--31dfa805-6ade-4bdb-a2a3-5ff751768425", "indicator--ee607c13-1e67-4ebc-9365-96abaf8d0d67", "indicator--aa6b9f17-46f4-4273-a5de-14438948d3cd", "indicator--34104727-8fa0-4391-8567-178cde71cd06", "indicator--de896bec-62db-494a-a531-2ff2ea724234", "indicator--cc31bac8-b083-449b-bacd-2023a87ff365", "indicator--fe874526-20e2-4849-9246-c86e986a580d", "indicator--d71c6bf4-6e98-4f15-99e9-49579c0d6a39", "indicator--ab7e4377-51fe-487e-8cd9-004a16edead9", "indicator--dbd2fe01-473c-4f8e-b3c3-14fba6102274", "indicator--28c9dcb3-e362-4a38-9ab2-55b3c1a4fa8d", "indicator--bcfc2481-abf4-495f-b887-cdc6bd1e0c74", "indicator--e06c5495-6f7b-4e77-b456-286653495079", "indicator--79e79db4-aeeb-4588-a041-6dd549fbd09e", "indicator--90b90f29-ee48-4eff-9c9d-7d251645ca05", "indicator--56424f9f-5e30-4259-abb9-9db4fb35d3a1", "indicator--5713d5d6-f784-407f-9d81-d77d5111396a", "indicator--07bc338d-50b5-466d-be0d-74369ebb221b", "indicator--b147ac13-1950-4145-ab45-9dcacf7b9653", "indicator--db1f1fdc-7092-421e-9bc9-58676c525089", "indicator--ed374c49-2c47-4e5e-a379-0837277fd76a", "indicator--b881dc56-4c85-4159-b609-6b926750862f", "indicator--e3aaaa90-cc06-4385-a675-0f0511b8e210", "indicator--1dc7456e-1c04-4192-8062-b1b0daf071ac", "indicator--f62d8d51-bcac-4773-81ef-7148123bc738", "indicator--b25af515-cb24-45af-82ff-996a6e24b523", "indicator--4bf3c076-c543-4816-9d77-a84390321ac0", "indicator--8455d48a-76ca-42a7-a7cd-60683be3c968", "indicator--c6bdcd8d-034d-4c0d-a91c-16e948c6b4ce", "indicator--34b7a734-350b-4859-89cb-3ac66b1c9332", "indicator--98f252b7-d011-4702-bf7c-24610158f8a1", "indicator--9dffc0b2-63cf-4562-a369-466f928dd9b1", "indicator--720eacaa-5bf1-4058-a911-c422e47e37e8", "indicator--f88172f8-6303-4ba4-a92d-b0e26fdf6006", "indicator--7d7bb128-02b2-48d5-8f6d-a1968181c234", "indicator--06b5b27d-6b96-430d-bb72-16d7fe7d1d82", "indicator--ab23d87c-972d-4e2d-a913-ec0d0425f2b0", "indicator--38fa71f2-f066-47c8-ae6d-de4b5dca5d67", "indicator--eba8b8ce-630f-4dc2-8890-d05622076405", "indicator--50963d33-d47e-4034-8df3-f47d344f47b0", "indicator--a3030405-0c43-4bfa-a3de-7236ccde3045", "indicator--4ae9da6a-d8e4-4524-a7bd-d60274f6cb94", "indicator--fee946f9-76c6-40bf-ba15-7193b88e632c", "indicator--2ce2dd78-7c4d-4d6f-b829-dce79f81a145", "indicator--5badfe29-de74-4606-ad47-38c7bba791ef", "indicator--185506fb-2b78-4e87-b3f7-2951da5ba073", "indicator--28139f96-748a-4f4c-a741-94141e95aa70", "indicator--7605a26a-ebe2-42b3-bb66-8e4ee09c66c7", "indicator--c685c716-e928-4d44-b2a0-49295ec68a78", "indicator--52c7ea44-25d4-485a-9c5c-d31e21fb9b7f", "indicator--6f666891-a157-4794-98c0-aa0c0ae016c6", "indicator--30305653-2141-4fd3-99bb-bd276322e98b", "indicator--e59f0062-9dbc-4791-945b-cf090f2477d1", "indicator--dcb788a2-caa6-48b2-9799-619c7cc3d215", "indicator--0483e921-bf84-4a18-9d33-8dc1adb01cad", "indicator--0ca17ab5-2538-4425-ba1a-9497d7e3b377", "indicator--05195adc-08f2-4e18-bdcf-f9aefdf366e6", "indicator--9a7328c3-7ca2-4c38-906f-582a63f267fc", "indicator--7418b799-afac-4578-be8f-55983b23908d", "indicator--1ca4c62a-9c8b-4c79-baef-800c70b1ce1e", "indicator--27bc24ad-8b16-47d0-9e4c-b737e61d7a62", "indicator--9cf2d48a-7209-4cdc-af36-841bf524b3b1", "indicator--6459b2b2-4c50-4733-a648-06a5f038d2cc", "indicator--f9cb30ce-69a1-48ae-8f52-dc6fbc0e5083", "indicator--0ccee5db-1e74-41b1-abe2-4fded84c4373", "indicator--1b2c930a-0507-4caa-8eaf-6b8a2b2ce99c", "indicator--d9ca19e3-1fc5-42f8-af8c-16dfe98a2e59", "indicator--1cf3705d-7528-4f5b-9b2c-5299084f978e", "indicator--39cf7bda-912c-42d2-808e-8cbd72f63a7c", "indicator--50c927ed-4934-4100-af97-38153d51234f", "indicator--d9f11f09-a887-4653-905c-d23f93c8e791", "indicator--bbcb9d87-8f02-4166-bfae-b492e4a30138", "indicator--b0df982c-5578-4350-947b-45875f8adca5", "indicator--f676926f-c23d-4b9e-bb4f-8570ac402003", "indicator--08f79ab6-10d9-41d6-b7ee-5f4913ad6aa2", "indicator--117b57d2-9679-41f9-9894-a257aa1db662", "indicator--ad9e0f2a-8c95-4e6b-b745-5cfedf3768ca", "indicator--b8ac68e3-60e4-4c87-a41a-53c056036605", "indicator--f2a61a7e-7490-4166-9174-6accab35e15e", "indicator--fd8eec3e-cd6b-4e46-8ff6-fe09a625a5d9", "indicator--296f385b-7836-40d5-a0e2-7d8887457109", "indicator--513dcdf6-a397-42d1-9018-f002984eb435", "indicator--aa646906-547e-4758-b988-bc5e49e0030c", "indicator--2a8fdc5a-31d7-499a-963d-a7325196a0bc", "indicator--81e71599-f457-4940-9048-469ad56d84d7", "indicator--78645bbb-c026-4d5a-9aad-b60566ac7603", "indicator--ddb8666a-4bec-49a7-8fc3-ab3f5c15bb8c", "indicator--95a2734c-f99b-44f4-ad3c-ed912fee0f37", "indicator--b1695472-84bd-48ad-ae87-ac12c85953d0", "indicator--22738da6-a0e4-45d0-ace0-553f80cf5364", "indicator--bf57ff47-fff0-45c3-91e2-eff59feb57e7", "indicator--5942452f-cc29-4fcd-b4d1-61de0a16bc1b", "indicator--7211b5c1-6433-4951-83bd-b9513df481e6", "indicator--52c21c7b-36e9-4d2f-914d-fbae8e58992d", "indicator--e0a5e5eb-f521-471e-84ad-a78928cc3e69", "indicator--46ee3047-3807-4373-879d-dce17c057468", "indicator--70bfca34-1af9-4f38-a967-ad22b871232f", "indicator--4431d0a1-fe09-4671-ad38-002897978739", "indicator--f9b5acfd-81f0-42e1-8811-3d9f82e736bb", "indicator--aa495da3-e10d-4ade-bd20-91d912c512a2", "indicator--e7bd4610-29a4-4700-86a8-a4700f63d6a2", "indicator--e287a21f-6ed4-4af7-b848-b8343d2a4e28", "indicator--0e5fbbdb-805f-4d30-b498-45616df384c4", "indicator--1feafa79-caaa-40de-b795-a2c872f5c1d9", "indicator--27befad4-a998-44fd-848a-11381e260f76", "indicator--fb982cb1-30a7-436d-b26c-56582fd92d81", "indicator--35c8c09d-d33a-4dea-a465-89ab49b3e769", "indicator--3d4e9d44-1ee0-4dc0-b37b-d8b05aab0b90", "indicator--35af8180-7309-4dea-9758-3e6e0d19c9a0", "indicator--e85e4c49-9805-4659-ad8c-2be6534ff0dd", "indicator--05af7da4-fd8a-42e4-a5a8-676892bbf0b0", "indicator--32ca782c-a1f1-4355-b0a9-ab1a63603b57", "indicator--4a6e725d-e7ee-47c8-b3b2-5acda8e12a56", "indicator--c81a7882-8551-4d1b-9a88-c04008028336", "indicator--e509faae-17c8-4940-b6b2-1668e8e86b7a", "indicator--60d72cf2-974f-40fc-8313-dd70b785de09", "indicator--4ce82a42-019e-4964-8828-d8e16630d0b7", "indicator--8e02eebf-ead4-4eac-93fd-9616d4af690f", "indicator--1c7e43b3-6cfa-482c-a20e-9c57953d0e1c", "indicator--c800ae32-eb21-4703-bfe7-2f0dd982ddf5", "indicator--c244d4ae-0ce1-4e42-b5ea-16d6dc72630b", "indicator--362cff62-cfec-49c5-aea3-6422512c672f", "indicator--f5fc5d91-68b8-4228-9236-3f0c51e85635", "indicator--02e174f3-c9ff-4527-8bd0-8416c03fbf38", "indicator--21472ba6-1a3b-42d3-a1c0-997153723208", "indicator--32d5d546-7ffd-4dcd-8183-cb6ce9398963", "indicator--531360c0-c41b-466a-ad11-2a67d5684478", "indicator--dc47544b-b02c-4bf7-a9dc-f3a834225c19", "indicator--ab8797fc-e39b-47da-9f45-732437b2b78e", "indicator--8fa03ee0-a4c0-4725-9dc8-0ac66623cae3", "indicator--89f5d2ac-f031-4084-bf63-467a20de4f1c", "indicator--7f51ad4a-d014-47cc-8c0c-703447eb2e62", "indicator--fc7819bb-7151-4836-b1ee-c20bc5f57568", "indicator--f2b0fa6a-87c2-4ace-a3f5-0d3bfe5c873f", "indicator--72b98d29-67df-437a-8c95-1bb57176da4f", "indicator--eef22df7-b3a7-40a1-8f84-21547422dceb", "indicator--aad7fb63-a331-4493-8554-73eae734026b", "indicator--f981c474-4a75-456f-af8f-e9bc55bbec04", "indicator--8c578d80-1d94-4402-b79f-554ed8d31bf2", "indicator--4f172c7a-6864-44b3-b1a9-e9c3848e37f6", "indicator--5d074bfb-2b0c-4a52-8f7d-7091438126ee", "indicator--1933cf38-34df-47d3-97eb-ca2dc5d04ec1", "indicator--e70a079e-3985-4a87-8d65-9bdc87d54465", "indicator--3d5b85fa-9243-4571-8fc0-63eaba8c3a21", "indicator--c9020eca-11a2-4438-af27-c8b1a2194cb6", "indicator--859462e3-3805-467d-bde4-69ca71ed533a", "indicator--0c4492a1-b4b4-45d4-8bc0-99a665d7894f", "indicator--ddce2ba4-a79b-42a7-90ca-8c5d4c328c3a", "indicator--8f817fc4-8407-4e47-8424-1b985c76f6f8", "indicator--f0426d4f-f0b7-4693-b018-f292e5d17815", "indicator--321d04ab-be2c-42f1-bcaa-af5d9aa40476", "indicator--1eda7cc2-9c80-403a-961d-1c8d2e94803a", "indicator--e83b3695-b781-4695-88f4-2d4c809c3731", "indicator--b0558d99-eecf-4c7a-b8c7-0d3409e24459", "indicator--371a64f6-dbb1-420a-a032-062244583daa", "indicator--0f847200-fa4d-4761-97d1-f37be3889612", "indicator--d2d2a9a7-423b-4c17-a582-e63edd79ca85", "indicator--ffc215af-fc3b-4471-8fbb-c300702ffcb6", "indicator--33f8ba20-7e03-43d9-a85d-47585b36f5e4", "indicator--8bd210d4-662a-4bad-a8f1-7db54275c660", "indicator--b62b0639-4ff8-4a76-9eab-5f4e4c21ec6f", "indicator--c84c1797-801b-4f6f-9c13-8c8b7d5f4bc6", "indicator--73d988bc-e8d5-4877-937c-40b57a672178", "indicator--15dd2aed-1e0c-4b67-a78d-19d2c67d72c7", "indicator--f826c67d-0207-4706-9f21-a85d1d7f112d", "indicator--47509896-b9c8-4942-b2bd-a60f92266026", "indicator--50d81869-89a4-4f4c-ae9e-874a21e10173", "indicator--d5a024ec-ceb5-4313-b487-58d5181d46ec", "indicator--7cdfbf83-06e3-457a-bc39-73c60d379c7f", "indicator--7c69f65c-05e6-47e9-9b58-58eeefdeb57c", "indicator--3b94cac8-35bf-49ee-8bba-eb7d130c6d60", "indicator--aa017a09-d6ff-4a10-947e-8e8e66f6e70f", "indicator--8c0c0bcd-5042-4b86-a5c2-22c6d5bd6f2d", "indicator--eab9d28c-bdc4-4087-ac9f-c128c5a62eba", "indicator--9d0523d5-8754-4a89-b837-9e214efdb63f", "indicator--5c3c5869-11d5-4f1f-923b-3e9094c4e0db", "indicator--65d37871-532e-457b-8a7d-c6c960f09208", "indicator--6f25e56d-c331-4953-a0a3-e1625ed9176c", "indicator--5aff2047-2d61-449f-8251-c1a3f51fb12d", "indicator--aa66a5f3-60a6-4090-af94-1fb427ca2497", "indicator--1821c0a9-8705-4224-b50c-d1063237cf7a", "indicator--39ef6f65-9f22-405e-8d7c-3ccd7706cdcc", "indicator--4b8b41cc-3361-4a33-995c-5bd3cfb4e83c", "indicator--8d74d58a-7b23-46be-9f26-99cec53b7421", "indicator--76b57e32-5824-40bc-b005-1f2f71887a97", "indicator--b05cf301-af0e-4188-bb37-5197a2625262", "indicator--5c02e7f5-c695-42ff-a491-8e01b33205bc", "indicator--631dbd63-5041-46e9-81c3-0638191db5b7", "indicator--36668931-f131-4007-b454-fa67f7ed1aa5", "indicator--c4da2a08-dfc9-4d3d-be9a-ba2001c63d27", "indicator--4783321b-9400-4f3f-86b9-260d18c8d795", "indicator--f6000c6d-6b2c-4e0a-91ab-2af770b5ea6a", "indicator--a7293988-7f5c-4525-bca9-969992a2b694", "indicator--3dc488fe-6b23-461b-a68b-241d3c46b425", "indicator--ac65eaea-7451-48a8-af30-9c9ccdf2859b", "indicator--551fff6c-ae8c-42f6-8630-0fec48d39550", "indicator--d56f2483-9f85-4dda-a0f0-4b9c25242eb7", "indicator--86558ef8-783e-4cc0-91b2-2b04f8162d70", "indicator--55c7cee2-5aab-4c58-bb19-fe3992543549", "indicator--7e2cdc19-8b7c-45bb-bd9f-d158940d4a96", "indicator--28e8967e-3df4-4c37-a837-4f49b2ce2080", "indicator--817dd39e-6d81-452d-a812-4bb5fab2d40d", "indicator--158cf9fa-b6fa-4d98-9fa7-b765947316bb", "indicator--35e578d9-40ad-4a5a-94ae-4edfb7748e43", "indicator--d913cda3-69af-4526-845f-919f58925367", "indicator--441e04ef-f95d-4df4-852c-d5dce7c84a84", "indicator--15d8ea7f-410f-4e31-b012-c9ecd37efef7", "indicator--37102bd9-648c-4eb5-92ca-7130ee6991a5", "indicator--c756824a-7e36-4488-ad8e-3e33a5975376", "indicator--74d125c4-17bf-4bf9-ab75-77cd066416d3", "indicator--cc11eaf8-5c52-4b09-a6b1-7c92cee0ad20", "indicator--cea2e7c3-deba-41a0-abce-688771bdc5e3", "indicator--f6553611-9504-4ce2-b490-b4402c5a17ea", "indicator--59dd1237-8f79-4eac-8f4a-cdb2103a26d2", "indicator--1f856967-514c-42e3-9cd2-23c1dd8105f2", "indicator--a73e0282-27f7-4823-9c25-cf899634097b", "indicator--51c0f7e2-6b8f-4b09-875d-452b61fd9975", "indicator--61aceb8f-58cd-4064-980e-4b9da630cb3a", "indicator--f7bc875b-c478-479a-b1b2-20a07bcf5146", "indicator--28e8e102-ba7f-469e-a028-ad2d122d4584", "indicator--bcdb6d9d-9858-4b46-9c1e-b984a507d175", "indicator--34a48ae4-e9e0-4051-b2d1-9d8f2a3b9580", "indicator--07194678-dc02-4f29-b251-948179d4726f", "indicator--9641d888-4bce-4e50-af98-c1182f20f629", "indicator--34e7f42c-51e7-419b-b1ef-015a1c8a6b63", "indicator--a266f66a-8ea0-402b-8c89-508c766d4629", "indicator--af8b631e-b653-4dd3-8910-195406aca659", "indicator--fd8f65a6-a425-4f8e-bea2-69b4e54243c7", "indicator--ae2a3943-b52c-49ef-ae27-13fb7b4011c3", "indicator--f989b3e9-be65-4dce-82da-11a85701a19a", "indicator--7324a806-b7fa-407b-bc50-87fd827db154", "indicator--e7795645-fbea-4ad1-94b0-22d6c17d8f8c", "indicator--87fc4ab5-19e2-4417-ac42-58e336fce484", "indicator--1b807886-d2e0-4b5e-b2c1-c1d14b1fbafd", "indicator--6e86654f-e3e0-45b7-a5be-888cd5079ebd", "indicator--ce8e0b80-4caf-4c25-8e24-8c3ccdb3bdbf", "indicator--30fa0a19-f01b-4e65-83ca-fd6f286bc182", "indicator--6b7775ff-8b10-4b93-af34-9994b381f475", "indicator--0c116e19-7665-4229-927d-ef3b4309d28f", "indicator--79824125-c13b-4706-921f-cbd1da461610", "indicator--73d964b7-4960-4504-a378-fd7a1208c617", "indicator--91522762-2295-4d61-aa14-5a1dbe6abd3b", "indicator--93902353-f588-4cd6-8a81-3f6f13ec6716", "indicator--1b700304-be22-4eec-abbe-2d06dfd8b721", "indicator--f3ae9361-3e5a-425b-904d-05b5db5520e5", "indicator--e140bfa3-0836-4402-ab33-f10fa58a0bb7", "indicator--de4d32ee-e56e-4e15-a95d-b88471ecc024", "indicator--3057d5e7-b8f7-4bc0-834d-d2e86be05129", "indicator--029fe071-c51a-40ec-a2c6-3fb917674c55", "indicator--2a490731-bfde-4c28-aa8d-226ca118a7c2", "indicator--577890c9-46cd-46a4-8121-7945103f13ef", "indicator--688a08a4-6229-4db8-bf9c-b8ebbc9a7c3f", "indicator--03119ed1-83f4-494a-bb5c-221a5651cd0c", "indicator--a759267f-567d-40d2-9f80-e8c2e3c120ff", "indicator--f09fa327-7dd3-4628-827f-beebd0822f37", "indicator--7f671fc8-4ec4-4aeb-ac57-8a98e1396b2c", "indicator--b218808b-6f15-4943-8e9d-5e3b1a69b5c0", "indicator--0f669c7e-eb4d-4497-b7b4-8323e879a99c", "indicator--a7f5dc91-ecd4-4e3b-842c-070db380bf6c", "indicator--2f05fc81-d2cb-4160-b675-35b407a65875", "indicator--0d8d4086-f7f6-4834-98aa-6c61d7f5e380", "indicator--7b9973ae-4ddd-44d6-b9e7-e26898659edc", "indicator--783f344b-7a51-4e0f-9762-9dec230d7686", "indicator--76a91a5f-b358-4bde-bc75-d538c25d26f2", "indicator--0ebcfce0-f289-46fd-b084-442cc5a0d553", "indicator--9b01b1f5-de93-4e06-a304-5eb5468559a8", "indicator--74f24e36-55dc-40d0-9fc4-a253a0a2f74b", "indicator--92fe6683-d226-4e4b-b3e5-4ab844ff68c4", "indicator--4e63092c-67bd-4972-9cac-277e9770ea27", "indicator--441588b6-0172-4447-93ff-9e22613d5714", "indicator--f8691e6c-a3e5-436d-b291-f2dc58f8cd86", "indicator--7645641d-53e3-4e23-9e59-234d312f2a81", "indicator--6003d9f8-968b-4e7c-9d68-c14e9018da60", "indicator--d1e9deeb-681a-4411-8865-6a897eaa3774", "indicator--850bc9c4-541a-4cb0-b5ab-1c8bc8b37c53", "indicator--21e555f9-a067-4566-8f44-931c63081df3", "indicator--8409103f-24e1-4d47-96b0-fa3481506fdd", "indicator--219ddd1d-9c55-4e19-b73c-71fb78977952", "indicator--60ee1895-647b-46eb-a1c6-7d3c8925a37e", "indicator--7b2e13f6-5ca3-4c89-b6cc-853461a4399e", "indicator--9b1a1773-af7b-48b8-878b-a9e40a0229b2", "indicator--d202ae95-f201-4241-975a-063c475ffef4", "indicator--f90c4edc-f5e7-422e-b38b-31ea779ce548", "indicator--1b7eb04c-b9c4-4fb5-a17f-d279c8cc4536", "indicator--5bf42ede-9aee-4fa8-a120-870b196c4462", "indicator--121b7114-7e5a-45db-8d1f-cdb26fef66bd", "indicator--e6d153be-d77b-4814-9b1f-0b8ff2b3c391", "indicator--a8fd8386-ad2b-46a0-9193-c2bd8ab750e0", "indicator--75317611-1b53-4c51-88f4-9806289a10ed", "indicator--9fb9f9a8-b9ac-4606-8bdc-900487686a0c", "indicator--05129843-2e12-4f82-bc04-a13c279fe7b2", "indicator--f925a1a1-3a54-4477-ae78-23be891f3fe3", "indicator--f8729388-2ddf-4f87-8ded-d1b27684e867", "indicator--d3d889de-7829-4138-9e18-9d74a5fee6f6", "indicator--a6af0d6e-9678-4d54-ac85-f14b80f5e8b0", "indicator--d402f91a-af9e-4a1e-8c85-9deb2baca70e", "indicator--b2961a74-7664-4695-88c4-571e71b5b101", "indicator--890abdc1-a48e-41a3-a761-3b55c8e771d0", "indicator--24b66646-5cda-4bdf-bb9f-783c9c7ab844", "indicator--d10b41b9-2357-44d7-9792-f575285cb6d8", "indicator--f855c789-5046-4350-8d7b-8359f43bb1ed", "indicator--b17e091a-4105-4ff4-b88d-a763000271fd", "indicator--00bc4040-ca75-43ef-ab43-706d2242c4de", "indicator--70375c9b-fe4f-4124-8c8e-54c838f4fc81", "indicator--22352aef-3cc3-44c2-88a4-b5d3daf7fe8b", "indicator--ae541ba7-55e4-4b34-8676-61f6c6ac529e", "indicator--6b0febde-4782-4ee7-8641-065c5ece7ef3", "indicator--004d9077-d2ae-4b33-bb9d-20f92434a46a", "indicator--77d3ea1d-a05e-42d8-ae62-8f323bd8faf4", "indicator--5e71bdf2-9f5a-481a-ac05-2a4f7c6c2df6", "indicator--177e9ee6-3a49-411f-9c63-993c0f5fe614", "indicator--a70ed3a4-93d4-407b-9f11-9f95ecde136b", "indicator--d0410dad-ab5f-4747-82bb-530fb6ed727b", "indicator--c78631d6-bb5e-4196-bde1-893d5474b89f", "indicator--3a2e21b5-dde3-4e3f-8a03-2137efe7e2a9", "indicator--bd6a171a-3cc0-423c-88cf-ece7e5dc970e", "indicator--5b3604c2-4267-45c4-91bd-6f33edd8f99a", "indicator--1b055245-3b07-4f33-921b-d89f35572e8d", "indicator--0abc0ef8-d87c-4b78-8438-bfbbcf43c7af", "indicator--14d0d449-e1ce-4a28-a1b9-f5414b5416cc", "indicator--76e66fdb-eb62-4969-b46d-1112c76b5b8f", "indicator--93053910-2b08-4482-b39c-5d1c9149e80c", "indicator--28b3be78-3e7c-40ba-86ac-e9d4678c4aee", "indicator--879a8d9c-4e02-444a-a46e-0384ee2af743", "indicator--f75d19da-df6d-4d7a-ba96-18a3f46af8f3", "indicator--ba3f0033-70a0-45ec-a5c5-b99bb66898bd", "indicator--9a73c029-d45d-4e84-b196-6b0f261c7943", "indicator--0f7b1cd1-ab3e-4f1c-9f1f-4b19c98f644c", "indicator--392ce689-324f-485b-a290-d06047ab39e5", "indicator--b5beebfe-f56e-413b-bc15-25e32009f547", "indicator--6ad15b89-e390-4e72-a797-491d9bfbe71f", "indicator--75d3c2e1-e6a8-48d7-a21b-2ff5b1fc43f0", "indicator--9dfd5ccd-c79c-46ef-9ab5-d4f4552f28be", "indicator--704dd470-8977-489e-85fe-d31940bb8575", "indicator--de98d8a4-1041-4efc-9458-6dd6b08684cb", "indicator--1ae90e94-a34b-4a91-ac44-328359a59826", "indicator--874e9866-3641-4e60-937e-421fa95d9560", "indicator--9609bc0b-d05a-44ae-bae0-292458ad3e98", "indicator--a5d84771-fec6-4f1f-b72c-b9e1cb7b83fd", "indicator--69171529-e13c-4544-bd91-3818c648d20c", "indicator--d0146d8c-d03b-4967-8249-7f3e4f085ffd", "indicator--d9e61cca-7a47-406a-93cc-627bab7cfcdc", "indicator--c0ad94ba-b931-478b-a46b-9ff9290c08d4", "indicator--28d86f35-6f13-4bfb-94bf-dc305a3e1956", "indicator--d44f5ba4-07d1-4934-9aea-a619f0dc38ba", "indicator--c878a448-2938-481b-8612-bddc7a2e4d12", "indicator--4db05c48-6e5f-4089-ac18-a8e52e2a48a2", "indicator--bcf5f875-78df-4f85-9f6e-54889ecad427", "indicator--d5baadbb-444a-473d-9025-fa22cf28b59c", "indicator--1eee04b2-c460-4ac0-b6b2-29c4c4d24e3e", "indicator--005e246b-2385-4c6b-a20e-68f440c50683", "indicator--5a2ac4d1-d02d-4078-9f8b-8b54f2f6dab7", "indicator--1b9e8c25-4125-44c6-ae62-46fa9233b8ea", "indicator--292e2c46-5203-4dc3-9d77-4a722eb62fea", "indicator--12b9bc09-2241-47db-8571-f113aefee0b0", "indicator--6b3710a8-3e03-4638-af0b-d8107dc6c91e", "indicator--1805e6c8-09ab-441c-96f4-00a0f73a3b6c", "indicator--e2461ab5-5244-4eb3-880d-5e9abef6b530", "indicator--a209e3e3-a0e2-4285-9174-870fb3d69164", "indicator--9aebc588-3398-44f9-8921-9e618be93775", "indicator--277d9812-e547-4dcb-a004-0cc557530bd0", "indicator--eb6f941d-f78b-49b6-8acb-d7f42061586e", "indicator--3bc21c10-0068-4cd7-8634-b6eed9ba29b3", "indicator--1b808432-0787-4481-bdf4-cef33fd5c954", "indicator--1962c0ab-4707-419b-a036-114ba6dc3c63", "indicator--273a9653-baea-4ee7-836a-3021ab1e16d8", "indicator--65c240cd-3a47-4134-bd39-93ce38e25777", "indicator--3c768aa9-fa6a-46af-b385-fa0e7113ac89", "indicator--36190dc9-0b25-4a23-a6ab-3acc97912527", "indicator--f3f3ef5e-42ae-4230-a78f-4a035b3be7a6", "indicator--2474b06f-efb2-4824-a3fd-f5ee2aa4dc09", "indicator--611222df-619f-4d86-b2eb-67cb0e457de4", "indicator--9ed1e324-b6af-42e0-b9e4-881c547a6b35", "indicator--8ffbfca1-1c3c-4806-8184-aa6f55743de7", "indicator--a08b3beb-3cc6-4ff3-afe8-7b8f3f77dcb4", "indicator--bf32dcfb-1a2c-4e33-8631-ba323a52f2cf", "indicator--16ca4510-0a58-4e64-bc4c-33b14667e9ae", "indicator--f7ffb125-333d-4f98-bc57-c4819791b88b", "indicator--83295ebd-366e-4e53-8ffb-ad349d6cbec4", "indicator--3c9bdd79-2364-4154-9fdc-0a897885164f", "indicator--e65aa2c3-2de7-49b1-a0a3-42a9ae58affc", "indicator--eb03113f-bd71-442e-a7a4-a8aa0b437af2", "indicator--6f7569d5-1c74-4a37-9ead-29a337ffc925", "indicator--73b0a3db-9f93-4f0b-b940-008c6328d966", "indicator--dbe1a823-897d-4228-a894-2fae9ae1029f", "indicator--73410ba9-e5d6-4eea-9c6a-3392fff665ff", "indicator--73e1b378-0e0d-452d-963c-4791d19b39bc", "indicator--afc07d91-1478-404e-8513-d385198d6a41", "indicator--e548794d-8c96-4583-a2fa-34afce0d029b", "indicator--36b59f80-a1bd-478c-b590-f55168d24bfc", "indicator--c7b05a7f-31a3-4397-9258-8fb86b57fcac", "indicator--ef16609a-0e80-4915-9e81-80f2402a4710", "indicator--ca7694b4-a5c1-4369-ac10-779bdfa99d0a", "indicator--2f667906-5219-4ecd-95f1-794b86b06f28", "indicator--1c9882af-7217-4385-9dec-6e173b5cf72f", "indicator--7fd17c22-b6e3-47df-bc21-73c6864e99cd", "indicator--6de7c0fc-628a-450d-8dfd-d136f57aa25d", "indicator--abbb28fb-3552-4067-bb88-9477cab90499", "indicator--1cb6f322-2c92-441b-baae-809d9529a3b1", "indicator--df6674ce-cd4a-4b22-850e-b2dd1192296b", "indicator--23ebecd1-717b-4877-ac38-68078c3f30e5", "indicator--9b7adfc1-db86-4a23-aa4b-cd1837cdb6c5", "indicator--7ead3a18-a203-46ec-b99c-0ddf8fff5f68", "indicator--270a0db8-2700-4266-9c76-90c0c3d84f0d", "indicator--605890bd-504d-4f7e-b9b2-933564489626", "indicator--24d2d175-002d-460c-9781-b9532458d1e0", "indicator--94c1f9f8-7719-4164-910e-4de971fbeed5", "indicator--9b92e983-e5ea-4ddf-9065-b358ac525d33", "indicator--c6309f2e-676a-40e3-ba4b-00df920321f8", "indicator--eb022edc-7400-4614-a464-55b8b8d94d2c", "indicator--235b829d-b6b7-4e04-a2cc-f954ad808d9a", "indicator--5e539114-3f31-4eab-ad90-bc299a43b68f", "indicator--188bc0b5-c7ea-425b-bd13-efd94260dbae", "indicator--e23d86fd-d1c8-4575-8d3c-a8f4d50386e1", "indicator--a34e9ce5-a6d1-4658-9019-3596ac1f8b62", "indicator--c9beaddb-c754-4e63-b154-c2e6221f638c", "indicator--6a23fd9d-d8bc-4aa8-ab05-449a89f7fbf3", "indicator--99171642-f254-498b-b7ff-52a062e1adc9", "indicator--c1687e74-598a-4cca-81d7-2dfeb0c7d43f", "indicator--05da7b37-a0ad-423c-9e0b-7eed3e2031d9", "indicator--530bd894-8018-4914-ae44-ea6ad1f0cdb5", "indicator--323b348e-2044-46a0-a5ea-bf042af4cddc", "indicator--6d26a208-1b36-4772-a630-24543445a031", "indicator--123fc972-0559-4f22-9de2-e8dc5750eabd", "indicator--e6efad58-eb43-4bc5-91f8-cd62b20ecf59", "indicator--fbb73a75-23e5-41b1-96c9-2f80bff18097", "indicator--0b94a57a-fa4e-4e48-9d7c-2e7969a33873", "indicator--2b66f6a0-6826-447c-b70b-1a423025772e", "indicator--9dc845f5-935a-4d1e-a362-5fbfe7103c83", "indicator--d19e0b79-b4e6-4942-9217-07aa78f27aeb", "indicator--c0377e1a-8821-4edb-b998-0e6f9fc2f4d3", "indicator--5065c92e-656d-44c0-a8af-fbdfba46777d", "indicator--e83a720d-da33-4640-a0e4-bc724e96b576", "indicator--de17a8a2-6302-40f5-b88b-7b5ca83844f7", "indicator--e4d3ae94-6574-4218-995f-a2f414123ab3", "indicator--17c35054-2bb9-441f-baad-e05104238a03", "indicator--f53b0ced-544b-4659-983b-f4a09d9cf57a", "indicator--7142cee9-0f18-4f86-83cb-b3f870194935", "indicator--f8f61fe3-c01b-4cf5-8fed-742090db882f", "indicator--db6bf9d3-fc6d-4bf5-8b20-7481d52c108e", "indicator--e859fee4-e68b-42d9-9ddc-cff478222063", "indicator--0016491e-0cb7-4cf0-b306-713af4ec1917", "indicator--c313e7df-5550-4919-a578-a9fe5709547c", "indicator--54425465-585f-41e7-ba06-2a48bfc87c59", "indicator--7aa61620-1046-45c5-95b6-dcc34f115010", "indicator--9d0ca7ca-016a-4d43-852b-8aa1ba599ff6", "indicator--5c51b942-ac6e-44e2-a960-0082ba1cac15", "indicator--7fc7d9dc-87dd-4064-b78d-92778d289964", "indicator--135fde3d-dcfa-418a-ae13-642d5d3094c7", "indicator--5a7bc3f5-c173-4455-84ec-58475a5d5c08", "indicator--18e2505e-09c1-40c3-b085-e375c41c16b4", "indicator--5767e769-7a07-4c3f-939d-2bce6aeddc9d", "indicator--5faafcf7-bd2d-4da1-8c70-500ea7d80d06", "indicator--8f57231c-62f6-4222-a7e9-ae4f61a61c2a", "indicator--dc116c6b-ad3d-47d5-bf00-dcfa754c49bd", "indicator--db238649-e4bc-49b9-859f-1eb38d90aa9b", "indicator--2b823d12-21e9-4578-aabd-eef3c07b71d8", "indicator--fb059f2f-0518-4aff-a1fc-a446d3937cef", "indicator--e955ece9-e48f-49e1-a5cd-da9c61f07ed1", "indicator--d607f1fe-f55a-4a4f-afed-ca3953779797", "indicator--c15c1a23-9306-407c-bc08-53c503ceb005", "indicator--ce286532-258e-46a1-ab5c-affb5ad0e2ef", "indicator--176462f8-c7f5-42e4-8680-845db0a0481a", "indicator--ff29db37-558f-41ac-ac5b-2a1bbdbcf157", "indicator--5d6526e7-1a65-4061-91e5-2349b4129055", "indicator--9b78a3ac-840e-4e0c-afd2-3ee8b6d004b1", "indicator--c1837d5d-83a5-4b79-87d0-cc1b93342039", "indicator--30530551-fd4d-4b52-8368-538ff9be9317", "indicator--2a8d4f29-fe3f-4280-b0cb-98cfa662daab", "indicator--d8267ba4-637e-4db8-bcb9-08d04f828f89", "indicator--6ec6b33c-6f7d-41d8-908f-c70d438ce1b9", "indicator--68dcc4f0-bbe6-4ddc-ba33-aaa869a700a9", "indicator--e447463e-ed3d-48af-80af-cd0d3306fb84", "indicator--aa443227-92db-4c61-bc3b-6859b79e7480", "indicator--5de5fb19-a237-4ac3-93f5-e6180dba9782", "indicator--efcb7a75-54b6-4cf5-88a6-20518f231e67", "indicator--8b4a9356-5d1b-4dfd-8034-9c63e67b472a", "indicator--7780a6b5-8659-492b-b3c8-67cdbfbe875b", "indicator--0b3717bd-7110-488e-9a4f-723806e1c19f", "indicator--adc20e1f-1678-49d2-bf22-71253e88419a", "indicator--5fc121a8-d5f1-463b-a8e8-d2237b3ca7ed", "indicator--8e0fe587-cee3-46c5-a041-f1d4afd36acc", "indicator--6fe28ce4-cb8b-4dd7-9eb8-6628d54119de", "indicator--49a093c8-c2f4-4cd3-8294-4c86e42a4531", "indicator--64a1fc87-200b-44c0-be0d-d898ed026ac7", "indicator--93c38c29-5960-49bd-8441-a8fd82d956bf", "indicator--986360fe-27ba-48ee-9f99-d1dfd130b075", "indicator--0cb988bf-f5ea-4eff-baca-0d4d1502fb2e", "indicator--af77817d-c45b-4603-a286-67f187ca7322", "indicator--242f31ef-b41c-4bb6-9a9c-917acfdef316", "indicator--a94e8603-f660-4481-9349-66982db9e506", "indicator--1ce641eb-9483-4531-91c0-8b90ce2178b4", "indicator--78a5f248-a2b3-4d9e-940c-88800672fb25", "indicator--a751f452-7642-4722-b339-ce31184daa42", "indicator--a616b904-11b4-424f-ad8b-79cd03da9e94", "indicator--86a46123-5381-48d8-b19d-0d8b63ae6135", "indicator--4fefd901-3f74-4d9e-9d73-4acba0d732f9", "indicator--1b489b84-81a1-4709-9f18-dc2bdb96ddbb", "indicator--3a858e9d-caaf-45dd-a928-aa19e113e329", "indicator--33f78a3a-3a43-40c7-802f-a782531d5c0a", "indicator--7b578111-3f4b-4ad4-9c66-a2a3f50ef1d7", "indicator--4b148cc1-ae8a-4d7d-ac52-37a32ef20307", "indicator--722b29cc-9ffb-4a68-bb69-05b0381750ac", "indicator--4081938b-e183-43fd-9f13-9f08ce7b8bae", "indicator--ae390d28-3ac6-474a-bc5f-ac2e3c727184", "indicator--271fbb85-b0f3-4d2e-8a2c-6ada7846129e", "indicator--9432d218-3fcd-4f7f-aba0-4eefdd1cfd0c", "indicator--a959fb56-9217-46e9-ab8a-20ff9bafacc4", "indicator--f3ef17f6-1435-4bb0-9218-0ede07c4324f", "indicator--50e5b59d-e796-455e-bf7f-be3ce1daf484", "indicator--a2e646cf-caaf-4867-a678-d7b426529c53", "indicator--4870cf2e-bd54-4677-b175-a035c0d79719", "indicator--9b5e883d-0e90-448f-8861-302eb48ef105", "indicator--39e2496f-822f-4735-a35d-6edd5fe52962", "indicator--2a38be4c-5aa4-4310-9d17-d29bb1b369b1", "indicator--1cfc7410-4ceb-47ea-ba3d-305b7f698aa8", "indicator--f7ccf416-0ee0-40e7-ad2c-e233ec5e154e", "indicator--fde379ac-baf4-40ea-a0ab-461f689b423e", "indicator--ac2d29d6-13ce-4198-b60f-60d5504bb710", "indicator--63231864-fd8c-48c8-bb17-6a291a06765c", "indicator--33118a62-ded4-437c-9ce6-5dddc157fbb3", "indicator--837f4bb7-e3c5-4497-89be-3559f0a20e4e", "indicator--b3ae6ffb-73bb-4274-bdcc-39e851a7b823", "indicator--4b4ef746-fd06-4b0c-9f65-76b3cbc478b8", "indicator--d2758060-7617-4680-ac8b-c65ffc2902eb", "indicator--cfebb531-6e5f-4f69-8a7d-8ff7100e71a6", "indicator--daef13c3-c88e-4e28-91e1-298497768a4a", "indicator--b97194b2-b5b8-4df0-a7b4-b7a4aa00e160", "indicator--b5578b04-9a2f-4a6e-8a05-c4be44f9f32a", "indicator--fc7434aa-41b3-4eb9-b1d4-dc0c685c5448", "indicator--59dfa133-6a77-4270-8b6f-36186ae19ecd", "indicator--1e55c018-cf98-4f26-8366-b350aed3fa78", "indicator--3fb5477c-25e9-4ed2-b6c4-8e5ef3734f75", "indicator--a0de103d-52ec-4020-9e7d-9fceb6186fb1", "indicator--e9810eda-591f-4a64-9beb-ec89f2e7e609", "indicator--a5cd8667-2f91-4b23-a57e-df0056af2d41", "indicator--5e39d276-6500-4a40-a282-b4f660b1ca07", "indicator--29b3d3b7-07dc-40db-9b4e-1a8df3036cd8", "indicator--0233e5a8-bc82-4362-ae54-5bf742f95788", "indicator--bd9fb550-2676-40dd-a5a8-c7a57228b51f", "indicator--cc2d0837-b489-4a31-8eac-805781c02c19", "indicator--eaaedc76-38ae-49ea-87b4-db42cd5c0645", "indicator--4fab5a2d-c456-45f6-b906-356b0296eaa7", "indicator--20d8c1b5-e8fc-4e19-9bd9-fe124ac36d98", "indicator--a48236ea-8aad-4a30-9999-54af6b6d09a3", "indicator--0dce28ac-421d-4084-858f-149af9f57161", "indicator--04e25f67-ac52-4863-b953-f4a9106b8cf7", "indicator--36396d20-8cfb-4d85-9501-a070ce83dd42", "indicator--b1e2e833-897f-4c83-b692-67dc0b21d592", "indicator--806b0728-a927-4d11-b491-b8146087599a", "indicator--cf919c49-b867-4dee-9474-d6d2d49eebde", "indicator--b2072c9d-8afa-4606-8d61-4c0965cd36c5", "indicator--1e10b809-10a9-4288-a1f8-d37780b91758", "indicator--40c9fc9c-4087-4a9e-8cd7-244b9b6d0fc1", "indicator--4101afac-cef6-4046-82f6-3354bb052007", "indicator--29f8179b-a7cd-422d-9977-9dbfc36f8253", "indicator--088b923e-84f0-4b57-bbcb-1a318527e384", "indicator--4f56ba66-42b7-4a3a-9e6d-f2d15e14f6f4", "indicator--bf25062e-bf8b-499e-9015-e4db7114edf2", "indicator--58572f76-0064-45b3-bf81-70eba4906c50", "indicator--6cc03f51-68d4-488f-9a7d-c5b8d08830c6", "indicator--9943b363-d062-431f-b1a7-11d39faf58da", "indicator--cb59b242-2e24-40b5-9256-3d5f7993060c", "indicator--6ad11965-02fd-4ac8-944d-005fe33f547a", "indicator--ca759a33-acfe-4504-b26f-553398f13247", "indicator--57d7eeb7-1ad1-4440-836c-259ad5995070", "indicator--68d08bba-10f8-437e-a20b-4cf92ce7f3a9", "indicator--8d76749d-98ff-4d0f-a309-b6ae345a18ab", "indicator--ff052259-cb25-4027-add6-08022c0b3f69", "indicator--e8b670ea-deeb-40b1-ac4d-151d76b7425e", "indicator--5435f829-a12a-4969-a3c1-ae522b4b7229", "indicator--750ec737-e559-4e11-a955-073110aac611", "indicator--7879c28e-6830-46b7-8faa-55c17cc458f2", "indicator--d9c59d99-c5e6-4f03-8db0-1a1f51dc9bf9", "indicator--e76262ad-00fd-41af-ac23-ba39db287de8", "indicator--52704714-3baa-46b1-bce0-37087d26e613", "indicator--70dec8d2-1fe6-4881-84e5-42fcbc15bcee", "indicator--7fc22889-d7fd-4a5a-86ec-d8f1e1151697", "indicator--c47c5f5e-8dc7-4013-8faf-6b2f617ee4d7", "indicator--71412eb9-ac8c-4bdc-b2b2-f94f610ec5ed", "indicator--86123186-7f16-4c7a-967f-95aa7a7d69a2", "indicator--02b77c47-f4c6-4e9e-8890-538ccadccdac", "indicator--607b40ad-46eb-42fd-9fa8-e76e06dba581", "indicator--4cf78878-b9fc-4283-82d5-95620a132575", "indicator--9366731a-c8c0-4c98-9f5b-8cb6725799ae", "indicator--81b7dab7-1931-4547-8638-2de22052dc97", "indicator--6d7e553b-dbbc-4e93-b43d-cbe6a4bd7485", "indicator--a3584089-21e6-4b98-b242-2693eedb282d", "indicator--ad7d75c4-75ac-4aea-8044-e3cfb6adf276", "indicator--0d49e6f0-afb5-4ffa-bd2d-1f46d5253404", "indicator--7639949b-d875-4815-a691-108aeeaced30", "indicator--258059d6-1cfc-4646-902e-833d44c3dc0f", "indicator--9ca05cef-f520-4e44-8624-73ae4e927396", "indicator--bd3f0ce7-c810-4f8b-8267-b3289424faee", "indicator--e222d7fa-84fb-4e5b-8fc8-9e44e05b16dc", "indicator--2cd3be0a-e866-4043-a9e9-3e24b8b1c094", "indicator--fdb7550a-59d5-4f16-82b3-75333c0c4d2f", "indicator--07436092-640c-4cd0-b83e-2e313cf87b74", "indicator--c6467690-37b8-42c6-8aef-0384d3432767", "indicator--b25de97f-9a41-4faf-9f45-b09e06bb426f", "indicator--f7fd21f2-0151-4098-b952-041283af516c", "indicator--f053a89e-8465-4f34-a392-55e581579c2e", "indicator--ff12e4f8-fb3d-4a98-943b-36aeb3c92d5c", "indicator--f534041b-ff91-4816-84bd-be9e491eeda9", "indicator--86f2b6f0-cb95-4588-92c7-693a92c80063", "indicator--feede521-faca-488a-be16-ba5c63127ce9", "indicator--b03e1672-07f2-4fb7-b6cc-8ea8faf03a34", "indicator--17810069-6e08-4bb5-9217-2ca219c3221b", "indicator--231d2a3e-150f-4310-8280-86dbdfd46700", "indicator--844cf233-6060-4269-a548-63e0b4f7b117", "indicator--92e7c6a6-aa39-4079-819f-1f2dd2f15367", "indicator--3d3bafd0-5736-4923-bbd8-715ee0d4da4b", "indicator--2aaa6ab8-cf94-41c6-b24d-fd75b0ca051d", "indicator--17da28e1-d765-4f6d-8211-1645dbf59b13", "indicator--c0df3d54-c42e-4032-ae52-d439fb0095ec", "indicator--5e3e9e6d-125c-4726-bc58-bb24e95e2cf4", "indicator--7ad3d36e-c058-4e4d-8765-c0b0de82bf68", "indicator--82927890-1e6e-462b-b967-9b9acda764af", "indicator--1ef88682-ea0e-43f8-839a-da8af346782e", "indicator--27221075-d346-4bb2-bf7b-0518364b01f2", "indicator--e7473413-8413-40b7-8d58-c5b894339630", "indicator--3b130d0d-e4ca-4d9f-86e3-5d6259791175", "indicator--779b252b-499a-4541-8439-07271ea4e64d", "indicator--565ac9ca-e308-4dbb-83c5-1bd9bd2a3034", "indicator--2e839d95-805b-4e89-b8f0-18ecd89d75fd", "indicator--b3b2ad9c-0e8a-49ad-a0dd-3d15a3698afe", "indicator--f11d842c-a0c2-47fc-b87a-0dd6b03d44c6", "indicator--b2309b15-9bfd-4f0a-b826-83413decff26", "indicator--14398503-69d9-4bf8-9ffc-b558be85a87a", "indicator--eb2dd0a8-df04-4f2c-8a22-c28f5ddd6ab9", "indicator--5adce7a8-f809-4fc3-a8b2-93fbc6041007", "indicator--4e82b754-0e80-4018-a379-1beb68acf6f1", "indicator--2cbb6862-dc58-42de-afbd-46d306708c5a", "indicator--e18d48b1-ab57-463d-91b6-fb6d62a713be", "indicator--63155e93-55ae-4902-9791-265c27cc923f", "indicator--5a0966ad-cd01-41f3-ab17-6981e97f5f9c", "indicator--be610e8d-e619-4826-a7d3-b786629fba25", "indicator--ab05c86d-a55d-47d9-9450-5360f82b8c03", "indicator--477da51e-61fe-44e9-810e-cc88f9a5e82f", "indicator--a8d92a85-4dfa-455b-b0a7-4d3e093efa49", "indicator--425fc872-8bc5-4b3c-8d90-18459b714a31", "indicator--cbeb7cbe-4be8-485c-9e57-29bad38c0ed4", "indicator--91869dae-1ba4-4c61-91e2-d63c4d9b2e2d", "indicator--47a06901-c973-471f-8711-bf5de83adda1", "indicator--1e921b4b-ff7b-41a9-9de4-cc8542faee93", "indicator--1d2e4870-87c8-4613-be35-112f282dcd5c", "indicator--3e4a1c5d-8db1-4819-a2f2-de07c7e0f337", "indicator--69b49cd1-8b57-4e11-940d-ff5b446ad467", "indicator--ff6b0918-c2d1-47da-b4e0-afaddfa77dbe", "indicator--4553c7d2-321d-4747-aaf0-2a34fec42714", "indicator--395205c5-567a-487b-a1c3-b7612c49d657", "indicator--07f093b6-f145-443d-95c8-79fde0aec6b3", "indicator--2fb6d965-70d7-4788-94c9-59783d03af4f", "indicator--4a9403aa-2a8a-4b8a-95f2-f95f39eb7a00", "indicator--642d9fa7-e360-4db9-9c50-781be6fa403d", "indicator--48fda2b4-2a69-479c-ad13-f535b81d0601", "indicator--391203a6-45a1-4577-86a0-809b12896712", "indicator--b3f767e4-6d9c-46fb-b8fd-722623b9570a", "indicator--5cea701f-0f72-4f09-b354-543b08212620", "indicator--f46f641e-d235-4a5e-838f-9f0b0749bf54", "indicator--e038b15b-5d17-487e-a026-ce92bcbf1787", "indicator--f48c33c8-5c91-4635-9b40-e815616e7f05", "indicator--2b5732a1-fab4-428b-802f-9a596192d85f", "indicator--939b0b6e-500a-46c8-a10f-ad204f6d5921", "indicator--8a09603c-3e9d-4ea9-958b-c0cbbf5d2438", "indicator--ce5e7e91-10ab-4e2c-8039-81505a15e507", "indicator--ec6bb508-cef3-4469-ad1a-5052e75906e9", "indicator--36e6216a-5b14-479a-9a83-aae6555031a9", "indicator--354359cb-78fd-4492-baba-a8df317ca4e6", "indicator--d29177d8-8be9-44ea-be0d-f72e40aec28e", "indicator--15e15dd3-2c3e-4d02-a8d6-b29ca69b45f2", "indicator--76579e5c-7391-4cc4-943a-0a5f74b448ab", "indicator--87040d64-e0e4-42be-adc2-39a6034f0fd2", "indicator--ad0dfef2-6a52-42c0-83b9-cf842ecda4d6", "indicator--a2a34a5a-34d2-47e4-a0ab-eb54876bdf0a", "indicator--3545f75b-b07b-48fc-8d19-6239104d6d05", "indicator--9dadb42d-9e6f-4e77-a88b-551ee49db359", "indicator--4a0260fb-abb0-4028-b48d-f7f7035d9369", "indicator--0a9ad6ae-72eb-4545-b3e5-a253bf675c93", "indicator--083e3f36-d688-4fa1-abf5-7565efe0c3f2", "indicator--4e489fc2-d9f7-4a9e-b887-39bc6f4a9ac0", "indicator--0dc59bb8-4861-4b15-a111-5362bae8dbf4", "indicator--47fd2f22-2f20-49d6-b435-277124aa50af", "indicator--dc0eef7b-7b63-4a8d-bc54-e08822be5f8a", "indicator--253c48e5-b88b-49b3-a61e-66adb556ae6c", "indicator--99546d43-c653-4a96-8da3-d7d19fc19c1c", "indicator--f4731af7-ac5c-4153-9090-73d8a512c73e", "indicator--39340307-7441-42e8-a574-5c0158a0b711", "indicator--0e93e853-add7-4cbc-b054-8a160a103ec0", "indicator--2da2e46f-1d0d-4084-be82-becb6f114f09", "indicator--1982165e-f3b7-4b91-b05b-bb6fbdcf6f26", "indicator--3f9bbcd8-b3d8-49cd-90b8-5732ae3e9282", "indicator--e5d042ff-7ef0-4122-b0b9-beef596dafa8", "indicator--332a392d-0160-4f8d-ad71-6f5cfa737f36", "indicator--84d100dc-909d-48bd-88a4-3e24a05b5f16", "indicator--4befa197-6467-4550-9097-242849b652c8", "indicator--11c722cd-6044-4ab1-b35a-46466e8e559e", "indicator--1549ceed-e8e9-4548-a3b5-bc88141ca4d0", "indicator--b9c7db71-6bc3-46cb-bfc5-33885ada6ac3", "indicator--9efc08ea-7b3e-400f-b595-87ec5526d6e2", "indicator--94d6b19a-8354-4759-aa10-c235db580c7b", "indicator--e2fbaa88-7706-471c-bb82-d46cc806dd31", "indicator--450a7938-59b1-4a73-8856-f75c2fc9afa0", "indicator--a563df05-581f-4975-a883-04550832ce00", "indicator--d13a9d3c-97cf-41c5-aeff-1e118ffd4f31", "indicator--471f859c-ed53-404f-b147-9977b3983242", "indicator--7a1752c9-f447-4a0f-8754-04fd42c51d06", "indicator--6694ca48-b5fc-4595-8527-cf82d740678c", "indicator--554f2618-7ccd-4d17-9855-bd30518cef20", "indicator--b0cd1dbe-2d2b-4578-a46f-b5b206a3fb36", "indicator--85449344-fd10-4f87-8339-704ce47db08f", "indicator--62572f88-7aba-467c-898d-c75f03c62954", "indicator--e00a57d1-80d6-48fe-a67f-352d484e1715", "indicator--30b3218d-f6e5-4472-a67e-453a2a2e3bb6", "indicator--9556f830-e14d-49ce-a3e9-45e92070921a", "indicator--f20555ea-330c-4df5-af1d-a4bda24772fa", "indicator--04b27191-3812-4564-8e50-c8d18883c251", "indicator--2656ba3b-820b-4c3c-ae11-ae7a5a7f20f8", "indicator--8deb57a1-999a-43e2-869c-173302de71e4", "indicator--d50849d3-9613-4cd0-bd99-3448ef5581d0", "indicator--c1773dc9-667a-4fe2-a814-f17ebc5b07c6", "indicator--adafb658-b9ec-4d92-bd44-788ed3d3837c", "indicator--e1297b15-1f48-4d92-b0f2-25465b1a5a70", "indicator--0a5b3e16-d0a4-4f1c-819a-cfe2afa3fdb2", "indicator--35794398-6d7c-45e2-988b-40b9b3588001", "indicator--2bd465ee-886b-474f-ab0b-2a49b0a1064c", "indicator--7068eadc-069c-4d5f-8f90-a020c4f98776", "indicator--b335e1d6-9c59-4c72-9f2c-1d009be90dab", "indicator--ff4769f0-43c1-4a91-b415-14e54f163f8a", "indicator--3f49f59a-f513-4dbf-b1f6-5b8f28a8731f", "indicator--75605cd9-6244-4731-a3fb-cb8a97a4f7d0", "indicator--fda7a024-5667-4804-b0ca-5e708c2393a9", "indicator--96d64c6c-e360-4dea-8b83-58d40a5896cf", "indicator--6264d84e-e89d-4c13-905b-9321ff1a8a28", "indicator--5af12952-66fe-4b67-9e7d-f75569d12fff", "indicator--9c2e2764-c4b2-4f53-add8-06b0235104e2", "indicator--eaedac97-4ae1-4afa-8a07-de5f38e54c9c", "indicator--dea7b9e6-cdff-4f1f-9b93-c3cd676690c6", "indicator--4654c003-6276-44b1-a8f6-c3491a8ec173", "indicator--5254d781-36ac-4347-9b71-2a701f25dd7d", "indicator--2d322866-d09f-4aeb-97f0-b3bcebbc9d20", "indicator--7f6b4005-18bc-42e1-8e53-7ca5da61c7f5", "indicator--6f47704a-0732-45a8-8958-01c1e60fd537", "indicator--f1cd4aed-a174-4641-9306-7a3b54686cb1", "indicator--f082e2c4-eac6-4d5c-ad7e-f9ac2f95c57f", "indicator--beaf234a-2a93-4a2a-bd06-45e2a61be896", "indicator--a4df355f-2090-4d11-ad4c-7fa92d7805cc", "indicator--7067aeb0-1ac3-4f4e-b12a-374450e6d557", "indicator--49286af3-3310-4c9a-b493-8ed164c718d8", "indicator--ae451b66-717c-4f8c-b85b-d84c353f514f", "indicator--7cb05e18-74f5-4afa-afbb-d4b0596e2eeb", "indicator--32c6e48b-6612-4da1-8327-5cd0e2367794", "indicator--db7fafb9-1f56-465b-862e-e3e0ab3dbda6", "indicator--d0bb40cb-ee16-468f-805a-359faf1ce66f", "indicator--ed13b2a0-5377-46b2-9356-b1ccbdf171ee", "indicator--cf5e0a80-0bc8-464e-8334-869d3dc8eb00", "indicator--177a2b44-6ab1-4c06-a947-29c9c73bcbf7", "indicator--20673f62-8a95-4eef-9fe3-e391092ab343", "indicator--7af0e35c-29fe-4951-bb6c-77338171dadc", "indicator--1578ecb8-76cc-45eb-b597-2b1c0e561f2c", "indicator--8924e543-f701-43d6-8cce-5471f6e30656", "indicator--1ef59a22-c616-4871-b550-ab8d2e4305a0", "indicator--887360f1-24aa-47d9-be20-108f1463f64d", "indicator--db511642-8da8-48dd-83da-a87f6259020d", "indicator--c129be62-7d10-48e5-9837-72ea73ebe728", "indicator--7bd1a58f-e882-4cfd-a163-fe5fb32fdf34", "indicator--6880625a-23ad-45c5-bd29-6430d53b1adf", "indicator--179c8a66-f4e2-4959-9956-73ecae257c40", "indicator--3c4c0ebb-8ac0-4c05-baae-a66af29b9daa", "indicator--80c343ed-ab33-4e74-af01-959a9f2dacb3", "indicator--ca33fe82-89dc-4fd9-9f27-d8caa1f5ad27", "indicator--5cee2d16-dcdc-4ce1-a8fc-8c5a6e12d2f4", "indicator--09247c37-2ce5-4aac-baa3-572c78c93f58", "indicator--bae62ecf-637d-45f3-81a3-a7d275d70a64", "indicator--4a5bc867-ec05-4dbb-8c47-c911f49a889a", "indicator--b1d85ab6-70c9-412e-82dc-cbe653999809", "indicator--3a805931-2436-4c9c-a085-d1af26c626ff", "indicator--d947513d-7a3a-4e9a-b97b-294ad992f997", "indicator--63a400d0-1b1c-4009-bdd0-08bf1c9945fe", "indicator--7006bf2f-ce8d-435b-9ee9-f7342f906f03", "indicator--0a14dbad-9d82-4b4f-b6bf-142a9c1f6d03", "indicator--6be89d6f-50e8-4679-84f8-1af43ffa48bf", "indicator--3b5c69a2-a7c7-4834-a0aa-4b0ded966864", "indicator--a81387d9-5f01-48f5-9041-82f95a772f76", "indicator--9f0d2416-b242-49ee-83ab-78c70f3f12f0", "indicator--05ae92b6-1eb6-4059-9683-2a634448aa0b", "indicator--ea8ddc57-b45a-4ed8-990b-750122b90d6e", "indicator--c812af26-19dd-4ab0-9a2d-8a9e7b243e14", "indicator--154a532c-8fc3-434e-8842-f72ae881271e", "indicator--9da3be7c-19bb-44ac-a74a-0f6537afacb9", "indicator--3f0f5c4b-cd86-41d0-b5c5-831192a6cbee", "indicator--852c7713-65d0-4543-bb8e-ae045d543308", "indicator--14718d85-4052-4afe-bc17-15e5421307fc", "indicator--b8f2e346-bc0a-460f-9d59-8428e1cbd327", "indicator--3dbd6f13-1a81-4ec6-9e0f-322d4a380be0", "indicator--d58a32a3-e6a0-4b2d-993b-833a83b25c85", "indicator--db797cb2-a679-4af5-94a9-3a356dbea2c8", "indicator--f14c5e0b-0325-4bf7-9ea5-1d45fc82363e", "indicator--db53f824-ccda-42ac-ba81-ef442cab3bd9", "indicator--9431de44-6817-4737-a518-2f2746e0f18a", "indicator--8f1d479c-7f1e-4866-aaf4-83613b854d0f", "indicator--956f317a-01e3-4eb5-aa76-bc473ab07d21", "indicator--8926e103-028d-44c9-816a-39487545ba70", "indicator--d94514e0-bfe9-4f74-a9b1-6cf31d696056", "indicator--d908f393-565b-405d-9460-ad76ab4514f8", "indicator--b2303c25-f0bd-44c9-bfa0-94fae9901a91", "indicator--42fb6f9e-bf14-42c4-8578-a6e230ace9ae", "indicator--65d77598-7ad6-45ad-8c64-a13e3d93d48f", "indicator--b82ad27a-1a92-4352-8f0d-bdbfca75a23e", "indicator--d2c48f05-1014-4f71-a4a5-4b91b0f3203f", "indicator--c848962f-2e2d-4a4a-b00a-af10bda9b3b2", "indicator--536f73f6-0fa0-4e63-bb84-4e6a482fd0fc", "indicator--18b71d12-d61e-4f5e-b949-fc4114f0f823", "indicator--77970f57-c2ec-4b1f-8590-1e7be695d77c", "indicator--be80599e-58b4-4136-9b86-cf43da32b06b", "indicator--46bd1df1-1146-4778-9ad0-628656a8c56b", "indicator--641937fd-386d-4ac8-ac73-462257c07642", "indicator--875fa659-d280-42fe-8ff4-b39020715b6d", "indicator--78cd4ec4-534f-4b01-8c89-027bb9405956", "indicator--685f63be-a764-4b96-a072-494e89eb88ff", "indicator--dbb3d077-f369-42a7-86ac-f1bd2d52452b", "indicator--c5e6bd91-cdd8-4243-b98c-f32b2445d3ea", "indicator--a858338b-712c-4d5e-bfb1-b1ad7b92683f", "indicator--3b22005d-1c56-4ca3-ab69-3fc0ed92a66c", "indicator--28951174-51c7-4692-a733-b9e6e7e81710", "indicator--d7236ace-a994-4fba-948b-2c38b88c6f64", "indicator--db79ff43-c87f-49b4-9ea6-8e4afc86731e", "indicator--ba023807-5dc3-46f0-863a-022a8a46457f", "indicator--e907cbf0-2dc5-4b44-9a7d-b6d7a144ad19", "indicator--828af379-021d-42cc-9b74-e53bb0471822", "indicator--713042b4-fa5a-4f54-a349-d53f06b6856c", "indicator--4cce7f63-dc14-4195-8792-52e53807c7e3", "indicator--0d8a4da8-bbf2-4ac9-aad1-90eff69a1c19", "indicator--fd6a5ac1-84c7-4f29-ba2a-fb4776eaba2f", "indicator--b456d69b-a83b-42bd-90d5-efc328461c81", "indicator--6e0424ba-2a2b-444c-82b3-b43fc496eb0b", "indicator--2d2a9ca2-a249-4082-b91b-91ea3b90a8a5", "indicator--d683df83-4dd2-41b2-b818-7116059e0388", "indicator--6541e408-4bd8-4075-af18-68fd35549d46", "indicator--c6fd602b-e129-457c-9e8a-0abbb127a3f3", "indicator--0db99872-883b-4d2e-810d-6146573a08d5", "indicator--16d599a4-6237-47cf-843e-6d250962fc86", "indicator--d2203c84-f0aa-4223-933f-dbcca626544e", "indicator--f17db0e4-a62e-4480-8b11-c8b76e91713b", "indicator--3b9ace05-a013-4de3-b4d5-7e2bbf324e34", "indicator--d6d4fe14-9ce0-41ca-bd82-8388e6b702e2", "indicator--7c8fe6d0-6df4-4889-9654-f25b33e1245b", "indicator--908be48f-e6f3-4690-9a32-32d9b48982e4", "indicator--b3db8628-95b5-45ee-a510-d87cb8782a00", "indicator--f09f8b87-0370-4b35-985b-7798b2383482", "indicator--f34637c3-fc7c-4fbe-bdcc-476bb8f3d670", "indicator--3f57ea21-f7f9-44d2-ad98-95003d0b37bc", "indicator--5cc82e6f-a2bd-4585-860d-079b8203b580", "indicator--4b627f10-9d95-4077-8aa3-4c8fc935e9da", "indicator--36f80329-ce11-435d-88b6-01ea220e58e1", "indicator--3a7d4d5d-fc01-42fb-9d75-37fc21acd17d", "indicator--0ba6aa0c-f077-4e3e-b85c-e1a284477c5b", "indicator--cc521fd9-cbb8-431d-815a-3945a82a3982", "indicator--5d148439-c897-49f8-a93c-621795d3ab43", "indicator--b492a09e-339b-4306-ac65-8c7011bfb35b", "indicator--eba41636-af4a-40f3-a397-906fbef14883", "indicator--05fc3c1d-7077-47b1-a934-56405aee2305", "indicator--a20dd21d-8ea9-4181-8809-c32399e6636c", "indicator--3f42ba25-eb16-4f6b-83e6-ea70e7105033", "indicator--37fe5e6b-0a11-4321-beff-eb9c6ab53cad", "indicator--426d6ea7-5fab-4cfc-83d7-3d135000cd1d", "indicator--9cf4828e-e076-4ca0-8aeb-29b0e2b9555b", "indicator--cebf4681-c8ac-4682-a5cd-b01e726ea38a", "indicator--33bc07e2-ef11-4628-b08f-aae0b88b91df", "indicator--8c86fc59-3f0f-42fa-9b5b-9ac1ec615835", "indicator--190c5d15-7f5b-44fa-952a-0aa129f578db", "indicator--06b4100e-bb65-471c-84e0-b4f4c6f54750", "indicator--cd38d8f5-36cf-4cef-9077-d2e0f00abf21", "indicator--212c8ad2-d3a8-415b-a45e-93c2e82931de", "indicator--540f8faf-591e-40c8-9caa-1f66473ef08f", "indicator--de097436-8fcd-46eb-bbb3-a71189be5db1", "indicator--c1b7b91f-37ee-4255-8048-65c3d8003a6b", "indicator--cedbc619-ef9d-4de1-bb31-fea989e19ea9", "indicator--ab170aed-e9c8-4413-bc4c-3ba4a8f99d3f", "indicator--dc1030bb-2f6e-4207-85f9-d0089eabbc92", "indicator--c427b872-d26e-438a-9cc5-c6fe76d11524", "indicator--e35ef310-cb5b-42d8-894f-b10bb8783b8b", "indicator--d91f91f3-3705-4a1e-b88c-3e142135e50e", "indicator--565bf3bb-e7fe-460b-b7bd-edd10bf0fbd4", "indicator--9ec9139e-b6c5-4bf5-950d-3d3b2a3ed119", "indicator--53c4c874-b64b-48ef-8780-9d7d7699d1f8", "indicator--d35ba709-6eaf-4eda-823e-dbbf347656f5", "indicator--6edd96ed-967e-4456-bf82-5db525a90b5d", "indicator--889914f2-66ad-4a62-ba6d-e2931e164535", "indicator--9ece07b6-ca6d-40e9-a27f-ad21cdee95ba", "indicator--ee4b1bcf-eb68-436e-9530-550c009c619e", "indicator--814a9f88-7cf1-4bfe-a501-52ae0c0aac89", "indicator--d5750aa7-dcef-4d61-9be8-eac65b89d3ca", "indicator--1c91287b-5d55-417a-869f-551715a662a0", "indicator--72dc6484-d35e-4b0d-8814-f4db61aefede", "indicator--63ae377e-e4fc-4e4b-b051-7c35cfd67b07", "indicator--4240bde7-7a80-4382-8f29-d4e7e0a7b4c9", "indicator--65ee08d6-4871-4116-be88-2de63e22f280", "indicator--b4960b84-bf81-4f27-a4d6-91c127dceb37", "indicator--be7852b1-ccd4-4aeb-b34d-6d662f709235", "indicator--0d4b4786-3f13-4195-a6de-61957b10931c", "indicator--e9308178-3c60-4c4d-947f-49361e58a0b2", "indicator--8381aad8-853a-446f-932b-41385d00794d", "indicator--42090a9f-d205-4a62-8e11-e85072a47cf3", "indicator--1641a9b8-8b15-4401-bf97-0a5b6157d1df", "indicator--b978277a-8f6a-487e-8d26-d6a65abf0abf", "indicator--f84499a6-0ae9-4c26-868a-61a2b7032d1f", "indicator--2b20f795-a119-4803-9ccd-4c0d95802880", "indicator--53a76c64-ca5d-4d42-85a3-feb231b37466", "indicator--2f9b018b-6319-4134-a64b-2ac549f83d4c", "indicator--079c3543-fc53-461d-af68-36bedc01d530", "indicator--6239c46f-57c3-4e87-9cbb-c2ea75caf5eb", "indicator--f654adec-e7d0-4986-af8e-a21793c8ebe6", "indicator--788cc74f-fae7-4560-a5f1-b4fc38baf2b6", "indicator--9138095a-fc89-4555-a85b-c0141e8cdf53", "indicator--b4403177-447d-42d6-b506-79c541cf524a", "indicator--f99a04a3-77c1-4c68-ac43-40ff0a0969e5", "indicator--bf524f79-06eb-444d-ae6a-e68c530e5e07", "indicator--46f66be9-84bb-4b8f-9537-89515bc106a0", "indicator--3c8c83b4-4306-4366-9006-76df87773028", "indicator--fedff35a-ea79-4ccc-bb86-de3d9454f600", "indicator--ad9c1980-be03-4bd2-93d2-858c4a5fb63f", "indicator--9b09aa26-26f2-46a7-b171-362e852849de", "indicator--163a5227-356b-4953-8f6f-76f4782c6418", "indicator--832821e7-4788-4540-90e5-c65f32e7c862", "indicator--4e39d796-3b9a-4a37-9243-f17533cfe1c6", "indicator--5e35ff49-8f13-4cc3-b149-3ad061ab85ac", "indicator--9e7d0dc5-0123-45da-b8e0-39139ddee04b", "indicator--868fe17d-e7a3-4b9c-a450-24ae748e2366", "indicator--ec5875aa-0a0f-44dc-ac92-de219d6ac64f", "indicator--57abd676-340f-4e3f-ac00-79b2f677aecc", "indicator--2b833cea-1ce7-4d34-9bd1-3ae404540559", "indicator--776f9b5d-dc03-47ec-aab2-878601422358", "indicator--fe34d4fb-3c76-4605-ae08-4f203bb32677", "indicator--9d9fb330-efb6-4330-b5cc-e537c64f24c4", "indicator--f6745d26-f721-45de-a2da-0e0bd2005630", "indicator--53c12650-d996-4e8d-8d93-19fa6e503a59", "indicator--198dd7ae-0089-483e-99a3-fde8008e29dd", "indicator--732d46ca-69cd-4e71-b08e-76577e40d795", "indicator--50948efd-10c4-437b-9d40-4dbce5ec2483", "indicator--6668e647-1d8d-43d8-ab5f-ae52eec1c0e1", "indicator--bf4065f3-e8db-432d-b7c4-674e51102daf", "indicator--5d4f1683-9820-4464-92e5-ed16c6ccd173", "indicator--88d52020-4c92-4214-bebe-d2371d1d55b4", "indicator--9371a06a-b441-41ec-9a2e-d4708f25556f", "indicator--fc171f07-b598-4fb7-bec1-8906128d4967", "indicator--a4207950-6e3b-4328-8b33-0569617032df", "indicator--cb4c54ef-ca80-4aa5-bc67-937a3a70139d", "indicator--01bf2e1b-493c-4e8f-a6b9-949498992577", "indicator--935aafe6-974f-4df0-ba56-65c0ae10f7ad", "indicator--38c8cbb7-c6ff-428b-9252-e650b95ca008", "indicator--b45f1817-17cc-4bf5-af5b-6a9f9436e10a", "indicator--390b0f76-2ef8-460c-8ec0-6ce0f708d014", "indicator--5246d6ed-d598-4d73-8666-90b249dcbb3a", "indicator--b0bbf872-c82d-4186-b187-0c4f49e9f6a1", "indicator--d91137c3-a3a7-4af5-86ba-54de0e7df720", "indicator--4d9df4f0-b806-4da6-9d37-6d9f820c03a1", "indicator--20eedd39-a87f-4b43-8589-6fa72694b537", "indicator--277d7ed9-280d-408f-9c41-dd3e982a9f04", "indicator--9ed8c5e4-727c-420b-8fef-fec91b67d068", "indicator--c18c1d26-61ad-4640-8dbe-6976e4bebe9a", "indicator--aa643531-b35f-4022-8c13-ad460e09229a", "indicator--3c7dc32d-4a16-4181-a254-334df376fd5e", "indicator--b2070f59-94e4-4893-99e2-a3c5ab3c5f86", "indicator--5c0f3d55-0c4e-4374-bd42-ced28ef55828", "indicator--5b63bfef-31a9-4187-ab10-703209f19792", "indicator--de15c807-5f29-486d-9f0d-7acd7a5f7a71", "indicator--9b85bdac-5f21-47dc-9eea-c222289be8e6", "indicator--9b78b454-6f2e-41cd-ab8a-3ecb3d89db4f", "indicator--1af58c98-15b4-46b7-a236-f88341ef4151", "indicator--e604702a-52b0-4c6c-8818-b0a1f174ae7c", "indicator--d3b0310e-af78-492a-8d6a-e35854d3510f", "indicator--95b972bb-5fa6-4d04-bad0-99829bfe11a0", "indicator--f99ba560-3cc5-47fd-8d5b-178771911c6f", "indicator--cfd7e48c-5806-46b1-9606-a92c6d7b5c37", "indicator--58809f44-8391-4f20-89bc-0129d34b0ea4", "indicator--0908ec64-ab0c-42b3-a14a-4ed71a04b0c0", "indicator--cb4833de-d3ee-49b7-8c67-9f732bf37dc3", "indicator--e00116dd-cef2-46f9-95eb-e2cb061ddacc", "indicator--7f3f1f84-92e0-4ede-93a2-899126e99d72", "indicator--9cb966c2-f653-47cf-bd7a-381b023da3c8", "indicator--bc44f7a7-56a0-4d21-ba85-6735c5abab31", "indicator--4d984c76-9d47-4652-912f-452f599261ea", "indicator--41bf9b1b-dd3e-4aa3-bc63-6f1c4207730e", "indicator--9b47bf9a-4125-4502-96f2-c933c36a0d9e", "indicator--3bc49d4d-5c05-42fd-8ca1-1533b90bd986", "indicator--3e1f42da-3314-4f4b-a8e0-b9bdea3bb52d", "indicator--288d2263-5130-412e-9ce3-9a882262958b", "indicator--dd56dfbf-0371-4a00-abc9-79e0d5b1ced2", "indicator--5602cb7b-26bc-446f-bcd6-b20d12e1d981", "indicator--65024626-ba00-411c-9d9d-4ceeb067510a", "indicator--4570b7c6-27c3-45f9-abb2-6afac882b7bc", "indicator--163d0742-c0ae-449c-a8de-bb0b5e4f8bc1", "indicator--84a74f67-33be-414a-b1a3-1681eac890e1", "indicator--5f198c73-35b9-49ec-a71b-ccf981fd5d36", "indicator--f8ef7b8c-469e-44e5-b6bb-15c6180fbfad", "indicator--5d3be856-bb62-4669-9214-0874a77420fc", "indicator--ec7b7d8e-eadd-409e-ab99-39d753169947", "indicator--f3ef5bf0-c562-47c4-97e6-58e4a0334103", "indicator--f6afd634-8208-417f-a225-7c7255d6f72b", "indicator--9bc64fcd-5ebf-4b9f-88da-9c914f4f4640", "indicator--27dcb13d-58a2-4756-afb2-0cfa7c80ba7a", "indicator--5a7157be-6679-4c02-9516-4e074bd4b45b", "indicator--d2c22197-65bf-4f94-8ac7-7c78af8ca861", "indicator--8024b2c3-a320-43f1-be9c-de7b0bb08efa", "indicator--5551f427-5e11-4d9a-9186-d5327fa20f84", "indicator--c6729464-2150-490c-91cc-1a9ed75e4c83", "indicator--357d4578-8ac3-47ad-a068-934cccf29c59", "indicator--e3d0d416-3da3-4fcc-9610-0b753cd38de7", "indicator--d42e45a6-758c-4cdc-92ad-e375b78d912f", "indicator--21a08fe4-4593-41c9-aa01-3e7d1d2f728b", "indicator--acaf89b0-e474-493c-9569-0d81a1d976cb", "indicator--16c4bc36-aa4e-47d6-9809-dd29bd65442e", "indicator--ebf8bb0f-255b-49c3-ac4f-efd3de649705", "indicator--21b36f4c-7d5a-46ff-b55c-ae1554d3c135", "indicator--f4ee669d-c55d-42cd-bb60-eaa97d35333c", "indicator--4f802666-a337-46dd-8192-4da2eef60792", "indicator--0206c423-61c8-41a6-81d2-0522ed5dfc58", "indicator--cbd48d66-deef-49d3-a481-5c373c97f900", "indicator--5a873699-947b-4502-a3ba-6f2a2f0f7cc3", "indicator--79b033c5-7da8-4305-8ff7-58a7c7e6d438", "indicator--4ee3e6e7-8cd7-45c6-bd47-c25dc7061033", "indicator--0fb66cff-2948-4aa8-ad18-b341dd63a650", "indicator--eb88e843-a845-4ab5-9a90-12f036a7db45", "indicator--61b4ce6c-978e-47e3-afc2-d5080eb5e28e", "indicator--eda3c6f1-f859-43d5-bfa0-b5f64deedd84", "indicator--c7c90f4c-91da-462c-b33a-b2ab78b6af0c", "indicator--c799869a-f006-4b45-a1dd-2507709efcde", "indicator--5f7c1a55-0c93-4273-90f9-41738d91866b", "indicator--89785c6e-2d7a-4964-a53d-37e1f4fd48b8", "indicator--ec5dd500-d161-43eb-970e-1975a7132566", "indicator--367a74d7-28ab-4364-adbb-df7e9ab5d3ca", "indicator--ca4d8604-bfaf-4b19-9237-1c9613dc156c", "indicator--99196b57-bd7a-40bf-b369-adc188f9c6b6", "indicator--7adf976d-4da5-4258-ba11-e7ebc76ee361", "indicator--7bca5564-c3f0-4c9f-8127-3e0cb24bf717", "indicator--459581a8-d486-4f6f-b3d6-bfc7e8c2b891", "indicator--82192680-0ce5-4490-9533-9acad7ef5495", "indicator--965dda86-e982-4ab0-a9db-f638e4d77a60", "indicator--42ea7a1d-b353-4c46-a0b8-c92516200cdd", "indicator--3dc3fe2e-3602-443c-a672-e12fee08521f", "indicator--c0742b67-f2f5-4bc2-9d21-6da67a2088ba", "indicator--cc5cb631-3f3f-4a93-b490-56899719a0d3", "indicator--613a0f60-c862-457e-8a8a-a17ce2910e0a", "indicator--f98ab71f-63d5-4960-8338-b2af5060254f", "indicator--7a916184-5918-4847-a545-7372ea5ee20f", "indicator--99b64fe6-b182-4325-a1a9-43eddf2fa011", "indicator--cf083a63-9204-492b-9119-fbb38081395a", "indicator--1ad4c2c2-f020-4935-bd8a-e8b1651bc211", "indicator--d06c2b8e-543e-4ec7-8ac2-371773cc747d", "indicator--15861480-7e73-4570-bdda-f98fe2faa097", "indicator--ed14bc92-1f74-4b39-b4b9-d243be391e0a", "indicator--53b9f5c4-dd85-4232-a5cf-a2cef5782b0d", "indicator--59030488-4778-4d88-b389-6d634f450903", "indicator--d75a82b1-d88b-40bd-8a97-885948d9513b", "indicator--ab9a8b77-711d-42fb-b786-caea24a9510d", "indicator--ad90c776-b11d-431f-a46d-64be502a70ab", "indicator--3ecc5514-8baa-4ce4-959e-e0a4c9a1503e", "indicator--336a535a-7ed8-4107-b47b-b94f395bfced", "indicator--b3006886-c574-429f-8e02-67caab60cbbd", "indicator--28f79ab1-9faa-4a13-aefa-4552b3b76e57", "indicator--f152d395-36e8-4291-bd53-839733264d41", "indicator--8bece5ee-ebc7-4d94-8cb1-faffb77889ab", "indicator--c5fbda37-6e32-4491-9d4c-00ea82a94a42", "indicator--5c9f8e1c-eb33-4fd8-8fa0-4877f14345ea", "indicator--69394d46-f207-4dd3-b415-31a1307094e2", "indicator--d78193cf-1d5f-4a61-a7b6-58f287ecf998", "indicator--966d85e0-52ea-478c-849e-c33b86cce1ac", "indicator--0d03dbc4-7cdf-481e-a321-91d41a8c87ff", "indicator--ad9e7e59-17c9-4751-bc3b-e1c5accedfaa", "indicator--33e6ec48-b6c7-478b-9961-cda86dff525e", "indicator--d3ebbacb-da62-4f17-ade1-9cb29b1509a5", "indicator--1c8fa269-f002-4999-9cc7-5582cc11d9b3", "indicator--c79bff25-5ac4-4223-b628-aada6bdea6d7", "indicator--440b1823-d73f-4a9b-9e4c-3751be66e78b", "indicator--dfacf24e-016e-4474-8343-02ecf239679e", "indicator--ccb251e3-b21d-4803-8035-a9ff43da575b", "indicator--4e0f5cb9-3d78-4add-bb0b-c64ca228daf3", "indicator--28a5b118-843a-4b25-9334-4b78a887de28", "indicator--9eddb540-55c8-4db2-b626-639b906b0135", "indicator--104f1e15-ae73-417b-999c-41b4b87b42fd", "indicator--a20cc7e6-795f-4946-bc4c-36c730f3e06a", "indicator--1d7de407-efaf-4043-889a-bbed4268df16", "indicator--ab2ad294-7873-4d15-839a-553d10564d7b", "indicator--89e0280f-2afb-44b6-a523-f67a53f0030a", "indicator--a6271be8-3c03-4d1f-b1dd-29460de66ea4", "indicator--f764ecac-e154-4491-a49a-53a120a349b7", "indicator--2f32138c-9814-49a6-98fe-345b9f292aa4", "indicator--db4f76d5-a8c0-4c7d-8cab-13dc77735dd2", "indicator--9a708f1d-10ba-4079-a271-f43aebb9da68", "indicator--20689cc8-566b-4cbe-87de-ff6e93af9766", "indicator--a37f31eb-5c81-4e47-8d80-734bb1e8a479", "indicator--d39426de-ccbf-4325-9808-c03ff431f3c6", "indicator--30ea6a53-6379-4638-847b-5dc4be934f84", "indicator--baaab722-135e-4a1d-9622-07662ada13a4", "indicator--46687be7-ec51-4ad3-998a-21fcd1fdbd51", "indicator--6fff257f-4fb2-4618-91eb-5d86416ce69f", "indicator--9a2dd082-aec9-4d60-9fdb-4e790eb44a82", "indicator--1911b9df-87cc-403b-8499-ed51bd0d32aa", "indicator--86b8e51a-aff8-4305-9025-96e143a5c44d", "indicator--b3fbaeae-fc96-4f67-9406-7d594d006320", "indicator--04ab7da4-ebb5-4bfd-a9bf-ec0cea70264e", "indicator--42ee5e83-317b-4f2b-b002-7038990a08f6", "indicator--a42eb435-88f5-4fcd-907b-b7bdab397a86", "indicator--83c6099b-61b2-414f-b058-effcfd0dd036", "indicator--710ffc1f-aa67-40cb-adb9-6130f042879f", "indicator--c40e58b0-5d2d-422c-8868-79efaa7f4c93", "indicator--1c528a80-b9e0-4c69-998f-956094774b8d", "indicator--66f56174-fe6c-45d5-90e1-5eab5b68eabf", "indicator--458a1bff-6f01-4953-af87-8193dfa1c6ae", "indicator--77a9bfb9-a456-4553-8a83-0e66528c6cba", "indicator--536b9f9f-e895-429e-b5da-3ba6dacd0122", "indicator--0c597831-dc21-45c7-bd93-847cac9aafa3", "indicator--ce3ba2e6-8f5c-434a-9d7a-a8141c76da2d", "indicator--fe23db11-eb56-4def-b568-33a1deed7ef0", "indicator--1015b319-ad7c-4b96-b319-d4820c6ea421", "indicator--29db27d2-7ce5-49c9-9d88-833a5cbc5919", "indicator--a86ef742-0e07-495c-93b1-c5137a7df43b", "indicator--da8fa878-ca59-46fd-b72d-8ac73e01f6b4", "indicator--85db7889-de53-4071-912e-50f7b98a61e7", "indicator--0e3643d9-d225-4e6c-836e-d86322a7117b", "indicator--0f1a7fc3-744c-4922-a1bb-c260b7f6adbf", "indicator--921fdb0c-6482-47c5-9ba7-38d8bca1df43", "indicator--3a51b986-4fbc-42af-9ebb-b878351e560a", "indicator--0963dfc3-8630-4be1-a7d9-5bfc79d29373", "indicator--2f2e1701-ff13-47d7-a24e-7369e269485c", "indicator--5c06cd41-1606-4a46-98a1-663b9d65298a", "indicator--f31fa05d-d123-4b5c-8dfb-e75de7682c76", "indicator--1b3549fc-4c71-4d74-84fc-c0c623d1a4aa", "indicator--d97f0cb2-b0d1-45f6-8951-632f1967f11c", "indicator--547c9bc7-b5fe-4063-993b-eb4c343b5a82", "indicator--99dc64ba-c207-4fa4-b5be-274d50ab1261", "indicator--6f2d1fed-d675-48ac-affe-1c5a688f265a", "indicator--14a3416d-63fa-46b6-9337-55efd98af442", "indicator--f70931c1-b159-4c25-a7ee-b4927409490d", "indicator--67434d1f-8a06-4496-8e6c-66aa0f1c59cc", "indicator--ab7013f4-a4e8-4bab-9cfa-0408a9f2112a", "indicator--31014567-b2f5-455e-bcab-b3f59215d61b", "indicator--9195cf30-dfd1-4811-a1ed-baca3f212bf6", "indicator--ef73aac8-1bfa-44b4-bc4c-565afc3f263d", "indicator--ca0eb70c-e231-4d74-a7a4-5c1a931e1eb0", "indicator--efe1780a-dd0a-4f36-bf68-a4904e0103cd", "indicator--8a80bc27-f8db-491b-9c2c-91f39d59f85a", "indicator--a5821082-c011-4dcc-9573-28ddd244fa94", "indicator--9b49a41d-ae9a-4a55-a40f-b97e9b84d167", "indicator--bb037201-bcec-4fa3-9d9e-9e55eed185c9", "indicator--060c7ebb-b6a7-4118-ac57-c6d5bfb3ec75", "indicator--6ad3ac8f-7d53-4dc8-8452-1ea7266a1a1a", "indicator--a5d458e3-616b-4e74-b04d-89f710b17e4b", "indicator--48596d5f-0433-464c-9af4-96faff545bab", "indicator--77b623ad-1b9c-457f-9c1a-015aaded946d", "indicator--35dda5dc-30b1-494e-953b-417336cde483", "indicator--335fa0d9-0eac-48d7-af2e-3d70dee1c2e9", "indicator--16a9b13d-3ebf-4798-a995-b67a036a6ac5", "indicator--832c77a8-48b8-491b-a7f3-f96566bcf4d0", "indicator--18656967-67a7-4c3e-9714-c5bb6863ae43", "indicator--dcdeb667-c045-4b1b-b5dc-f88b3c25e4b6", "indicator--beec3b05-159e-4711-b5f4-0f554e17b9a4", "indicator--aa74bc13-78be-4959-b012-91a31ee080a1", "indicator--33b1f265-05b4-49d4-92a2-6dd55d26d228", "indicator--71a7f52c-6106-47c2-ac16-2a05c709ca0c", "indicator--9ab0818d-56ca-45fd-b0d2-4801b60a5693", "indicator--5684394b-8db5-4cff-a1a1-1a378245c53a", "indicator--00969830-d9f6-495e-8de8-7851504c9780", "indicator--c08c17ce-ca59-4ade-9134-055a21acdb83", "indicator--1f498da9-6b06-49ef-b9b6-f856fae2c6fa", "indicator--1f9fa068-d665-452b-a11d-d6fc644576b7", "indicator--9b80b250-c938-4ed2-89bd-e0094f1d367d", "indicator--b3a1ad61-1f27-4823-a015-f3b1546de2ee", "indicator--5f799de7-2bbc-442b-9dae-0ad798dc306e", "indicator--84efde15-2c49-4b79-9d00-c1a7612cd36a", "indicator--d90e5216-447e-4fdd-852b-6b6f683db60f", "indicator--f81b5224-bab7-4040-a967-f17d748960e4", "indicator--b24cc870-46b3-429e-ae75-5f2e89aede83", "indicator--9863b9fa-3491-436a-aa33-e38dffb553f4", "indicator--fb0eb927-ce53-49be-9dec-47d2c99ed830", "indicator--776a59e9-4f46-4072-9d1e-114d80bab200", "indicator--2d05f61f-7253-403c-8216-c0000309d6e4", "indicator--6c864e60-c7a6-458e-8da8-8c106905bf35", "indicator--ee1fcfa0-4166-4942-a53b-46df9adc53f6", "indicator--df6c4acf-86ea-4bcc-8710-482199c34ed2", "indicator--a2ce31b0-42e7-4cf9-b35b-433670daf04b", "indicator--49b318a1-f8b6-4577-a123-ac4d33e609a2", "indicator--19dfe9df-3d17-4731-a850-f09ae4f9bacd", "indicator--748cda8f-a2f2-458a-b116-216da94bf339", "indicator--5990a8d7-3ba5-4b46-8a03-3c58d6c96505", "indicator--81e510cc-c229-4b59-b191-54a14dcf6a8e", "indicator--f6be3dfb-1ec2-49a9-9430-148f3dcdec19", "indicator--2a5860cc-dc3a-41b0-8605-73718358c39f", "indicator--c79098f0-06f7-47f5-962c-cbfd51637328", "indicator--deb3d719-471f-4920-b517-ead7c4d609b1", "indicator--ae1da4b7-4f11-4911-9e40-a7a5a6814794", "indicator--1cdc2ed6-ba1b-4680-a094-4582bbf1160e", "indicator--04d8d1d8-3c6c-422e-9762-bb59c0eadb2e", "indicator--ff29ecb8-0535-4983-ab93-6b87b1b5457d", "indicator--1f06f239-d025-4a31-b53b-072e6dfcd69e", "indicator--e21a52ea-38a0-4497-b94a-ac8bfad7f9c0", "indicator--e129083b-9907-4421-a230-1f728fc0880f", "indicator--2956b77f-9153-4a80-b12c-7366b047fc37", "indicator--9cba8b70-1bf2-45e4-b0af-6f4736c8f94f", "indicator--3218c5cf-1725-453b-9cd3-706da0c3ffcf", "indicator--aa36114d-a156-4a4d-bda4-390152cb4040", "indicator--cd351f70-be7f-4149-b4e6-1c634c218a03", "indicator--835a61d3-959a-431b-8101-015b65f65bbc", "indicator--450110e1-fc1a-4a5c-a7df-e08f1cc9f30b", "indicator--36c0d05c-ebd5-47a2-9656-06df4dc00548", "indicator--cf53cae2-4f35-4fbc-b887-5c84939bb440", "indicator--5e7bbc2d-25d0-4695-a903-725a01bad251", "indicator--f9b26594-fbb1-4de0-8339-965b37fadcb3", "indicator--e8d9b348-c21c-4076-a9da-333e42166a00", "indicator--fe40f07f-70db-4906-90f3-c790900c4fda", "indicator--82551114-aa64-4100-8497-533d24689552", "indicator--f41a12ad-aa1a-4eb6-a8ee-4dbe97740b97", "indicator--1de954c0-7b9f-4478-b007-22793c6265d0", "indicator--891f3a0d-0de8-4b45-b2c3-36425968a704", "indicator--d5798c89-fe33-4cf7-9b87-924d8084c629", "indicator--d20f8c3c-2bfa-48b8-917c-dccc32a1aa45", "indicator--ce3ddafd-084e-4017-92e3-437c9831f906", "indicator--da250b9f-1dce-4479-9eef-56a81320bea7", "indicator--123f4787-0c3d-4745-8982-0196708fbc16", "indicator--d889203c-7b68-4ee6-95c2-98309d124098", "indicator--a13bdcb8-636a-457c-b7ee-a85fc113cbec", "indicator--6d31c4ca-a7f3-4289-939d-39104a8f1237", "indicator--6491a7ac-e6f6-4df8-869d-b64d55acdf31", "indicator--c0fea909-daab-46a3-afe3-0b7431fe5abe", "indicator--123677a7-35e6-4dda-8919-78782682561f", "indicator--d9dd6573-3625-4f04-867b-65d15ffb2709", "indicator--90d6b9ca-5d48-4bc2-8362-728ea2ff9ab5", "indicator--52c53888-08a2-47e3-af2d-ac82a8aff091", "indicator--c7f51c8d-8aca-4b8b-8a6b-a45e17776594", "indicator--f3b4dceb-2ed4-46c8-9427-b129068ad7b0", "indicator--62fdf022-ba5a-49b0-bc39-dacd9ff932bc", "indicator--59c83646-9863-4c11-b3ac-ad9419fdd030", "indicator--094d3a62-8060-430b-ba5d-dd590c50d41c", "indicator--ced0b53b-97ba-45f7-a79b-38e0d0f3ff37", "indicator--741e59b1-332d-4148-8731-a1bfd9fe1d98", "indicator--855ebdab-e5af-43e1-9a34-ba26b3d0c657", "indicator--f9bb050c-5a22-491c-862b-7e9a52a15676", "indicator--35cedb85-5bd8-4526-beb4-be57d456241b", "indicator--870e6928-de63-4d11-8e4d-5580df859a7e", "indicator--3eec5975-6cdc-4bdf-8e55-acebc4ae9edb", "indicator--4a7cd2dd-650c-4946-bced-12dea1309513", "indicator--7165e0bd-f566-48b5-b69f-fd834730eac6", "indicator--659d19ed-0029-496a-8cfc-4855414e7b02", "indicator--98374239-b6b6-4e34-b391-d67c16922820", "indicator--9fbf88ad-1aa5-4247-a652-84bb2a633c9e", "indicator--01091187-21ca-4942-b8e0-8339a93a4500", "indicator--90c16c80-e10a-4593-993d-e0ce9e1073fe", "indicator--9a1282c5-2d87-4837-a34e-f3da4e713223", "indicator--35ffd01a-11bb-45cd-af0e-8979491c0ab1", "indicator--52b34e4d-ba42-4a37-8cff-ab523b1e06b9", "indicator--80a19aee-e383-4103-acdf-cfd718d34cfc", "indicator--7f54d1f5-8279-47b7-8a88-90b4e93e3a29", "indicator--febd25e8-44bc-4204-ade7-aeb0219f9f44", "indicator--6470349f-9020-4949-8375-da66a2831184", "indicator--ab239498-7182-418d-ad1b-675829775c9e", "indicator--0a18e017-f771-407e-8f01-4ae5e17892a9", "indicator--bf7c5c9e-ff0b-4fc3-8bb8-1fb98c7f754b", "indicator--1254d1fb-9ef3-48c7-8cea-b9de5ee970ff", "indicator--f481fc9e-2224-4f09-ab7e-fd6d4d7c29c6", "indicator--ae7cd847-994a-4ae1-91c9-f40f32a1fdf2", "indicator--4a1d9082-c21a-45fb-b7ad-6efc290c1bfa", "indicator--54b81768-cfcf-4881-8ba4-286e5e38d480", "indicator--7817b307-4d82-4f1f-9b29-8e2a5f31e1c0", "indicator--819c0f5f-30e6-4869-8c1b-64e0620b81c3", "indicator--7accc57d-c0fa-4455-8b87-6617f786695d", "indicator--0732aac5-e8ec-4189-9697-ab7e0c9a3e9d", "indicator--2b9710ac-6d7b-4e95-8197-4a56853880a2", "indicator--f9b28c56-8fe1-43e4-99d7-9671596faa8c", "indicator--217b74fc-6452-4425-9f85-0c462e3c48c5", "indicator--5f4a7242-7e0a-405c-b549-e86e18df6d2f", "indicator--8e39a243-d36e-499c-9138-01885667cc91", "indicator--c88c9e87-9b6d-4892-adbc-e2fbd85243df", "indicator--9f265f94-eea4-4a28-a5c9-90f2acc3013e", "indicator--829eafbf-3d0d-4777-b707-c6a9f2270821", "indicator--4fa3115a-fba2-470b-970c-59b6f65d1973", "indicator--54dac539-aed3-4461-b1c3-9e8b50abe280", "indicator--5756e2f2-018e-420c-87b0-e555492dcf87", "indicator--ca937356-ca63-4f64-9813-e5e15eebe4ac", "indicator--d5639d81-2684-4555-bb2f-7cd9dd24592a", "indicator--e15d6107-97ed-43c0-b03a-3dcd7e8fe833", "indicator--920969e3-dd37-49a7-b23a-dd5f83e05489", "indicator--e0a860ce-f86f-434a-9748-ab0f16eb864b", "indicator--4ea65ecc-0489-42ce-a60f-faed0d342abe", "indicator--40a66f5f-00c0-4b52-a917-6650b90b15eb", "indicator--279545c3-e8ef-44fc-98b5-bf18ee2c6227", "indicator--b583491c-583b-4183-941e-728b3f7c6492", "indicator--75169e12-5bf2-4f07-91c9-92b59a9fe58e", "indicator--a56e6d63-3a38-43a2-af2a-e0c06ff8a626", "indicator--1d250b0d-f29f-4d02-90ef-b1f8fe604cf0", "indicator--a04f614c-0ec0-47ff-a584-132202babc41", "indicator--50b20b83-0823-42cc-a398-1da3bf1a4b6c", "indicator--27dee566-e37a-4a16-8c74-87cf42b3126b", "indicator--1d58c6e2-5812-4949-848e-ac263869c964", "indicator--04cb4b6c-86a1-4645-88b3-dff215f43894", "indicator--76ba27ab-95d5-4a24-bd2b-24578415d497", "indicator--4cd7cdab-7f86-4b52-a02c-157408dfb624", "indicator--af1e99b6-83ea-495a-a48a-d1a8a4b83a6e", "indicator--014bf4f5-5442-44dd-8ba0-99145751fda6", "indicator--816ea8b4-cc1f-4767-a25b-51c92c4bbda4", "indicator--3d6ae7f6-3550-45ff-859f-279e5fbb392e", "indicator--1041d3b2-8772-44df-a93a-377af93ad7ad", "indicator--192d91e1-b5c5-4e5b-848b-3a3eb4da2eae", "indicator--d6ae6e87-b0d0-43fe-bc96-fd0a433a42bc", "indicator--f54776b4-dc6f-45b8-bdea-4c040212c12b", "indicator--01f357de-1211-4d85-b432-665a45aa207d", "indicator--43d1c74b-e22f-41e5-bea8-f8f278a5b48f", "indicator--8431d7a6-5413-47d9-b583-eb29bb530686", "indicator--50428cba-565b-4e6e-9b81-48a738bbb87a", "indicator--a8309c10-0065-4ff3-b762-950c5e599c5b", "indicator--455aa472-f5e3-4ebd-aa26-8bd07597489c", "indicator--1d4c19eb-eae9-450d-9e83-a6200a2eed11", "indicator--75425b42-595e-4a56-8636-da8a7138cf76", "indicator--4c46bb53-437a-4533-8bf1-8254b74e2219", "indicator--dbf8d8c5-c246-4db9-9342-e755afcbc65d", "indicator--f7de39b8-744d-4074-af41-e1914f897f4e", "indicator--4293ef31-f539-47d7-b32f-81dbe0f112b1", "indicator--2356cd92-b448-45ff-92a0-733a27612407", "indicator--7ace08e7-3353-411c-b734-de20e0359430", "indicator--0a161c18-11db-4618-a04c-bd57b08e67ad", "indicator--c446feb7-415f-4fbd-9a5f-64cf80319449", "indicator--e5d99a54-cea1-48df-8f27-e0fa63342272", "indicator--072791b3-c955-4f41-b140-107c83a1a509", "indicator--4533102c-ca0e-4d18-bc8d-ad7d0e6d34c8", "indicator--d05da814-7b7e-418c-848f-597a9dfde8a4", "indicator--efcf7529-2fa5-4231-9bdf-77e034dccec1", "indicator--2df36a19-71df-4d3e-8239-73867b0581e9", "indicator--06695e87-f6a2-49e5-b8fa-aa25b2917d9b", "indicator--cacbeced-165e-48a7-8110-0bf0b039b29a", "indicator--f625540b-3dc5-439c-9ef1-a398d207be33", "indicator--256d3fff-4efd-4b8d-b298-f0e024c3dfbc", "indicator--9dcfa712-2e15-4f84-8763-5541a84606e2", "indicator--4dd0d268-940f-4966-9116-bf5da2cef9ca", "indicator--59a79601-4094-4750-a75e-2f9fbc1f54e4", "indicator--1ab25308-8de4-43ae-a327-fda87d4027e4", "indicator--2335c81a-2a8b-434b-8218-eb1e935a96f8", "indicator--c93cb78e-fa3e-4983-8213-6f8ef8e242c2", "indicator--82ae389e-3852-4ffc-bd1c-a656410ae6f0", "indicator--09a53e28-bfcc-458f-9a4f-c82c160523b9", "indicator--209b6baa-8684-4bda-a98e-52cff737a184", "indicator--17b4bde9-8cd9-40d1-aee3-3e74018117ae", "indicator--dcea68b2-bca6-44a1-8d18-c323911be8e7", "indicator--3916a9d8-0ac7-4aee-a045-1b63ac6e3120", "indicator--50e30d00-2a3a-4cec-884e-212d200437cb", "indicator--bf20ed63-7662-4481-8ecd-a48ba17a4d60", "indicator--b74e1203-64b4-4742-9379-e8d1f397d5f6", "indicator--f5c0d659-8425-4696-8c68-979944f504ff", "indicator--d0828965-7908-4efe-b68f-e0f1a32f2c6e", "indicator--797a939d-03e9-4dd5-99e8-24d7051cf40c", "indicator--68ce1d92-5ffb-4be6-9dad-ad80c3237756", "indicator--8590c898-cb51-4d2f-bc8e-40fe525ae547", "indicator--b993ade7-01da-4f24-8163-e6dc28838e53", "indicator--72fbb53c-20b8-467c-b4c0-5248ffac16f7", "indicator--b480ed67-71ac-410d-9a6e-0374edec927a", "indicator--4d3bd8d5-b1b9-4f8e-b7ca-4fbfe4bcd5bd", "indicator--dde296fd-2221-4652-96a7-04225c9a63c4", "indicator--871e5cd0-277e-4c9f-8dee-c9a9cdf94584", "indicator--75090e45-0987-44b7-a7bc-657ab8d2c9e9", "indicator--2cc7f435-2bc3-480c-9b90-1a2a6bb18d41", "indicator--2aa17b4b-5734-4e64-b63b-df45ca1de083", "indicator--5134ff28-7049-4094-b126-28683faa7bc4", "indicator--3fe17ac8-53b8-4968-9ed0-5a65607d1bdb", "indicator--412afb3c-79f1-4967-be9f-b9bce11a41bb", "indicator--089c3d3f-1410-4de7-81f9-7d757a6f53d8", "indicator--743910e7-e566-48d2-8ad0-2e149cfbd6bb", "indicator--e08fd4e9-fc83-4dc4-8eff-3b216b515ba4", "indicator--e17ae327-56a6-47a2-b1fe-2e73128fe105", "indicator--016d12d2-578d-42dc-85d5-1f13b5a33e76", "indicator--be8d79c8-5bd2-4b18-a214-d845935adef7", "indicator--44ffc9a0-06c4-4b6c-875b-3c49019eab8b", "indicator--d1633f0c-6dec-4943-ac19-9177c7594273", "indicator--948574fc-9a64-40d0-86e6-137e81d37109", "indicator--ac4c489d-4c6e-4a68-b8a5-642820a1fd27", "indicator--6f27b646-4145-4803-a5c9-728ed55f5775", "indicator--7ac34879-28cd-4c38-8ce7-4da3d6a283eb", "indicator--b3c99995-5ea4-4449-8bdb-5f2c6501bc43", "indicator--f1ce922f-e6af-4ff7-97ac-427371f516f6", "indicator--b530822a-5b13-4720-91ec-18819545563f", "indicator--de344d2e-aec3-40fd-8081-bffb918b88a1", "indicator--2c432350-d6af-4277-aa2d-8c7afc41d561", "indicator--950ebc37-d619-4863-aa1b-c0c13685418c", "indicator--861bbecf-53fe-4bdd-adc0-397de69d553d", "indicator--994882fc-52e2-4fa4-9776-5dc7d0342979", "indicator--e08c7eed-69a1-43bc-b316-50513b595075", "indicator--af1fc26b-0e34-4a12-8b87-c506159a8c18", "indicator--06ee7929-9435-4715-9581-b6bd58cc76c6", "indicator--ec037f58-ad0a-40b3-8e53-690d78ca9d5e", "indicator--314b3435-b539-45f9-a6a8-1ce0213cbb4c", "indicator--9d132743-3f82-4496-bb20-d3bfbad4465d", "indicator--44c5aa19-3778-4017-9987-c8452362dfe8", "indicator--e6f1365a-d5ef-4c86-a1f2-11ea51f05320", "indicator--3031ccff-36c3-4eb2-8702-87b7eda69d09", "indicator--0b490e88-35e0-4c28-b2ac-1820eaf47c2f", "indicator--d26ce0f7-8c5c-4e77-86bf-cd547a5b1d4a", "indicator--cbe57307-1e7b-4823-869f-2128cd1e951c", "indicator--b9957b78-eeef-4eb6-9e92-b3e0d04aba6c", "indicator--defd39bd-4541-4552-aeb6-3c74561aa3ba", "indicator--c4b0955f-cc6a-436c-a0b1-cf3b8943648d", "indicator--48984392-4fc9-4242-ad93-af98d2ca39e0", "indicator--65ca13d0-060e-4d32-a78d-ea4edfcdfabe", "indicator--f0959158-9c85-4db0-b97d-5db0cb379c37", "indicator--c975211d-2d83-46fb-a1fd-cb49faa0193b", "indicator--af685c07-ee72-44a7-9a7c-4c24f3793d78", "indicator--6d0e5646-f4f8-4be4-971d-e523e484ef1d", "indicator--aad0f457-ab91-442c-9daf-aa1cc5200e41", "indicator--25fb6f2b-eec6-46f2-823d-2d9aa169ba99", "indicator--1d53e74a-15fa-49fa-a33e-998a62480aab", "indicator--6a5045c3-6d3b-40c4-9543-9f209fb09a3c", "indicator--c34708da-8896-4743-b0f1-db578e866b4a", "indicator--69c0f4a0-57a1-455d-8826-007bec4630c1", "indicator--387f9fe6-0bee-47b2-b7e1-39abd78d4636", "indicator--ea84bdd8-704e-4bc2-a2b8-4f44ef776bb0", "indicator--f1d47ddf-cc17-4e1e-a3b7-f981830e7f65", "indicator--76336abf-af8d-44e6-bf55-5919102bd720", "indicator--4bbac633-bf30-4ccf-abe5-33e868fa490c", "indicator--c2ff0e4e-c94b-48aa-bfa8-85c9872356f7", "indicator--ca454ea9-57fb-4d7f-a971-e89f80c94339", "indicator--ffcc5aca-73c0-45d7-8c77-22a8dfaaacc6", "indicator--3fb42f67-5ca0-439c-b140-1af90b3aec1f", "indicator--ae495675-0d76-4f7d-812e-d4f3355b4238", "indicator--ec85a3d8-3c8c-40c3-92a8-2b3a5a6169af", "indicator--e45c0276-f4c9-4b5d-8493-28cc73915f2c", "indicator--6a84f5fc-5375-4cb5-95e2-ec707b9909e9", "indicator--972e78f3-8cf3-4553-9dca-68edf40ee3d7", "indicator--d36c49e1-21c2-48e6-b665-fc9c2708cba5", "indicator--785f844f-a732-4621-9154-5cbaaf02e8e3", "indicator--8a806888-f564-4f82-8079-d40fa76b732e", "indicator--68209681-fdf5-4654-b044-794d98f02542", "indicator--4df20f04-c567-410c-b84a-efedf8e5c891", "indicator--d5a66e34-c71a-4916-af84-758d4f8ae577", "indicator--b79b47b9-0b6f-4e6e-9106-461f667f4f5b", "indicator--2de170fe-5d65-4e55-9e58-c378b19e7a7b", "indicator--8e06871d-db2c-415c-9a90-ea7471dead17", "indicator--07f422d8-80c3-47e2-a708-d346b4fbfd3c", "indicator--17eae0cd-e5af-4b7f-a0ba-6f6a436f9c45", "indicator--5589fad3-6914-4654-bb9b-57f0e1287bdb", "indicator--7fcca615-6175-4966-a934-a1f68ee7af67", "indicator--e5ec345c-8506-4502-bb19-5457f0bc8a4e", "indicator--45d868ce-d401-40f3-92ed-cf0c31cf7600", "indicator--11380e02-edc7-4c45-b736-077d1c9f4d90", "indicator--3f9f8b67-add2-4d43-a78d-7eba45e6ea77", "indicator--78f0af8c-7f19-4f06-bb15-3f6e1cd72423", "indicator--60e47849-12c3-4a01-8fe3-3c8bc68c747f", "indicator--a53745be-1989-400b-8efb-86d939f152b8", "indicator--0a0a9840-b8a3-49b6-b409-e381d5d4c2e3", "indicator--5610079f-f144-4880-bf06-351dbb39c927", "indicator--597f335c-d466-45bd-a743-044fa9d4c63a", "indicator--d94c8816-ed23-4b32-86bd-d3a0f218953e", "indicator--4592059a-f68f-4767-9e7c-858d3dfb90e9", "indicator--067b2459-c097-48c4-bacb-99e5b589213d", "indicator--9d252a85-fcd4-4070-83ba-76c592ce8668", "indicator--a42d2c2c-caf8-447c-8665-5b7392545ca7", "indicator--7ac2097c-2afd-46f6-bd3a-eaffe62cf704", "indicator--e9ceed77-dea7-4f49-bd64-2fe297eecf27", "indicator--ab700c28-6b98-48e8-ad65-b611463a8477", "indicator--5234af78-0683-429e-882a-5d0bcab22eb7", "indicator--4fde46df-714f-4fc0-b842-ee359d17b7ee", "indicator--a60dccf9-dac1-42d7-a05b-ca7aff3bc4c6", "indicator--1f1e4e0d-b596-4855-b0ba-8d313ff3e871", "indicator--756cf85e-0f76-4ec6-b194-4cb4cd77c383", "indicator--5dfcb2ec-4914-4164-b583-af2179e14110", "indicator--bb9d02d4-9431-42e9-9684-760068fda683", "indicator--e3d7fb76-3aa9-4106-ba76-214b770983a0", "indicator--a002d6d0-e765-45c1-86b6-1d2aab9829a7", "indicator--d8b452f8-cf15-4e5a-8f3b-b332c8b36c1f", "indicator--7bc988d0-fa8e-4918-8ebb-418a581709f2", "indicator--7c6f2781-33c0-4909-abf3-088cf1077c8a", "indicator--d669ff44-06f5-4083-b5b1-8d48dc83c432", "indicator--599789e4-2332-49b7-860b-29252217a879", "indicator--8add619d-d64b-4006-997f-132594812443", "indicator--4ab28d2d-adfd-445e-a067-c5b33aeea739", "indicator--2438fdba-c983-49ee-ab04-1fc31a8c0443", "indicator--896445df-5291-491f-9567-f495e86fa56c", "indicator--119708dc-fb22-40d5-b7ea-7b2ad23689a5", "indicator--efa2860b-a0b9-4c05-b2f5-ddbc277d14e6", "indicator--20557cf0-9368-4459-8091-ff5f223d8e16", "indicator--ff8ebecc-fbbc-41d8-9de1-008837d00294", "indicator--6ad7ea6a-50d2-451b-9eac-b9b3f6f72f51", "indicator--1b558323-b9ec-4deb-a88f-02f8d18a2043", "indicator--228f0629-4f9a-46fa-9a55-e133d35b9732", "indicator--5e439ab4-7afc-4751-9bb3-cf9fb930f33d", "indicator--eb45f0da-aa56-4613-8a0c-b5644d4d4b6a", "indicator--40e7f9cd-7086-4626-ad0c-89d4cb2b6e03", "indicator--05f7ee52-8c5a-48ae-a05e-9a1fb8a06573", "indicator--3ca6c3fd-23bd-4e6d-bcd8-33a0f36d7841", "indicator--902fa465-197f-45b2-894d-6cf53356ba90", "indicator--1c8853ab-88c4-4032-864c-a7fbfb0c6534", "indicator--5ac63513-1c6a-4ef4-9526-7945f86563d9", "indicator--9735c5d0-ab36-46ef-8288-615a931b3ba0", "indicator--c074d7c4-d08a-456c-bcc4-25c704b244b4", "indicator--b47c26a8-b2a3-4918-804d-76161dd42d95", "indicator--63820bb2-e74a-4d0b-9f78-12608a12be9e", "indicator--51dcb39c-10a2-484c-a246-5d6be465f21a", "indicator--91f90123-4f80-4e62-a738-848541f4516f", "indicator--e65cf6d4-4cbc-4cf1-b256-97be607005ad", "indicator--1c3d0e24-7d9d-4b40-ac6d-01dbfb21e2ce", "indicator--09b4cd94-cc9c-484b-8bc9-b08bdd22e9f2", "indicator--ed3dc805-735e-4ace-8b9b-a2cef5d51715", "indicator--c218a3ef-7721-494a-a7cb-51fdc329f507", "indicator--a5ccadac-3028-4c33-aeb9-4983a6561bfa", "indicator--ff4e15f5-9df3-4228-897a-f86ee57a2579", "indicator--45e03cbb-8403-43de-b66a-a8c109c21baa", "indicator--6e729786-5add-451e-a92f-8e72f38ac54b", "indicator--3d415f44-1e14-4b9c-be18-ad4a2fcf45f2", "indicator--b519e1bc-1b91-42f2-aa6c-3ba6a19d3a26", "indicator--8170dd05-0d7c-4b75-bddf-b7bda6625a76", "indicator--0c000e7b-95a8-4796-8363-56b173c4473a", "indicator--96c45dcf-dd02-4c5d-9c0c-48bde7653ac9", "indicator--0c3baf0c-1012-411e-bfc7-17f606f69beb", "indicator--e2d2f2ba-25e6-4cb0-9caa-70d9b7a68816", "indicator--3a72c0a6-be31-42b9-93db-ee0f26847dc5", "indicator--ae2f2d2d-23c0-4350-bf55-2492b19ac69a", "indicator--d78fd225-2397-44ba-8b80-3dd52cd43611", "indicator--d1e24899-d211-4fa8-b6d4-709806200efa", "indicator--2832ee64-34a7-4e5e-a97d-4935caacb90f", "indicator--fcda363d-2d8b-4ffa-8a91-a2c8a5f4cf59", "indicator--c2bb7b37-76e1-41cc-8680-d27abfe1be6c", "indicator--24d54c9c-3cd4-4474-9ec0-8ae1ad768978", "indicator--c470a9b8-1c93-4110-9fd9-fbedb77b53ac", "indicator--6b106519-76d8-4c47-a3b5-e48ef2719896", "indicator--dbb495ac-ada9-4f78-b30c-389d2cafd28b", "indicator--9895cac8-7855-4d26-b7cc-7eaea9937637", "indicator--c425a736-0654-41d0-8890-e679c1a0ce69", "indicator--8190256f-6101-4a1d-adda-c28f98487d71", "indicator--98b9b0bd-2538-4d17-b86d-c8bd1718267d", "indicator--94cc6d6c-04cf-486e-8569-ff16a39b85bf", "indicator--7e2bc404-4c59-4afa-9c42-2da15c55e9ee", "indicator--0680e3c3-cdc6-4352-adb0-0e6e56467660", "indicator--6838cb7d-f817-40b9-aaa6-f94e7533a3af", "indicator--a5b0fea2-3518-4bf2-b06f-2584f7a6a1ca", "indicator--50208218-e4d9-414f-90f1-02113d46c36b", "indicator--f76b3333-b54f-41e1-b5f5-30e2e6cfba88", "indicator--193d0494-7fa9-476d-9322-cc128cb6ce18", "indicator--408dce16-101b-4b3c-b8bb-e3523997369b", "indicator--ab64c720-67f4-4219-9538-175edc0a4f4c", "indicator--3ad86ca3-7af9-4569-b9c6-e1f54a0f1902", "indicator--e17eb922-556c-48db-8c70-6dbb6a14466d", "indicator--b4df3fe9-677c-4e72-be87-a88c5f5528da", "indicator--88002725-31e9-45a3-93cc-da22f62524bc", "indicator--54f08e88-9caa-4096-9d8c-c538351d5a57", "indicator--09db91dc-649e-4c3d-ae15-4b6f89612a90", "indicator--1151afa7-2224-4428-bd0f-a1df5da622f4", "indicator--658e0a39-a0ca-4d87-a773-c3d07893e2aa", "indicator--e7b853bf-9f47-43c0-90ac-63f3a46e6036", "indicator--6e050fd3-b7bb-49b3-9061-97bb5930f647", "indicator--d8e97493-d308-4a22-806b-251bbbd83134", "indicator--e032b035-b234-4c75-a5b9-73c2cd662470", "indicator--e3ab6b81-87b9-4bfa-bfcb-a78a2634f34f", "indicator--e9afc5db-3926-4d50-98b9-cacf646eedb8", "indicator--6aa4aaf0-1e6a-43f3-855b-c79ddbcf4e76", "indicator--45855844-03db-4ba6-8f66-2ee31f6c84c1", "indicator--d2e73e86-62fe-4a78-90f2-8f71a5a150f4", "indicator--b65515d9-2e05-4d0d-be2c-55e9d593b647", "indicator--c658db8b-647b-452d-acf9-89e30636ae60", "indicator--baeae0a2-ec27-44d4-b9e0-f647278f91fe", "indicator--8c48798e-482c-4daa-ac67-d53450e22548", "indicator--7a4dbb7f-c5d2-4704-b5eb-4db593733b47", "indicator--c5b3de02-85f1-4f4b-b6c5-59b63aa745f8", "indicator--b90d30b0-490a-4fcd-9ae5-2386e689c176", "indicator--64ceb921-a644-4e6d-825b-a747b16a2e5e", "indicator--21a3422f-4f3b-42eb-85dc-529f051a3dd9", "indicator--bd20bfda-73ac-47fa-a142-bc96ea5f7853", "indicator--1cff1133-3794-44dd-b85c-90f356de7d62", "indicator--e7321517-e677-4ec3-a40e-5a4110f11e8f", "indicator--5e178e0c-d798-43ca-ac24-2ef168e87727", "indicator--1ac848c3-f4f5-4c41-9daf-befa6682ed6c", "indicator--852dabb2-26cc-4a61-89bb-7bb0599a3c0a", "indicator--107a269d-b97f-4c4b-bcae-850c5264cbae", "indicator--b32abfe7-a4bf-46e4-bb1d-b6aedf2d33df", "indicator--7cffd5ce-a33a-4eca-800c-945947cffdc7", "indicator--fbd9c6de-397e-4805-837c-a2444b56832a", "indicator--668d25e5-e0c4-4cd2-8a3a-dddd7078c0d3", "indicator--b70d8e4d-f9ae-4dcd-bc76-65f2d05148e0", "indicator--29e0df01-721b-4809-bf61-f31aaaf532d6", "indicator--924820aa-975c-4fcb-a1ed-7654670015b7", "indicator--95574ec0-8b83-4195-8b69-966573444b1c", "indicator--e40ecfc3-5b9f-4777-ad2a-31c2d0c5c888", "indicator--60661b8f-67ad-41a8-acc6-01f6b4c5efa3", "indicator--2c69a59a-d891-46b4-8d93-2f02a234d40e", "indicator--41a1d926-8bc3-477e-a662-9a18f1f4511f", "indicator--29d2bdaf-dd86-4daa-8b2c-aa76eeaeb73f", "indicator--101fd637-a84e-4849-ae03-e73cb90d190d", "indicator--1d32e47e-672e-4cff-98b5-42cb77ff1d80", "indicator--686409d4-c04b-489f-a023-014e7106f0a7", "indicator--5e940ad7-be1f-45e2-88d9-f700bad1d5e8", "indicator--382cd728-cac1-4595-8438-4f7e982b958e", "indicator--bff82027-f887-47d5-a776-b65abc66cfed", "indicator--05f3886c-528a-4a49-b708-fa8bcdad9ca1", "indicator--88e1c098-42a4-4cfd-a83c-1f0103f60e15", "indicator--63ef39f0-a5f0-4b00-903e-562df84c367c", "indicator--02fcb385-0a70-496c-b1fe-d656100a5f7d", "indicator--60da8402-8904-446f-b8fe-04fcd87cc0fa", "indicator--c699feba-31ee-49e5-ae18-64614a503b70", "indicator--af4aff95-e35e-4bc4-9e57-fcfd59ee2fd4", "indicator--e9799b0f-42d3-47b6-add5-95a4729a70db", "indicator--a01beead-382d-4152-af22-2e3b8f3ecc7a", "indicator--5648085f-560a-44f3-85cf-85fd32832a6b", "indicator--3a91488b-4867-41f9-9c1d-00be9d26c5b6", "indicator--c01c6bf2-57ed-426b-9381-0e15ecae8850", "indicator--32f30156-9ed6-429e-8192-0f68bb034681", "indicator--68e8e905-f0a7-4a64-acea-ae00a4fd341b", "indicator--6dbfdd41-03cd-43a0-b41d-9334d0783494", "indicator--40972746-9b04-486d-b14a-1f06ce87f5ad", "indicator--5ed2b964-04bb-48f0-a53d-c3e8f5b90c4c", "indicator--12089b96-681b-421c-bb49-f6efc0d1dcad", "indicator--04d529fc-0b87-4723-a90b-be0884685be3", "indicator--d734ca3a-c200-4b6b-bd77-d83cdb96b22a", "indicator--46c7c459-c1fc-44c5-a608-0653506416ab", "indicator--535ece95-e861-44db-9195-e15b4c3f9f05", "indicator--61ba0996-d64d-4dce-be8b-5a41e7ab5aee", "indicator--e497aeee-9269-4e01-823a-681ebc9ea74d", "indicator--3b21293f-ec1c-42a1-96d1-8997977b6c1c", "indicator--391faaf5-8c6e-4241-8b97-f880569f1187", "indicator--536f8baa-8bdd-419c-b554-a7a179397c56", "indicator--0a14b848-49ee-42bc-b74b-f08660c7f1e4", "indicator--081c10b7-d6e2-42ec-a9e5-b696b8992883", "indicator--d567317e-e397-4dc5-8210-d573502b613f", "indicator--a2858f65-dd62-4235-9f2c-715e8aee9303", "indicator--68c8b581-836a-4c66-bb48-46f2f8cb5c51", "indicator--0f0327a4-a4e2-4589-8719-bcbbe5d9d518", "indicator--17b8eb10-0c62-4be2-82d0-5ea96b9089ab", "indicator--e2a809b4-11c6-4520-92d0-395e52c3f103", "indicator--0dfebb24-b72e-43ec-8406-f44142b92124", "indicator--914631ed-9f69-45cb-bc0b-30ff8410d554", "indicator--353fd7fc-c94e-4318-a6a8-864a0a3a8c0a", "indicator--9c65cc8f-5bc3-4545-9488-9fe68c21dc81", "indicator--1771e242-8da2-4fec-b8c9-4d6de9bfa1ed", "indicator--bd8a1772-133e-47c0-afd4-f4bac19c99d3", "indicator--23242718-e17a-4f68-95b3-12106b393406", "indicator--0cb384c2-9be9-4e91-bfd9-ac514e62e2c7", "indicator--b18ecf72-cf98-4691-a44c-3591e582abbf", "indicator--5a50536e-e5fa-48b3-a93e-39240a00c7f7", "indicator--b8d2bf2d-50ff-40b2-8a43-6a5db3928abb", "indicator--efbcc61e-2460-4755-9532-fa2050ce28f1", "indicator--36338b7a-b782-458e-9a1d-5b4708d3308b", "indicator--b89fabf5-9ec8-4cd7-91c3-e122df9e1093", "indicator--71ee5260-055d-4ee2-b65d-8abb3629b6ff", "indicator--462ec585-4293-4e3d-8363-888472e1f117", "indicator--5b704f0c-b965-448a-837d-add95b790fe1", "indicator--04989a1d-db5b-40dc-96a6-0a45db82cb84", "indicator--710147ae-f586-4fc9-9b08-bc2db29e04ae", "indicator--af15350b-7ce6-4179-93dd-dccfb2345543", "indicator--551ef798-311d-409b-a741-1b0b09bf847d", "indicator--00cbaa0b-4a28-4a33-9e0b-6ac3ee8d9301", "indicator--0b369326-5154-4dd6-8a40-2a6b3cd86ec4", "indicator--c71257f1-b444-41f3-8bbf-03260f8c60a9", "indicator--83942045-d8a8-4ca9-a32e-c4db3630226b", "indicator--d01c9d3f-643e-48a5-8fff-9bfc38942ed7", "indicator--be6200f6-6614-4631-ac61-370c0bb0d4f9", "indicator--030690e4-16fb-4590-b7a2-56494b07d5b1", "indicator--13e710c8-3cae-4fcc-859f-b0511a5eba2b", "indicator--142542f5-39d3-44aa-918a-a0dfc9bf2cf1", "indicator--7deff233-f019-43f8-b05a-082573b00f0e", "indicator--1059690b-03dd-42c3-9f17-854273fe3e20", "indicator--6aaa4397-7220-4d4a-bddc-2b1c26087541", "indicator--5ca415c8-c3ac-4aaf-88a9-d2063da24558", "indicator--e79a92b1-cabd-43a3-a2e9-3dbf45451bae", "indicator--5d87e68e-1bda-4d28-b24f-955eb21fb453", "indicator--9e9bd239-a5b9-47c5-80a8-158b299deb4e", "indicator--3f51f695-0e5c-43ab-8d06-8ac667c381a6", "indicator--4b612c84-47c1-41ea-a305-73b6218861b8", "indicator--b4233f2c-6ee1-44ad-9cf2-cdfd22a8162e", "indicator--4b7b3377-211f-4abb-8980-1eeeb9d1864a", "indicator--202e697e-0d4f-4524-9cbf-9df60d5f852e", "indicator--198dca25-14e6-4f2c-a13c-6a2e4337d83b", "indicator--f2e1142b-d73c-4dc9-8f2c-8a09787f3bac", "indicator--a730017a-e7a9-4267-a5d8-86d4d52006cb", "indicator--b8c1b7cf-07ea-4b29-a3b6-74ca8ad8bf9a", "indicator--21a1fc94-c20b-40d2-8153-9bcf4a369f1f", "indicator--e5ea54ea-ea13-47c6-99a6-d751ce693020", "indicator--e486dac8-f695-41b3-8976-8eebb1c44c56", "indicator--a9be742f-aad0-450e-b3f9-d2a8267e0c5a", "indicator--52e1f3b8-c8bc-47e2-bd5f-89d02a817020", "indicator--01d94fa8-7a58-453f-a537-f35965162e31", "indicator--5bd96b75-1c1d-47be-80c9-b64dacbcaf81", "indicator--410def8c-8c67-4e03-8812-0da523742352", "indicator--9dc4969a-124f-4a2f-ae22-b5b3b4a15e99", "indicator--1d75e45f-3499-4cf9-9e0e-9efe786b0061", "indicator--903c8506-5663-4a59-b338-5f68eb4b547c", "indicator--fc290d8d-7d77-4302-8272-600ac11abe18", "indicator--cea2a1e4-0014-443a-be25-dfd81e491d94", "indicator--c131df03-2087-4aad-b518-7fd16585c134", "indicator--5cbc4e79-c550-4403-b3df-7bd7ea6f9f7d", "indicator--0cf0dfb7-23a1-4eed-9f60-b354ea04319e", "indicator--38a98cfe-61a7-45dc-b01b-23b5a330c35e", "indicator--a58baae3-d215-448c-916e-8ea35a75d39d", "indicator--b7bfbe34-39ff-4814-98c0-4a0d9a2e4fa5", "indicator--de405cd1-f415-44ab-b92d-03e4cae7f6c2", "indicator--fd8f6203-7636-4965-8944-a96e30cec8ec", "indicator--6ca0eccd-3aef-4b37-a584-95fcd0583890", "indicator--5809cf99-fffa-4588-8507-b9541a62fe33", "indicator--173de7db-66e2-4033-811f-6e6f8ad83f3e", "indicator--91eca07d-5401-44d5-9b2c-5c67a2b3cbb2", "indicator--e9b27e73-9257-4a0c-a4fc-8e8c364cbd9e", "indicator--77285a4c-7543-41a9-b2b7-3e35b72571a6", "indicator--da9f3d8c-e613-4049-8f6b-32771d227c3c", "indicator--d7ff90f9-471f-4e0e-949b-87544510f00a", "indicator--84e4fca4-c2f5-417b-8008-c321dc3c1a45", "indicator--4ad47bef-9e2a-49e5-8f6e-b671d5802612", "indicator--a2d0b82b-95a3-47e6-bd48-ebf142a37b75", "indicator--388dfd43-54c0-49bf-96e9-adbb16006a7e", "indicator--f3aa98ad-aa6d-4e26-9cd0-b2b9508974be", "indicator--9ebb1c2f-f55e-4318-aa41-efb9275d643a", "indicator--bf8cfb10-5edc-425e-be15-855768b677c6", "indicator--a9f29629-e246-4639-89fd-206eebf9a30a", "indicator--cc637e98-18e4-461f-a4df-bb95155a1523", "indicator--e25f0315-18ad-4c83-8dbf-37975fa7bdec", "indicator--8c45eb59-5511-4c22-9308-35b17248b73a", "indicator--2e0a466d-860e-4079-99c2-04545b3de9f8", "indicator--bab9fc98-d3f3-4400-9819-478b2d30fcde", "indicator--dc594e86-56ef-49ba-ae5c-c874036a2eeb", "indicator--d764594f-3075-487a-9d67-38e25d5e09c3", "indicator--94cbfa0e-4b09-4795-81c6-1e626920dac1", "indicator--58622a2a-1161-49f8-9017-ac046d25139e", "indicator--03201add-adf5-472d-9506-d04ad98c8a21", "indicator--c32ebe73-706b-4a08-ab96-6e35bdab9767", "indicator--a8ad0ce9-b259-4a55-b8dc-8c0d13e2daf1", "indicator--32ef65d1-951d-4407-b8fb-1cfa3777c9df", "indicator--926b0335-8141-4da4-87ee-e34131c07631", "indicator--6f88bf74-61b2-4807-85c6-769c47ecea92", "indicator--6924ad34-31bc-4b32-bbcf-70c1d006eb6c", "indicator--9cbe1643-ec23-4864-8210-314273433b8c", "indicator--3d743014-e45d-47dc-98cf-dc9e67d99652", "indicator--3f2f64d4-be6d-476a-a8ec-be9ec9afdc00", "indicator--a177d95f-beb7-4c74-b63d-95744184b979", "indicator--78123f44-0803-4f6e-84e1-863edf2910f8", "indicator--ae1bed9b-130a-4859-99ee-1ce954070965", "indicator--725d33b8-3c27-4888-a3e7-0874d9bea2db", "indicator--4f7cc82a-2809-40af-b0ff-c1e67c7b48d4", "indicator--ca6e48f1-4a32-4af4-8af4-49882c781173", "indicator--04972831-3fab-4e7f-ab70-7c37dcea7cbe", "indicator--f6cca4d9-08ef-4a16-afa4-b085deb46964", "indicator--337fe26c-9e61-4c17-8eb8-48097aabde23", "indicator--e23bcded-8eb5-4719-bfd1-6b2152b48b12", "indicator--de08c53f-e48d-4582-8c0e-5cb6119e3069", "indicator--b2e519f7-d946-4bae-8bc2-8e0489f88440", "indicator--20663682-5a0f-4b60-a7ad-c71817001c14", "indicator--9fd5ac70-a9ce-4ebf-8470-e9f70c51e3c9", "indicator--bd7748e3-646b-4889-bfef-2852de7e4866", "indicator--68710899-0033-4600-bf4e-91e23c293a12", "indicator--a4d14e74-8b00-453b-b7ff-cd1c1b1f6438", "indicator--14642c52-ddcb-4d2b-912e-846f64e0f381", "indicator--8e50080c-b3f8-4f44-b3f5-40583e9e18b1", "indicator--627672f0-12cf-422e-bece-e9a1abdaea7a", "indicator--70656450-d76a-43ab-873c-ec61b1fc845b", "indicator--ae584ef0-747d-40af-b100-e47cea9ec2d8", "indicator--16b43abd-7392-432d-8a75-f57daa1750d7", "indicator--7a64cb97-48bb-401b-94e1-eb424e65c1b8", "indicator--36e191c8-9d6b-43cd-aab9-38ab52791158", "indicator--e4f5b244-076e-4524-a4dd-43c3c7a6ef69", "indicator--c4a3e293-c239-4ff3-83c7-8ba8c1616e8d", "indicator--0c722fdb-cebc-46ee-a5da-ed157f9a368f", "indicator--94b8403d-b748-4575-993b-a6274d32b6bc", "indicator--fdde8e2f-1b71-407b-94c3-ecaabb3326c8", "indicator--7c5f118d-4d1d-46ba-b360-83ccbdc7c1c6", "indicator--faf48fdf-a52b-4ed8-95cf-e0af03f80769", "indicator--c2b4b939-c713-4170-a264-929bbbbd178c", "indicator--aab73c9c-7a57-49a6-b0aa-8f452df46fdb", "indicator--16822ae6-bfab-4765-896a-72d0ee733573", "indicator--e0c68ef1-8184-4b0e-a8b5-46b1d5a8acfe", "indicator--99a4a229-ce5e-4f85-8fe4-812506817bcf", "indicator--cb3d3e86-b420-48dd-93f9-2c2c11c6ba6c", "indicator--1024c244-cde8-40a5-bebc-51cee42eac1b", "indicator--dab987b3-ed27-437d-a6e0-2dc49b2b777f", "indicator--4b8079b3-cb1f-47bc-b65e-5e8310ea3435", "indicator--8a67ec18-edde-47f2-bb50-c6472278f2d4", "indicator--22d5e809-de1c-4700-990d-89478935c90c", "indicator--893f456a-065f-47c2-a0f5-d5a2618b70c3", "indicator--f4a91ac5-3016-44ac-90df-2006334f8f80", "indicator--af5ffb82-3f59-4228-a13b-e385e84d0c63", "indicator--8ec93c29-cf48-4c2b-8582-8bfb1ed68a18", "indicator--7eb3b033-9e77-49f7-8ba0-f8923d7aa3ef", "indicator--e654b140-3860-4546-a56c-b4828c7d3aa2", "indicator--70ebaaee-6b0d-457a-9907-3e5731ac1be6", "indicator--20c5893f-e7b4-4691-bcb2-f409d98e3832", "indicator--0c2ef05b-50a6-46ba-a083-e0a7cb56a75d", "indicator--9110fed1-5607-4c9e-83ee-911aa0046292", "indicator--116c0e1f-6504-40fc-bb07-1968ef5434e8", "indicator--d73ab2d9-ad23-455d-a306-80b2d212e7fe", "indicator--f00ea6d1-9e7c-43c7-9f2b-731a5d54e7b4", "indicator--80a156a6-8523-42c6-bcd7-37a62ecfa074", "indicator--013a4f62-c699-46f2-83e5-997c859c7ea4", "indicator--332a8d5c-92cb-4f84-8c48-8fc61443b5c4", "indicator--b7c7429e-c112-4ea3-9a0f-d694586a1bc7", "indicator--cff8bfc1-c6d3-4ee2-b0f8-964e51e6e6c4", "indicator--262bcdd8-122e-4ebf-9a50-bbdad32c2122", "indicator--b9a7457f-fbd9-4377-aa1b-6843d897b317", "indicator--d412704d-3b0a-4d37-abc3-c5f04638bf60", "indicator--b0830938-d84b-426b-a749-32432be3b2aa", "indicator--9576cfab-edab-4fb0-902c-704735d9e341", "indicator--63308886-ba20-4216-ad72-97c00d58aa87", "indicator--2279100b-8a07-49ca-b9bb-3e51c333d936", "indicator--a9a23b0b-1547-4d8f-a56f-27dfd05b2fe0", "indicator--ff6478ba-96a0-465a-b675-3b7324fc4c3a", "indicator--9426d34b-c212-4560-9533-0306cbeb3b9f", "indicator--929b1293-7354-49d5-9f32-f2bb47f40fdc", "indicator--93376726-d1ff-46cc-893a-5560035e56b8", "indicator--e7f5edb2-a181-49f8-bae7-a66d83526aea", "indicator--c678caf7-f0b9-4b02-905e-c0cd7936d390", "indicator--7b5c7fea-57c1-41df-af61-9a29c3180672", "indicator--581e534d-5071-46c5-a2dc-f52d47b45739", "indicator--7804e661-a40c-41ac-b286-473b4559ddaf", "indicator--07ad955d-7874-4ef9-8653-9b0d33db01e7", "indicator--ff47f73e-81ed-4b03-96b1-b53a8504b67f", "indicator--4c36b322-855c-4df1-86ee-a11817658a49", "indicator--b2029ee3-8250-46cd-a4e6-b70cd4ab310c", "indicator--e764159d-1bbd-4794-aa81-e6d04497170e", "indicator--fd90f2a1-8009-4b96-8912-d4951076b1d1", "indicator--b54c58c2-abf5-4c02-976c-ec1f5749a112", "indicator--ada0307e-be2d-4924-afd0-7c82e5bf4320", "indicator--f54e5ba4-6a02-4c9b-89b3-71a4f2dc27fd", "indicator--7724655e-8ff1-47d4-acb7-b26c6c63dcf9", "indicator--db9d2b4a-25b1-45d6-996c-85b7551fbeac", "indicator--566d7966-e794-4f68-a1b5-113a0dab6e3a", "indicator--3b84a8c5-dc26-4f68-9ae0-e22fd126cc0a", "indicator--f31d08b3-3ae6-4816-93ac-0cf2840ac829", "indicator--ecb578e7-6a90-4387-8306-f991e225c521", "indicator--248c01ff-a758-4db1-b7fd-637c94c5ffda", "indicator--f86c5b86-64db-440b-98d5-6a3c6ca6ab26", "indicator--c587b24d-f9eb-43dd-9967-96adab104412", "indicator--e51cfdf6-3340-4b2a-90c2-d51ee6642935", "indicator--dfe56700-2b87-4c62-8937-9393d6d4350f", "indicator--301e0ef7-4aae-49de-ac10-a98d7210c596", "indicator--b64ddf5e-7119-4209-b681-5483a00c6bd7", "indicator--38d85689-a74a-4710-9d5a-6dd150dfee79", "indicator--83462aaf-4bb4-4f33-9344-fac27d77ab01", "indicator--3edaeaac-7b75-469b-b643-1acfacfc3fd8", "indicator--490534e4-599f-446c-ab97-5863b82dc9a3", "indicator--d38ad603-c613-4eb5-a029-22055f0415c3", "indicator--01c5e66f-dbea-4f5f-8622-badf52a08cdc", "indicator--5d6a1594-6069-465a-bc03-cf6a174a4a1f", "indicator--64f1489f-1070-4de0-8053-53c745ffe57f", "indicator--cd4bc813-215e-4a94-936f-48a79153e509", "indicator--9fa76d53-43ce-4001-bfa7-9a60f0876487", "indicator--26cf72eb-20a9-47ff-ae82-dac2dda1fe85", "indicator--4d1ccb1c-95c9-4e0a-a09b-31cdba78354a", "indicator--dc93f491-2c3e-46fa-b122-0832da86c039", "indicator--ae268782-8a28-4c81-9e93-fb056c3084cd", "indicator--7538c816-bc6e-4931-8c12-a77159f16d98", "indicator--db83456c-987a-4172-902c-4c926b39e1e0", "indicator--beb4d1d4-20a4-46d9-8b61-d4cb6a78b73a", "indicator--7c31dab0-bfa4-4a98-a894-a96f5a9f37cd", "indicator--a144784d-017b-453f-b4cc-4c316ad94571", "indicator--55de6da8-eacc-4a2b-942e-eef03d83d0cd", "indicator--f19957af-c5d6-4f8b-a5d9-2292c92a7750", "indicator--06abd6f4-d2af-4a2d-8a17-ffac8e62d1d1", "indicator--a3225b09-ed9f-4f26-9cfa-cf075d6cb253", "indicator--35f67723-f69b-4642-871a-246312500721", "indicator--f31ea476-c9f2-42d0-a43e-c2a0fa9d5152", "indicator--c5af9508-a993-48c3-81c4-521382259628", "indicator--4a3a00b1-4950-4be8-ac73-ff6409d2d633", "indicator--b8f87879-223b-4b58-93af-e9317494800e", "indicator--e48cf900-ad0a-4f7a-a5b8-f35ff87d5dca", "indicator--0466eb16-fbe1-4410-bcd6-7c924ea7534f", "indicator--e6450b95-c292-451b-be20-a209c2add453", "indicator--eb62a5f9-7cca-415c-9a3e-0ccea677794d", "indicator--8d465b33-d83e-4a6f-b587-6613b7cb8f1c", "indicator--23ef5283-3dba-481a-89be-6a2b3012af21", "indicator--71387943-2fa5-4b9b-b1ad-072cf3d56089", "indicator--9dc436de-7df0-45d3-96d0-e491ec39c25f", "indicator--16ef765a-c989-4842-8a55-d9aa24787cf9", "indicator--fd6f75d6-ee8c-4a37-8c57-d5d0bed5d5c0", "indicator--3c0d3ff4-590d-4758-9370-110aa3d421eb", "indicator--54c973f9-c0d7-4aed-aa82-3dbb771b1efc", "indicator--55f7f4d7-a8bf-4c0a-88cf-be96f8cbc8a9", "indicator--221c1acc-0525-41ed-b3f6-c8242c5e1809", "indicator--4429dd0c-d75b-4c6c-acf4-03f915c10bf6", "indicator--2b568996-9087-4f19-9622-c1fd9e4c6485", "indicator--c792f6dc-80df-46c6-89e8-c310f9844810", "indicator--61d10d37-5c53-4289-92e3-4f79068800a8", "indicator--ccbd6af9-7d4d-440f-aa1c-4e7dea3d035a", "indicator--82644d44-27f9-4118-a98e-54ce77521846", "indicator--7a91c668-f7ba-41b7-b745-d9d4d0dae416", "indicator--ab861fd0-3310-461e-a23a-239f75589ca7", "indicator--c89bcb55-4a39-4f26-90ce-dc551db26d6e", "indicator--1814c6b8-be38-4944-980d-e7639626379c", "indicator--b4266fd0-cf9d-4bc4-af9b-3778d3ebd724", "indicator--d3022166-e085-42cf-b598-667f7378769c", "indicator--da6c38b4-3c9d-4c50-8822-f292a9069a01", "indicator--69fec9e9-0cd0-4f38-b496-ff05ad762519", "indicator--a618e001-3140-4d8b-bd5b-0833a77a7ecd", "indicator--4332e1b8-9471-41ce-9b08-f01b79a96164", "indicator--d26bf38c-e797-4b8d-a35f-030328d9536d", "indicator--dd3693d4-c672-4290-91b2-19a47c9478b7", "indicator--fd4e434e-b46d-42e2-b34f-5b0ba6b1d109", "indicator--5511a827-22d8-425b-bc68-d1f1d1c717c4", "indicator--0b71ca79-2ecb-48f5-8a1d-27b94c12f18f", "indicator--e1ba056b-e0e8-498b-a941-2392cb445d1d", "indicator--b03b8508-0bd9-4764-af91-422e6ab043d0", "indicator--6bfa0031-6311-43ad-9a60-46bc7db1bc83", "indicator--7eb7502d-9858-46b6-ac2c-ad177a51111d", "indicator--8f94a28d-1700-41ae-a72f-a723c2766c2b", "indicator--e26c9fb0-ab4b-4508-8a78-40ee72577618", "indicator--3c80c72e-52bf-461b-bf04-f6b7b5bd0a6a", "indicator--b74dc6f1-2cc3-46fa-88b5-d7aa5f3f8b91", "indicator--894d5ccb-9f68-48d3-95f6-e6ed9a75ee8a", "indicator--44c87cd3-5781-42dc-8b26-b4ae2ff0fe63", "indicator--0ef81808-8dee-41ef-8ba1-2550642b3bad", "indicator--2e0fd8de-fce4-4f94-bda4-8e9c369f1693", "indicator--daf39418-79cd-42a6-958d-2e01c102be46", "indicator--0db01ede-ec67-458e-ac04-b97641c84645", "indicator--fbf8630c-3a79-4e6a-8b16-f197f6f2b919", "indicator--854dbab5-75e1-4393-b79b-c8a1d8397b5e", "indicator--486293c9-64be-4b37-a216-0f9df6de4ebf", "indicator--33de0d57-88b7-41d3-b3e4-47af99f92c83", "indicator--4fed9258-5038-44eb-bf31-32c3d12cb436", "indicator--e1cd9bb4-e539-4fb5-8447-c814e2f70571", "indicator--b8780d6f-8fdd-435d-a287-83769e8d0f3e", "indicator--21f5a11c-fe98-443e-95d8-9c4fbc96f5dc", "indicator--25e52fed-83aa-45a6-98b2-cb25c1a017c3", "indicator--2f3ce5f1-490c-41ab-ac1b-1f045c47469d", "indicator--d8721686-ee7b-4a1d-a655-704dd64a693d", "indicator--a7e3516b-d9f4-44e2-b01f-e166433c3de2", "indicator--16082ec6-29c6-4b1d-886d-40d516f43078", "indicator--a8438e05-3db8-4428-a8f1-4b094bf8b66f", "indicator--75129d65-6a8e-49b3-8323-1fde0acde570", "indicator--f1ea16c8-f554-4784-9f24-59297f4cf6f5", "indicator--27c14dad-6597-47e0-b6e1-84b5446f80bd", "indicator--de407454-83aa-465d-81d8-1d4baa94287e", "indicator--ae02c317-8b85-4333-a3f4-6e48e79f4802", "indicator--4342eee1-4b0e-4b5b-95ee-1b24b794bdef", "indicator--a77fe45e-1bbd-4c6c-9220-8f709de0fcf3", "indicator--50ee1bf1-b985-439d-92b9-b2020778d3a4", "indicator--191efb16-6bb4-4626-9a77-2c73feea10cd", "indicator--573c86cf-340a-4d20-980b-229e80798777", "indicator--4b9e9b85-d16c-4900-a354-b824223a8964", "indicator--df1bd043-bc01-4563-97a5-17b3f615fd5a", "indicator--6b983346-f693-4080-ac3f-6fb9f41c267d", "indicator--23252421-d577-43a4-b38a-011dcf5187c3", "indicator--9497256c-66f6-4cc9-bab3-16cd89590433", "indicator--91066ed2-0a5c-4d18-8326-01073ba75827", "indicator--274549df-c6a2-499f-bd05-e867cd5e9799", "indicator--6b049e8e-f0f0-4024-85e0-1aa5dfb0c91d", "indicator--62e4318e-3afb-44f4-8a56-824be9089620", "indicator--761e4620-900d-46d0-a01c-858e7ab226a4", "indicator--a1d215d8-82bd-4deb-a094-8bfce4ad0920", "indicator--41086772-ab1d-4217-8f75-86bcc20968dd", "indicator--c5b990f2-f94f-4523-9754-d5915ea1f841", "indicator--217d6fdc-97ff-4a84-b752-c8edf0a8e864", "indicator--4d2f6b62-6347-428a-8c02-18c68f708977", "indicator--08a3a4db-9111-43ea-85c7-0d2fbd7a4473", "indicator--7fce45e5-be05-4f0b-9959-e4e524ada31a", "indicator--4b03aa89-f5cf-46f7-bb02-3fe9dc07af10", "indicator--9e6ff46b-a0b9-4696-936a-95b6437dc13c", "indicator--742dc7c0-1d0c-4d49-a5cc-53928d9ce9f5", "indicator--a62fd911-f682-4b37-a84e-198ba4ff8681", "indicator--044116f2-bc03-4879-b4d9-73da54f05c51", "indicator--87218974-2272-4c9b-aed9-f37849514d1f", "indicator--6fea9b80-8a24-4213-8e6a-96ac0bb79737", "indicator--30a6b6f0-cf71-4c75-9995-5b5ebbf6593f", "indicator--4c957f7b-10c2-4e4e-9905-47950d809402", "indicator--f4648a02-2038-493d-a9e4-b15fe899f01a", "indicator--22c7773e-b04b-43ba-bbef-4f05bb7d2a18", "indicator--07953f06-42ee-48e4-80ea-b545087830b9", "indicator--98d9112e-f26f-4d00-87ab-3a4c43bce6af", "indicator--93313e43-5460-42eb-9ddc-c330d797df58", "indicator--76ab0d01-73f8-4680-9532-a05749474f99", "indicator--389ccf55-1409-429d-84ee-e258a783481a", "indicator--2d753a7d-d950-4cdb-87a6-73181f5af05d", "indicator--364210cd-1c70-4ce5-8896-f48e3faf979d", "indicator--e9f7ed6c-4b7a-4730-908e-13dba27a6c70", "indicator--ffe204cd-3fa3-4690-9b46-d80a612626e7", "indicator--ce70b5dd-dad1-4351-a938-23d0e3756c60", "indicator--ae046115-c603-4ba2-9c22-9d50b11b993b", "indicator--3f385868-3258-4e0d-8c32-13992ee24e15", "indicator--aaaf7d38-6daf-4537-90e4-4099153a5d5c", "indicator--239a6152-304e-4d83-ac6a-d730f1fb0742", "indicator--1b1fa7fd-cdb4-4107-be76-5ba224de5a52", "indicator--bba242d9-9a5a-4e21-b222-dc5d7ed546c1", "indicator--4cfb6b12-168f-4c73-86f4-10bba95fe350", "indicator--4c5e8bbf-4985-4d15-84f6-dcc5fd02068e", "indicator--2f74626a-d491-454e-a840-44869b599d26", "indicator--ebaa9b04-1b77-4e84-bd03-04dd3c1d5f8e", "indicator--7f132b52-3945-4d0e-9303-e8d8b11c49ef", "indicator--8f97a228-4300-4203-8378-c03832b92aab", "indicator--c00a64e8-7035-4e3e-bf24-bad62faebe09", "indicator--25c166c2-5004-411c-b75f-a6af72a42907", "indicator--8c9ab15d-d6ce-415b-b4e3-845888cf5280", "indicator--2609c7bd-de28-4cd3-aead-e82bbdebe790", "indicator--5c9fc7ef-94c6-4a93-8cea-a619a2684305", "indicator--0f0bb8f7-29a7-4e6d-9ba5-0f07064ba224", "indicator--d0274091-ed99-43ab-a9f5-415ba8aea27f", "indicator--a3b820cb-aef6-4ca4-a029-00b9300043ac", "indicator--004d8694-1003-45e8-b5e8-3887c8f11688", "indicator--8b505514-2be1-401b-9e9b-dd1519fd9641", "indicator--8ed8a17e-4304-4f25-8089-e5e12399be4d", "indicator--bf29b167-018d-443f-9875-9ef23f2c4c05", "indicator--b2ec020f-4392-4126-a9e1-35b635bdfc5f", "indicator--27ebf73b-6121-4826-a7e8-d22d160b9c89", "indicator--c9a38c9d-b8de-4972-bce5-e3e4c7ac597e", "indicator--1f0c2f40-43d3-4463-9875-7abcf0bfd06d", "indicator--003218bb-8f36-4020-89f4-e0dd5bc38c0b", "indicator--db8558af-18da-46ab-83d8-8c61e939673a", "indicator--6574b9c2-1301-460b-aa15-19e6957f4544", "indicator--3050a7d8-cd95-4477-b5f7-99c056b59cf1", "indicator--7430cdde-e71d-460d-be89-e74f98d24514", "indicator--305cc8ce-29c7-45a2-bf21-6801362c1bb0", "indicator--2e728c9d-86f2-44c5-9dca-e242e6c03121", "indicator--69e74f71-d178-4363-9367-0fee0f8c4452", "indicator--fe605e04-37a7-4851-97b2-f97014df5ba2", "indicator--791f272c-c509-4ea5-b562-d0da19b2907c", "indicator--1d455e5e-195e-4efd-bc6c-c4f107b7c345", "indicator--f7dedd74-5b62-4210-aad8-af0147c3c50e", "indicator--ce38e598-6405-48a7-8d57-0e15dcd5793b", "indicator--37498462-46ce-4c10-869e-954b98fa254e", "indicator--827aefe4-8914-44e7-9794-f652e468761d", "indicator--ab7d993f-5f3c-41c0-b0df-fd9f4f1e3045", "indicator--3e3dc9e4-16fd-4359-90f9-332ce572fde7", "indicator--df69ad20-e8e9-4fb3-9c64-396726bdb82a", "indicator--ac2286ce-20eb-4060-8916-822d77270f1c", "indicator--2b24a9c8-b98f-4c36-9b28-4ade319ba951", "indicator--6bfbe9b0-d942-416f-802f-6de60fed9bc3", "indicator--02f6eea6-5acf-48b7-93c4-9b3dc0b6e74b", "indicator--50ebc5c7-312a-4a66-8f71-ad3f66c0149d", "indicator--3ca9362f-daff-4d90-82fa-722b3618c9d9", "indicator--d541d1a1-8bfa-43bd-b770-a9273a3df26e", "indicator--58c3b170-5797-4ca9-9f0e-7cf5e47cd8fb", "indicator--1315f0a5-eaef-4089-aab0-e3d225203537", "indicator--23ae8402-07dd-4ce1-bcd5-bbc3729b1ceb", "indicator--f02949e3-8079-45aa-83f6-cea291d5d067", "indicator--5e8ceed1-daa1-40db-8f12-27fbea4d970e", "indicator--653cf8a9-99e4-4206-939b-b3c9e2074aed", "indicator--c19162cf-0b21-4401-82e7-ec4a7831d127", "indicator--ec31248e-8d26-411a-812a-6d0627741f5a", "indicator--89c6cf28-0d1e-48f7-96e7-91d1d85e62ab", "indicator--7819f655-1c80-4381-82d0-b8d97c6b21b0", "indicator--c738f010-bf7c-47a7-85d7-982e2a103cfe", "indicator--735ea068-7ca3-411c-aeb3-9b715046d6f2", "indicator--702d74b0-7989-4fb2-9c6d-c71407b441b1", "indicator--c758b574-71e8-408d-9401-a8ceb8b1c02d", "indicator--5457a668-4ebb-4114-ab03-cb24e75ff662", "indicator--064ea7ac-e6a8-4796-971e-beca988f0b10", "indicator--9f2a600c-0a79-43b2-9ee5-28ad3269fd97", "indicator--c6e112db-887a-488b-95bf-48f72589d6ab", "indicator--32629aed-f1f2-49cb-bb03-6c5c47349c95", "indicator--75c3cb49-ca5c-48dc-9249-93eb3ba2b36b", "indicator--6a30e234-1ee9-43f4-a110-bdffa72348b6", "indicator--00e47941-b2c6-4336-a3e4-3bd6cfd322c0", "indicator--4c1c6cf6-8fe0-4cb9-b264-81ddf6d1f69a", "indicator--1ce45554-5955-4b97-abac-ada5a3a88634", "indicator--28714fec-5614-4a96-9bc9-43bbeeb7558d", "indicator--fd5ca301-c82f-4c19-8406-5cb8fcfa3229", "indicator--83383faa-cbf5-44c8-a3f4-579fca31bcb5", "indicator--febe7b2d-f4c6-4b0b-9e01-ded5619af495", "indicator--8edd83fb-3b73-404a-9a06-06fdff8bbfa9", "indicator--f927b150-b518-420f-a3ef-67d15f20d360", "indicator--97f85e77-c453-46f8-ad41-853bd5861d8b", "indicator--a0022e14-716a-4958-8376-96d07a35cdf9", "indicator--f2424e88-4dad-42a3-b5c9-e640b719f0a2", "indicator--31a378bb-83c6-43c9-9e37-9719ec60338e", "indicator--1eb6a1dc-fe0e-47ef-a6cc-25d23675fe33", "indicator--5128e947-dd49-4ef6-9261-35fac174dc04", "indicator--a21798d8-cf2d-4950-b9c6-0ae5b669cb87", "indicator--b3e3746a-a975-4ba6-bba1-911b1345d1da", "indicator--82de821a-0168-47b9-bd85-682927b67178", "indicator--08dc15b0-7524-40c2-b052-0c90780bd2a5", "indicator--6f50f565-e2fb-4b23-a7c7-d647e172d326", "indicator--09f2909a-66ec-45e1-a5ef-723d5071be45", "indicator--0272b149-6e45-473a-9db8-fe465c8ff23b", "indicator--ef9997ae-199a-446d-aeb8-43c3a09ad40e", "indicator--8a378d5a-ff74-4ae7-8c80-355e26a7cfc6", "indicator--106fb331-7414-40f3-a8ee-bde076f94baa", "indicator--1fccff75-983c-4ca6-a235-d75a4d941a29", "indicator--af3e3849-be17-4c37-9d51-4bfc95730ac5", "indicator--d3c89bdb-b810-4a72-81e2-f4e869a5c0ac", "indicator--dff9bf84-ff8b-4d2a-8859-5bad5f9908ed", "indicator--a1414e1e-c74f-4356-8794-4d8ccaec1361", "indicator--18073964-a357-4907-bb1b-19dca865692c", "indicator--22e0f073-94ca-4f50-82fb-9f8388b64548", "indicator--671d3243-30d5-46ac-898c-8434e5a1e87b", "indicator--41be5c31-07c1-4b51-b197-494cdcacf53b", "indicator--b26e1491-4b96-4a96-b00f-e44742d376b3", "indicator--2460789e-1e48-414f-b2ba-074fba03b8cd", "indicator--ea9b771b-aa19-4192-b435-aedcf4e3abe6", "indicator--4bfcba22-0402-4291-bba7-e958d22fffad", "indicator--03e84761-ad5a-40bc-9386-50e632ef71d8", "indicator--26b96aff-f003-488e-8648-171dbe155052", "indicator--41dc1d8f-03a1-4bde-878f-564caf13c137", "indicator--0612fa9a-d299-454c-878b-407b2a858cd9", "indicator--1b402d27-606f-407f-89df-bc8e7ad5b3b1", "indicator--36bf25b4-2331-4c58-95e6-c65482c98cd6", "indicator--afef775f-81d9-4054-b847-68bc3b8de4b2", "indicator--0f0a72db-70f8-4034-8b21-b1b2b329f291", "indicator--4fe1b370-4966-4824-866b-d09adcd2ef01", "indicator--e58b712d-4657-4f59-8daa-49276526b771", "indicator--8eb7ddf2-6f64-4671-acd7-abc0da85040a", "indicator--5fbde2c5-f3a4-4b40-a076-afdbeddc04e9", "indicator--8566e8ec-2c0b-4e09-8bb4-8b5e08cee5fa", "indicator--b210a566-4d8c-49f2-8f95-da21e7013735", "indicator--6f6dec30-2bd0-4597-85a4-6285819723aa", "indicator--eafe56bf-35c7-4af4-b382-57aec0b2a3e7", "indicator--0241c11e-56aa-44de-afd9-43ba7e215d56", "indicator--218dc3c5-e117-4885-a4dc-ffeb3ba9c883", "indicator--f8391de1-8a78-4ade-8f16-a8ad3d7fdeb3", "indicator--d07fc57e-ebb3-4145-928e-0110121005e1", "indicator--25bdd7ca-de52-4854-84cc-a7d5924f1c16", "indicator--680e1b31-d40f-45d3-b062-5b2c900b49d8", "indicator--81097b8c-78ef-49cc-b2fa-eed376a0e303", "indicator--0a379bdf-1e20-482a-988d-7635673dc8e9", "indicator--067ac478-758e-4e07-b618-7d15ff97b304", "indicator--90b0a6ec-c5ac-4da5-b6e5-75fe469e8b40", "indicator--babf4194-ac30-4c8e-bb96-f4abdb40384c", "indicator--dc022d91-0433-4430-8acd-cbd2a1743849", "indicator--8c5f7d1d-99f1-4242-97ec-dc05678242e3", "indicator--1e88307f-4ab1-46e1-b9a6-98607e123a72", "indicator--5b5439bb-14c8-40a9-9a97-55bf93fbed0c", "indicator--e8efdcd2-0faa-4b9e-83cc-b4b8454d1273", "indicator--f23ffd04-08a4-4c40-97cd-9ecff3a3d185", "indicator--f25c24d8-6c7d-44c3-9af1-0171a9d7e287", "indicator--add72a3b-2f62-4cb7-bec8-fc1affe342aa", "indicator--34600aeb-6fe0-406a-a9da-89aed582ae7f", "indicator--f5c0e8d6-d161-4029-839c-4dd18259836f", "indicator--f73912e9-f097-4c89-9f86-dc8b9eb9fb25", "indicator--3ed63b28-c3ad-41bb-8ac0-3a7d586faf5e", "indicator--c5111899-abc7-443d-9931-e258a6317262", "indicator--312b0599-bc7c-488a-95ed-f2cdbe68b342", "indicator--3dd5a1d1-65f8-490f-88f5-8b7a26fa1712", "indicator--abc505bf-8bfc-484f-be28-200a73594ab6", "indicator--a283a527-ea45-423c-bcf8-568c688072e4", "indicator--89098e78-3083-4502-91e2-7bed90af53b2", "indicator--56ddd89b-ae7e-40e7-97ed-c1a98457fad4", "indicator--98106424-153a-4308-b609-3256810de576", "indicator--3902f0a4-ec53-40a1-a270-345084164969", "indicator--a54b6ce7-91e8-48ca-8f97-376e12462a7d", "indicator--88ec183f-5ecb-498a-8ed8-edf26cbe4f98", "indicator--1c16272b-d913-4948-9a13-57e10ebf6fd4", "indicator--b59dd82c-2a44-4eff-9c23-7ff0b2a29dcf", "indicator--227d6bf4-0578-4735-aafa-c9cb576f65c6", "indicator--5ef3ddb9-c95e-4534-93b8-4baa391e037b", "indicator--e7e4b823-18c4-48ad-a15e-93adb4799e26", "indicator--59061cf5-4df3-494d-86c2-8c084326ee5d", "indicator--2dd7e218-2ca4-43c2-8bc5-bf942d25fe60", "indicator--89a37167-c9c9-46c9-bc20-1be290632db8", "indicator--b7a49258-b91c-402a-b451-f8adbc4c6937", "indicator--76f7aa01-8e80-4b53-9cb0-2bdad591f99a", "indicator--7e88dccd-a7ff-4d9e-a050-0cd54abcb7ae", "indicator--09044c83-8f61-4c47-a49f-c0cf70a75a49", "indicator--bb7b070c-cad2-4109-83a5-f28259fc8e33", "indicator--1a663796-e4a3-44cb-948d-df2742cca2f0", "indicator--5474d4b4-9164-4365-adb0-1dbfec3575d2", "indicator--5c11b9bc-be6b-44a9-9c33-4c2d85824113", "indicator--2f78dcdc-ffe7-4001-a3e2-687f07e5e037", "indicator--37188c30-7f9e-4f56-a709-0eb05155ead4", "indicator--ad30fe32-a9bd-4b95-aaf1-8fe4eb569567", "indicator--ce1bd91e-27b3-4a9f-a363-8d40325b49b9", "indicator--7faf6a43-9034-45c3-b243-40c666a6c2df", "indicator--00a2f24f-aea8-4c6e-8ed1-c9295e2fb7dd", "indicator--ea4a24fa-a808-47c6-aac9-3e286133df3d", "indicator--f11bf9e0-fc95-419c-a41e-6f8c5a7520a2", "indicator--b67796f5-d8ff-4368-a15c-f6b494caa79e", "indicator--2a99f4b0-263b-4b20-ac5d-db5d65c1a996", "indicator--ac89e7e5-8ae6-4480-bac0-4dd38103301b", "indicator--7acae5e1-b1c0-4330-9f70-e72e1c041466", "indicator--50fab262-760c-4992-9e0d-eef2c1fdee0a", "indicator--2a092d0d-a478-4eb7-988e-85d1614e9917", "indicator--a1d5841d-7828-4d39-9c38-d8ac6a8ebc6c", "indicator--8809985d-98bc-44d2-881c-7b297c5f8967", "indicator--a21a1d65-5fd5-40c9-bfee-c369d8482be9", "indicator--ea0822b1-1209-4515-98e9-ae693c07680c", "indicator--73008ef5-806e-4686-87ee-51ae6fa04bad", "indicator--06aa017d-f05a-466c-b0a3-1c505ab1c849", "indicator--b36792fa-f14f-47d5-a742-66c511bbadd6", "indicator--b16e2cec-360c-4f66-a82a-1b79e6cadb6b", "indicator--cf5b8775-d18a-43c5-b1e5-43b4b9f47a39", "indicator--14420c23-c261-442a-b36c-ec7fe9d0b07e", "indicator--e01546ad-d168-422f-93cb-54242d774a72", "indicator--fc26b307-2075-4907-aa6f-54f03caf4576", "indicator--a30458ce-6b25-4215-bd91-18cfb1ec0ab2", "indicator--bfe09707-72d6-4ed5-b0fe-1f9d0a7e560e", "indicator--9d79c42b-494d-4047-9bfc-517016da1362", "indicator--b4dab08c-73d3-4ae1-aa90-a489622b9760", "indicator--d041fd7d-eaed-43ee-bbba-2ace9ae3ef01", "indicator--b039d06a-15b3-46d6-bfb4-e9078f4af344", "indicator--bbf10ae0-8c58-4744-b6b7-f0744f853e27", "indicator--5e6f2184-ba1b-4fa2-b93f-6f22728f6e1d", "indicator--6cf684c2-dcb0-44d2-9c21-95021e194aa0", "indicator--e81f7ff1-1079-4bd5-a5b8-9568cf6917f2", "indicator--73631c70-2744-4b76-a4ef-66529f4e4b4e", "indicator--432a1c8f-1813-4bec-a681-67f53bc0fb3b", "indicator--193796d5-a851-4964-bea9-d7a6be354c35", "indicator--1d15a651-7bd0-466f-9bc1-bb235b6a77de", "indicator--dedfc82c-f47c-4371-8e0b-b951285dfbef", "indicator--efa15cdc-deb1-4823-be47-ac58a5da0bab", "indicator--d5f0e385-b889-4b7e-90ab-32a0cae9f2fb", "indicator--d9665ca9-f935-40fb-80e4-47155437f8e4", "indicator--0622fdd1-0b8c-48d9-883c-800e8550689d", "indicator--0f1c4d39-46e0-4111-ad8c-66a77377bc6f", "indicator--8cb0420f-81ef-4387-b2e1-851d48a354e1", "indicator--691881fa-07d5-499c-9377-fdf79781186f", "indicator--706ceca5-12fe-4371-aada-2cec947890b7", "indicator--c5d6c2a8-e9fb-411b-9927-f2413ca03651", "indicator--469b9271-7214-4644-85ea-caf6000f9e19", "indicator--f4e9b605-3ce1-4f69-8d23-ddf785f95e27", "indicator--bcc4633b-7e92-450a-abfb-decfbf9e2189", "indicator--01fe407d-d1e0-4ed2-b3b6-d72b2a3d18a9", "indicator--ef023acf-33c8-4158-b7fa-237c4ad649d9", "indicator--bad1a440-07f6-49e4-af6c-c09a5b801e48", "indicator--4a679042-4862-4285-8d6b-f6bf87584bf0", "indicator--cae7f40b-230f-446b-8c08-6779e54ffdbf", "indicator--ce73520d-75ce-4f84-83a1-b0ad5e317821", "indicator--0326e593-6693-4f1d-9945-881b75ae6d76", "indicator--374ea8e3-d4d2-4b06-b7ae-659fd1209460", "indicator--29f8daa4-a9a7-413e-a1fc-15fd19230f49", "indicator--656dcba1-92fe-40ab-af63-379be863259e", "indicator--51cb4608-15da-49fc-8049-1ad871e175f0", "indicator--2afff8a7-fca8-4152-b653-459d96072368", "indicator--ab073cb0-ae76-4312-8047-d8524d7b24fa", "indicator--86cb319f-ccc8-4dfb-a425-dd29c8616f52", "indicator--78d14667-5ef0-4b0c-b32c-dd171f89b6ec", "indicator--51b0fcfc-90e2-4273-bb4a-167462b31e5a", "indicator--c52fbd7f-4bb7-491a-9f20-4acdb12a1ba5", "indicator--3a33a7cc-5b41-4029-95f7-7f6fde0a8752", "indicator--122c9931-9778-42d8-80f5-070cb19340e2", "indicator--5ea8c10f-48b5-43c4-bec8-a1769f2638f0", "indicator--7564e3d4-b87e-4bab-9a3f-c599ff38c2cd", "indicator--bdf51c14-9033-4da6-8738-211ea628913f", "indicator--a96a90c1-a4db-4b75-a039-25d0ffa7978c", "indicator--7807c085-a8d4-4768-a726-c3b9fbbcd53f", "indicator--1c48cff3-e53c-42fb-bd40-f83ca9c56b46", "indicator--e6a5ce3b-7215-49f6-9b8d-239466725d9d", "indicator--20657849-803b-49b6-bf70-61f91200237f", "indicator--1eb7cd88-7e5e-4dd4-b424-f1e56a12df0b", "indicator--b9c6cc16-61a3-43d8-823f-55a8ee73e97d", "indicator--ef06b2b1-558e-41d6-af35-625234ca24c9", "indicator--9cd7fe02-8eed-47f4-9046-9952189ec2b1", "indicator--7e5a462a-2c57-4999-92b5-d8b5fb8b1f61", "indicator--5e84be82-d788-4d27-a9b3-d1de65702a9c", "indicator--b52a0a36-bb23-4006-9434-a05e1aa8d85a", "indicator--a9641479-624f-4102-95eb-3b2a6cf6ace4", "indicator--c6c3cc41-5488-4720-aece-8b932f018eba", "indicator--102d2993-caa6-4532-ab9e-b4eec36bb2eb", "indicator--b3029b8c-9670-461a-9ebf-3d7b5b5320e2", "indicator--850f2eec-2fbe-43f5-afae-e9607eab7e29", "indicator--b0434361-99ab-449f-9aa4-5f10d205ddd4", "indicator--20e49140-e374-4c8f-aa0e-2439704fcfa5", "indicator--5f4992ec-a809-4004-a1ed-f4dfe5881acc", "indicator--c5139ab2-640f-40f4-bb84-330b6facddf9", "indicator--ae3a135b-b7f7-45a6-a1e3-35502513812c", "indicator--064df9d1-273e-41d9-826a-729bba25b09c", "indicator--c38b7329-7b55-4d8d-b9e3-aaf663d7e3a5", "indicator--34756fba-e08e-446f-ad5f-a31d8e19b7ea", "indicator--34b73d94-85c1-43f5-b8c5-ac4a877a1da8", "indicator--2751925d-c346-404b-a18e-368d09d1625e", "indicator--3a4d0e1c-af26-49ba-ba87-7bc64527e30e", "indicator--1fc9757e-cdec-44c1-a366-b59b757433a1", "indicator--14167811-a7aa-486e-9f8e-efcacac09587", "indicator--bec1ae37-e858-4d84-8c31-b41ee5682571", "indicator--1c68afd0-df33-4322-b4c9-7227e6e6dea9", "indicator--3e6f6c1a-deb1-4366-b05f-a108edec3d2e", "indicator--c96adad6-b80a-42a5-ad28-3d64f2ef3f0a", "indicator--b7d758e5-1741-4598-9eca-cb77d27f57c3", "indicator--83e81ea1-2b9b-4723-87bc-53df5738acf1", "indicator--d01d46d2-554b-4eb6-ba9a-57242e1f8536", "indicator--0286fcae-374a-476f-b52d-0db318771dae", "indicator--f83ed600-2f8a-4680-b4db-e63f04f05ae6", "indicator--44063a49-9444-4276-bac7-f24e11c24c55", "indicator--b03d852e-895f-40e4-b921-46e37cd295ef", "indicator--1ddb4e56-e066-4bf7-8033-c6aebbf8bbfc", "indicator--2993d64f-9496-4d8e-ac72-ab5caf1a0de3", "indicator--4218711e-8eaa-4c0b-9976-c47f589fb519", "indicator--8737bda9-7740-468b-b338-7079a124148e", "indicator--6349c3fb-edfe-40e3-b979-e668231d0e3e", "indicator--10cd5745-3863-4ce6-8945-e2c9b91115a5", "indicator--9b6aeda4-158a-4a35-ac8a-11bbc93d4eb8", "indicator--aa648157-10bf-46af-9d1e-043667179f6a", "indicator--d15b436f-3533-47df-8cef-cf6569a41242", "indicator--761b157b-5f70-4924-85fb-90b1032744da", "indicator--d5904a0b-ab40-425b-9c30-40d34f7cd82f", "indicator--af9e0e81-ba70-4020-83ab-a425e947a739", "indicator--344ffecf-282b-4af2-b97c-b58998f44f4d", "indicator--13ce7383-b20d-4134-bf5e-15187e00c3c5", "indicator--49b44569-8673-4cc6-8855-8dfe95a97610", "indicator--6ff912c5-45c0-4a29-99be-e614b1584001", "indicator--7e72eedc-9206-4127-9c28-814355d18b2d", "indicator--3ea39083-3d46-484d-a588-86e15b8e1c62", "indicator--6d441741-cc2f-4ba9-b3ae-fa99ee961745", "indicator--1fe3e2c8-a797-4089-bf16-efe742682e92", "indicator--0301f51d-ee26-4db0-919c-e36dcc56dbb6", "indicator--c33e607a-c232-4458-b214-35f9888ed788", "indicator--2c6a3328-8a59-43c5-b5bf-7d7d662d30b2", "indicator--b880698e-4453-43c2-983d-b158d1343ae7", "indicator--f3a3f02b-e719-499c-bb4a-c1d67a454603", "indicator--3bd45bdc-b870-4887-a60d-909b2a5e4201", "indicator--463e7b9f-73fb-496d-9c41-b73b336884cd", "indicator--04633542-6614-4684-ab0d-c1f94887bedc", "indicator--d4af73ba-83c5-439e-9670-f09a44d46ae4", "indicator--d5d1e954-29f6-4a33-8dfb-3c31af7bdbe0", "indicator--f68f2c69-9b72-4bb4-86b6-dd01201fae16", "indicator--c0fb9dd0-534f-4279-945e-c4b93738406c", "indicator--29e19c4b-a87a-40e4-a060-f92e2f50d9f2", "indicator--5a8c96a4-61ad-4fd7-a7a5-cbc5a67918bf", "indicator--30322b43-43cd-42bd-a1d9-f83d2c124c9a", "indicator--6dd4fdfa-0b79-4950-8dd7-2db05579108a", "indicator--57fec7e9-030b-4ad9-bcc5-340f60d51d0b", "indicator--8cf33263-c62c-4620-9ca7-38e9d25b4f07", "indicator--c4594651-5312-4293-8821-fc8eaa9e30d3", "indicator--f3fae7b2-d87e-493e-96fc-03a58c3cb79c", "indicator--2587c699-a8da-4ae4-9a84-2e705f367c23", "indicator--4379a3ac-4ea5-4d6f-a03c-4df0cafb67d5", "indicator--802f0be6-b3a4-4bd6-ae5c-e78fbb0ac175", "indicator--a4c65250-788c-43d2-a8a7-3751d23fc7ee", "indicator--c31a1bfb-46f3-40bb-aef3-040276e158a3", "indicator--bfa4a47c-abd1-4850-a59b-5ecdb3b22a4a", "indicator--46014158-7bf9-431d-88bd-f395ccdf578a", "indicator--e35289a7-761b-49d5-91b6-0fcb7fa477fe", "indicator--9d48f1ae-f0ad-4c1f-822c-4e1abb9016be", "indicator--2c040dea-3eea-44ff-9c72-48ca018a9c80", "indicator--be338b61-abf1-4d90-ae8f-ef87cc3f18f4", "indicator--28aeef33-b02f-4c9e-a5f8-8bd976b4d897", "indicator--fd1b8b0a-8a9e-46a9-a199-b5f5ecc9c238", "indicator--2ebd95c7-bc34-4f49-a557-b2514ab7b3e2", "indicator--0bcc853f-cf56-452a-8b50-c835b074db59", "indicator--ad3e5f84-1c99-455b-adea-341c4c04969b", "indicator--dbba61fc-ff6f-41e3-8acd-4063ca9a9c87", "indicator--c878458d-35d0-45a5-bade-c57c1a415e23", "indicator--478165f9-5434-4ef6-9030-64f07a00026c", "indicator--6f3de3d9-e051-49b1-8934-564d68c2dee3", "indicator--fe00e4c2-0c3f-491c-9780-736d5452cda1", "indicator--16572e8a-cd61-4410-893b-adb831cf8a05", "indicator--1b530605-22f1-4c95-8599-38b45eae4381", "indicator--41118741-957a-4010-b3ca-b694e297266f", "indicator--0d1c42c4-c865-41ed-8620-fc4194546753", "indicator--1b9e9d35-cbaf-4343-9556-76e48c7dce3f", "indicator--2d679db0-89cb-4965-b949-bf04412cbbb0", "indicator--126732c0-4fe5-4049-895e-e6e3ea74d3cf", "indicator--4393939f-b7b3-4e07-afa0-0e27c972324d", "indicator--cefdeaa6-147a-4310-9b97-86254edce077", "indicator--b72831bd-9eac-46b5-89ed-c840a131fe00", "indicator--b6b4e1e8-1fac-4daa-ad4c-dd7db73c7483", "indicator--ec7a196f-f06c-4c5f-811d-09db8a114b23", "indicator--68bf945d-4c3a-46e2-8a0f-d42a20fcc0a2", "indicator--1e0db399-c2bf-43b7-b28b-e047d9e415c9", "indicator--cad5af18-bf73-40d3-98bc-c06f0a824db9", "indicator--6ec31435-ac81-4539-afdc-c766370790c8", "indicator--20940f1a-da0b-4839-9489-1153473dab30", "indicator--9f3466cf-75fe-4c7e-b7f9-24d4a61d8fda", "indicator--fd10bdf8-4a0b-4e15-9661-7c92122cd5fc", "indicator--b42f53fb-df78-4f4d-b1cc-f3d8b91aae29", "indicator--c0025822-904e-4217-a03b-96d7721db26b", "indicator--a33c63ed-6e95-4065-bf6c-108eabf676f1", "indicator--5eaffa56-60dc-48f7-949a-a7beb977e45c", "indicator--7256d878-20e2-438e-a5ce-ce88f18f57c6", "indicator--bf76eeb5-1ae0-4b0f-b004-d3b62cc6e59e", "indicator--50d22a89-0552-468a-a0fd-69ecd86c6725", "indicator--96ffceb1-8dea-45b9-a66c-dc4dd1d9048f", "indicator--e265f4ec-053e-47ad-a006-5ca8f11fe54e", "indicator--a458f396-e5a4-4028-adbe-151a8056a72f", "indicator--ae0044b6-9223-47cd-a9a0-13e5f9ca61b1", "indicator--f929c72c-dbe9-48aa-b071-5d974432354d", "indicator--20b70c53-c233-4370-bf56-1090cc5d48d2", "indicator--fc00c4b5-9b54-41f7-abd3-56e2f80807b2", "indicator--3c3eaf34-adee-48e5-ba2d-8c6a2cdaea8c", "indicator--ee8d0b73-3ac4-42ff-98c0-7ba37778835d", "indicator--a2d140b2-e0ee-4ded-a2da-c19fbb74ea9f", "indicator--82abf2af-7b11-478f-8579-b8724d7a95fd", "indicator--2dad6664-87d1-4e96-a04e-b8eae943f6c1", "indicator--4495b1fe-8606-41cb-bbd1-5fc276936890", "indicator--6cacca3e-adcc-4c91-92ba-f4ef38e2b51b", "indicator--f3a63003-037e-4411-927a-1943e9c0fff8", "indicator--513f8658-dd51-47c7-964a-7270519ae74c", "indicator--41cc2bc8-8e77-4cc4-967b-82332bac5734", "indicator--4c28c3df-38a7-4d5c-baad-fa68d9a5a1c2", "indicator--836bc643-693c-4d10-9d27-c761695ec9b8", "indicator--d8af6c94-fef1-4b6b-93b2-c027c2418dc8", "indicator--6a15d94d-4fa2-4c05-9d36-b01ca55e4aa8", "indicator--1073b95a-d281-4891-918c-54c375f78ac3", "indicator--537a1d76-8c28-4889-af49-0b4978328788", "indicator--c5737401-6a14-41fe-aa94-0835447a1949", "indicator--b1a396a4-3efb-4edb-9927-0ce9163b451e", "indicator--2d90decd-0131-4fe4-a596-750d79d37763", "indicator--9525f680-8cc6-4c83-b5cb-45c7cd26c017", "indicator--a7bcdd17-cbb7-45fb-9717-9bab57b66af1", "indicator--35cbd59e-2ffc-43b5-8fb5-d17038711258", "indicator--532f94fe-6692-4ad2-a965-2cf85a782e3a", "indicator--fd24a7f8-e546-40af-81f1-2b33111201ed", "indicator--2fe19b0a-fb3b-4215-8f02-575d74d60b96", "indicator--4f5ab791-bc49-4d40-9d81-b6d99a5d3b65", "indicator--5e7d926e-e6ef-4238-a160-3ddba00d5664", "indicator--5a1f0b28-5e8a-428e-ac8b-acaa2978479a", "indicator--2dce77f9-04d7-4d98-9fa6-5e6e9e416236", "indicator--1a4856c9-b59b-4656-b257-4b99fed66610", "indicator--c1cf8c01-9d9d-4f49-9191-4a296d595856", "indicator--056d6e90-d13e-4bb5-908c-0736f1955a03", "indicator--c722ff61-5301-4a7a-bca6-f880419a710e", "indicator--ecec7931-c6a7-4e02-9931-d261fea68ac0", "indicator--ff4190d8-2ea1-4922-9b68-c202f736f6a1", "indicator--a9fe299e-53c3-45bd-8271-eb1c6a798631", "indicator--24fe1563-f5f2-466e-9222-3cf970b43dae", "indicator--32ee3d3d-2916-4596-8086-a7271c363f43", "indicator--12451352-de50-49f2-ae46-10e11186d134", "indicator--ea8cdf10-75aa-4db3-afb8-2c57bb8d4998", "indicator--e2786cf0-e5c7-463a-8c0a-15de30d4b7fc", "indicator--af553af8-1c96-4b8f-bfc5-6fefc8632d21", "indicator--b835f2bd-771f-4a4f-8202-a83fc3810638", "indicator--3da8d00a-73e5-4d2a-89fc-53d655f95ef3", "indicator--ef3ef9e2-850b-46b8-82c9-818dd0a3cc31", "indicator--a2fbaf7b-1095-4c94-9978-5680ba6708db", "indicator--3d6a8bb8-4872-4d3a-958f-ae6266b2cff1", "indicator--dc619553-72d1-4479-beb2-fd2864191b94", "indicator--244fddf1-0f31-47e0-9084-a434b22859f7", "indicator--d597ac90-4467-4da1-9bcc-006d00e89de0", "indicator--0c56c4d8-3949-431d-ac5a-252729b85928", "indicator--8cb9cd3d-ba3e-4c9b-ad9d-6845f03a70ce", "indicator--a452eff7-8365-4209-849a-18ae087a2009", "indicator--f2dc75b6-4fcd-4b82-b5fc-779b1a8575f2", "indicator--3c4ba8f2-af29-4963-a2f4-2e0313179b3f", "indicator--d86512da-af27-4e93-b989-19a3cb029398", "indicator--3ebad791-c3dd-4c6a-a844-9d9cfd062641", "indicator--82153fd8-f0fd-488a-8557-76282050680b", "indicator--f7012c17-8400-4d16-a53f-6e58f052e32b", "indicator--9a454a61-94e4-40d0-b29d-b2544cfc70f1", "indicator--9ec4434d-f9d6-446b-807e-cb8797267d9c", "indicator--ac1a3c57-643f-42c2-be49-6a54a40201a9", "indicator--c789cd4a-7505-4ec8-9a94-9c59e0b5e844", "indicator--e2fb249f-c8ad-4845-affe-e6a05b64ae06", "indicator--da7c893e-bb31-4f40-9126-d3fdcaae2910", "indicator--fb3233e6-6ac9-4177-b766-bee2f2c5ebce", "indicator--e0e08a54-e39b-43d3-a614-9bdfeace5edb", "indicator--2ba6d7e8-b17d-4cd1-a4ba-0de7fd358bb9", "indicator--2c53530e-188d-4e58-89a2-b13d39f41621", "indicator--2e76588e-ee88-4350-ba17-3a9fd18f68cd", "indicator--583c48fc-88a5-4b31-a5f3-af86fc3d3b24", "indicator--d197de7e-ab67-4a3b-ac86-044a5f9e8a38", "indicator--dfcc9549-acc2-4be1-9038-6fb5c13999f5", "indicator--d1a90008-0c74-4ef4-998c-f88d9ed13274", "indicator--c0ce9a4d-f0ad-4ee5-9eab-77791f3b354d", "indicator--207b3f2a-3524-4032-8413-b85b17c8dff9", "indicator--11e8f8aa-5048-45a6-976c-8a2a546303d4", "indicator--363d08e9-799b-4bc7-93b6-bc51273efafa", "indicator--b9aedafb-ae08-49a7-a074-687a818baa3d", "indicator--e07f4d84-c1d0-4ea1-91b4-af9c1827f7fa", "indicator--cb220584-1df8-4646-b976-bc20e66503b2", "indicator--04d21190-eecc-4710-b36f-90f485a65236", "indicator--842b6e0b-3007-429e-aea3-7f03b93c32f4", "indicator--04e2b61a-b035-4218-a94e-b3ded140396f", "indicator--9904dedf-ad7a-457a-b783-48d56fc3496a", "indicator--ef24ca29-2aff-4807-b44b-4b6df366b9ce", "indicator--b332682a-76a3-4d7f-93d0-1604587f9fb8", "indicator--b59c5796-2e5d-488e-bf4d-6df30301a64b", "indicator--0e1f089d-02d4-46bc-87a3-fd2dffd677e1", "indicator--3a8a1ecc-74c4-4fe7-bdd4-c2457653445d", "indicator--35e02c21-529b-42ac-bbd3-97c7d6f20467", "indicator--32f8679a-e718-44a3-a4e7-7d7464545881", "indicator--2d65076d-6593-4baa-95c2-c3705cc71993", "indicator--6fb36879-5d6c-44e5-a1c3-3af40981335f", "indicator--562396e9-3b4b-42a3-a054-2952cad8306d", "indicator--22e8298b-907c-4df0-995a-253f3a805541", "indicator--7dabeaa9-efb1-4a25-8267-c63c8c7cc6a9", "indicator--c5a314a6-6d0c-433d-8221-30ad618914c4", "indicator--2193f25c-2ad1-47c7-925f-430c2d8099ba", "indicator--6e15e773-1723-4b51-a413-fe0f45a79621", "indicator--e4708a6d-7a14-44db-b914-dcd70b4dd89c", "indicator--8cf0ed04-3d89-4d97-b949-099df243f918", "indicator--e18f297a-97b0-40f5-b45a-921d0ed84552", "indicator--7561a7da-b344-43fc-95a4-b873f2f672eb", "indicator--2a8f4155-5853-4004-956c-5ca4dac43f5d", "indicator--e0a51869-5764-4eb2-84d5-ddd418d802ca", "indicator--bef2ecaf-2ccc-42e1-b7b2-43f4eacb67b1", "indicator--1cd70794-a4c1-437c-8ea3-1a98688e2a82", "indicator--f150a5c9-df57-4776-bfeb-27af70188eac", "indicator--b1bd900f-3349-45ce-9745-064d79abf710", "indicator--8d4981a5-397a-46b9-9b96-50e5e02ebf72", "indicator--0c38beca-bfa6-426f-b84a-586bb250ad3d", "indicator--0ee232b9-074f-42fa-81a2-25ccec8c30a2", "indicator--f88ec160-968c-4120-84cd-5f452ba3ac19", "indicator--946f045d-6423-454a-8d73-e562f361bacb", "indicator--2a6f25b9-680e-4347-abff-1b58c7041e31", "indicator--ae349b59-bf81-4e9a-b080-da6aa7e5dfb8", "indicator--9617b054-2a2f-4e8d-8d23-fee6007d96b2", "indicator--f93c95f9-60eb-42c7-b95a-24946dad83b2", "indicator--46d32ed6-0f5b-496e-95fd-a3534c97f2de", "indicator--cb300715-56b5-4a79-92b5-1ebc3fd389b3", "indicator--2b19852d-cf06-4308-96a4-589f3dd13240", "indicator--ecdd5ec8-5198-4235-a1a2-ed8e92f8bca7", "indicator--6873335e-2c4a-402f-bdf3-415260f31062", "indicator--e8aec5e3-619d-4c91-b234-e5066d414232", "indicator--f9c58744-0bf7-49e5-bf75-42dae18c5dad", "indicator--e64a16ae-db93-4154-bda3-0003b6def93b", "indicator--2a4b780b-8f0c-4df8-b4e6-1e477d58d5d4", "indicator--0dd942bd-54d8-4a02-bd22-ca60a3fdb39a", "indicator--4f1850c3-79e5-4ca6-b968-2ab83092eb89", "indicator--94a3c384-f2c0-4202-9bb2-6dd0c27f4d0f", "indicator--24e94c68-fe75-4f12-9e98-6cab390f5fc6", "indicator--b99d2275-abb8-4f6e-8f8d-142063870edb", "indicator--24a8fa60-7a75-4149-8d14-83b647d781d7", "indicator--364f5eb9-8ca7-45cb-a8a4-2da752043651", "indicator--4dedbfb7-512c-41ab-b4ee-bdba116acb91", "indicator--a7a3ac7f-cdf6-480b-98f7-eb6b3f91a55f", "indicator--2c6dca25-7a40-41de-8399-19ad73e9fcd1", "indicator--1021421d-4eaa-4de2-a477-47449bd660fa", "indicator--a0e19781-dfd0-47c3-99f4-d7a2c82e5172", "indicator--37536b14-e83c-44b9-993e-d0f22c9e11ec", "indicator--c5334cbf-74d6-4fdf-9297-b43bf446f1b1", "indicator--970351dd-b258-425b-9408-8cf4671fb2e4", "indicator--bd994e59-81a8-4697-9269-8574f696aed3", "indicator--5aa8d604-85d8-4dac-b23d-68ff615b670b", "indicator--d825d9e8-1187-4b4a-aa97-95288dfee48e", "indicator--06609c8f-8974-410f-bf16-6e8dcd14f8e2", "indicator--a18e7b77-77d8-4400-a047-8f9736f81a53", "indicator--91803c06-ce81-4443-85c3-c4ab857e022a", "indicator--5270f40e-0ea6-4cf7-8754-35748cdf14bb", "indicator--0aa6e843-be0d-48a4-a0cb-e71124a37c41", "indicator--a1561fc2-d9b4-4c8f-b3c1-11c6040b1cd1", "indicator--ce8740ad-71dd-4e59-98f0-af08dc51f2ea", "indicator--6b35aea0-e9ec-490f-8422-7d600615cbff", "indicator--a3715dcb-86d6-476d-b8b5-3c63f5ae12d4", "indicator--6e258b18-193e-4c6f-8d55-d1dd40abc629", "indicator--abdcace5-85fd-49b6-bb44-7f1aafa1a97c", "indicator--9c3280db-375d-4a8e-8db6-cb0d9d6288ae", "indicator--7773bddc-e800-4ea2-9059-f114f9ee052c", "indicator--029b9587-584a-46b1-9161-7c87cd6713dc", "indicator--4e7d4516-d47e-4061-b6f8-008b87aaa60d", "indicator--0990aef0-afc5-49a6-9a4f-ccb2047b449d", "indicator--a63fce44-a15a-4a6c-8cb9-07e874c902c4", "indicator--6c4d0ee4-9ce0-4b1e-94be-e5edaee4121d", "indicator--ba58910a-7346-4650-8bfa-e3107d63d3f7", "indicator--9f47baa0-8c8f-43f1-a7b4-5ea25a087b9f", "indicator--bd00ba86-f309-4f1d-8959-4b9160649e9b", "indicator--504c733a-99b5-46ea-8b91-dd07a17038f9", "indicator--4dc5d7e9-f239-44d7-aefb-bdf1a573e841", "indicator--a2bb1646-3ed7-4b13-b532-8c5d014931ef", "indicator--58bc587f-6b70-4024-b708-2b0a12fb6fc4", "indicator--1147f271-2ea4-4ae5-a2ec-f5b8abe4fd20", "indicator--eb0ec2ab-120d-47d3-9160-0bb127a11191", "indicator--6c0b0810-8ba7-4749-86f4-7be4aadae462", "indicator--5cf6489b-74c3-4638-b21e-71e357398e63", "indicator--8057698f-8752-4b17-8243-7510f21dc739", "indicator--f224681a-5962-4d89-aaa6-9c24cc68f123", "indicator--21a51669-eb94-41de-b2c2-143094b2d418", "indicator--12693c0c-bc52-4ee8-b25b-e37af1bf1116", "indicator--02db0e44-f60c-43a4-ab1d-d65b51721d3b", "indicator--c1e29e8c-9917-4195-b78d-151aa755438c", "indicator--bb0d53b1-2648-4ae0-a7bb-2fd5e0066083", "indicator--088f3ce3-8d37-4b9a-82bc-61efe450873e", "indicator--52c885e1-2e0b-4e32-acb0-cef4ce51a8e0", "indicator--5a466c63-0231-47d7-9190-cc92b243cbe3", "indicator--132d4a3e-376d-418d-8f7f-b398a102c7b7", "indicator--2a146708-794c-42fb-bf98-d749b0367386", "indicator--2a5c45c9-362e-4493-9dab-e0b6e4792c40", "indicator--060adacc-79d0-4814-93e2-b2e201c27795", "indicator--32144b3f-3ab3-4a78-a1cc-0a18c680daf4", "indicator--4fc8d9b6-119c-4a3e-9817-a854fab45d8b", "indicator--f7366bf3-fad3-4354-a262-91fc5556730e", "indicator--20efd5ba-56b8-4cd0-987f-106d016802d9", "indicator--d3411247-dfa4-4338-b443-a2cb86473c19", "indicator--10b14fe7-9fa7-4c13-b1ea-347e25178f54", "indicator--c748b3dc-b142-4344-9e41-59899c0e0b51", "indicator--fd827b44-5635-4e16-a147-50372eff8d38", "indicator--fc18724c-a632-4a34-9aa3-bb98c5ee6d29", "indicator--0c1853fa-fee3-45a9-9dd8-7ddbe2cb29d8", "indicator--55221106-e7f3-4cfc-9840-808507c53e4f", "indicator--9d8528f2-847f-4e14-a50b-1e8a75743cb7", "indicator--97619ab6-f4d8-48d5-a635-887d2f53f391", "indicator--ca4188be-7cf2-42b7-804e-5985a4d8a601", "indicator--689f86e9-22ca-42d8-b16c-9639645adc5d", "indicator--b6970798-1257-478c-8d17-ce94acf9bc04", "indicator--c01d8eab-5ca0-4db1-ba87-c31e9a454730", "indicator--b08d0866-e196-4d9e-ba04-e5831a878f2d", "indicator--c746ad44-f9c4-424a-89cc-29e547dc66cb", "indicator--465fb32c-7b06-4510-8224-c261b478596a", "indicator--a0b7311d-80a9-4f44-b760-0893269d26cc", "indicator--e91fcad1-bc0d-4ffe-8cce-01f4405378b2", "indicator--5b58ee44-3659-4454-a591-bef4b56160d4", "indicator--b130dc74-b0c3-42ea-b2cd-2094e008c721", "indicator--43ee2dad-df39-4572-9e1f-e14a2c69884a", "indicator--dc56cc98-e970-4c41-b1d8-7de87394a8ca", "indicator--9a302740-ec30-4239-af8a-cd32b4c9bef6", "indicator--9effa3cb-ba13-4125-b5d9-7ff9c016e52f", "indicator--24c55c35-ea7d-40ac-8fb9-6f8311a31d27", "indicator--2f792065-ba7f-4a6d-8152-9c856c195f0d", "indicator--6044099e-a032-49b7-b670-5e0ab5009b5b", "indicator--e499bb68-d864-439e-9300-99cb8d6c1b87", "indicator--7925be83-7f09-4033-8a95-5e2faf48701f", "indicator--dea1d578-6b64-4bbd-8ed0-ba1604d4b492", "indicator--5999c117-de5c-4ff5-9b29-667926343cc9", "indicator--1b6e913c-466d-4a64-abc4-26ba5ff0cb90", "indicator--3fb8bfc7-b484-4929-ad6d-5559f6a01be1", "indicator--b0ad1015-1ff0-4f03-b8cf-6b993a9a436c", "indicator--dc49d75d-1058-418c-9b56-f455865d0067", "indicator--d038f7b2-eea7-4bf8-9c93-49d3a9489338", "indicator--5275a4d5-cd35-4333-8e14-f6e777b92398", "indicator--4e427cc9-ad51-463e-a136-01b394c0f986", "indicator--7f5bfb43-cce7-4c2d-a288-e62f9d75168a", "indicator--d6f82380-d439-4b08-a063-bd1b50cbedd8", "indicator--09fa2710-4bbe-43f0-8427-c578fe531272", "indicator--83d11b43-ae9a-4b97-b47e-ed373df6639f", "indicator--3b73b8cd-320f-4c6f-bcb3-d4fe0b66018f", "indicator--55d6e323-a472-4a59-9808-0505d5c5954d", "indicator--605b98b7-0fdc-4e1e-b5cd-088582319beb", "indicator--2aaed40b-7983-4f14-8404-e9f4559d3c2c", "indicator--bd93d17a-68f0-4043-9e92-b4fd2db6998c", "indicator--14e059ec-9daa-416e-b33a-d43fc10be7e9", "indicator--b4c0a69b-3c0f-4d01-9582-34223acc3bca", "indicator--bed7a881-e8de-4d89-a855-3d5c1e9daeb8", "indicator--02f8b970-16a5-4003-ac4b-78bc5d91bf4c", "indicator--0878fdb1-f343-4a42-bd14-040a40b3d2fd", "indicator--79ce01ea-1e70-406a-b95e-750b627055a9", "indicator--8f42b1e7-2deb-4b12-91ab-5f2d99d86675", "indicator--51f86d1d-2f56-484e-9b09-929fa605797d", "indicator--507e168a-f1d5-41d4-9d84-4ff6a2419be1", "indicator--37ddbd6e-f4bc-4a52-ab40-cfd2166624dd", "indicator--07329355-b86a-454b-b382-8dd541077561", "indicator--aab0da12-d7ab-4d5a-bc5e-0c738488ce39", "indicator--5bea2448-3869-4e6c-b355-709c86fdacc8", "indicator--694169ca-6240-4594-9078-80a5ba4cd9e3", "indicator--f939af27-fb2d-4d57-bd9c-bfb35ee376c7", "indicator--f4c082fd-7e8d-402d-8968-f7d282aa1a5f", "indicator--51d09303-de66-427c-a6c4-79d5b08478aa", "indicator--0ea3146e-3c7d-4a33-8540-ee3ec994b6f2", "indicator--f7c1c964-9840-4b07-8c10-114a5073a5e2", "indicator--28f560de-3bf0-497d-b88f-680a328b55a7", "indicator--3d8e0d80-e5d3-441e-b897-baf65e083da3", "indicator--1c71ae07-fc00-44f0-92b2-5ad4f30f2b27", "indicator--a965c41d-d6db-4f85-9a03-9cb323cfaa94", "indicator--9049b6c5-fcc5-49eb-b7a2-6f1e1be38f0e", "indicator--063e83a6-3b67-49fa-a270-3c39fab5974d", "indicator--fb9bcfd1-3706-4272-8bb1-2785958adfdd", "indicator--eacf68eb-5b90-4a34-a1a3-3cd42ba9901a", "indicator--b5857a7a-0a13-4f18-b816-b487c6dccc6c", "indicator--81899754-a012-4a4f-b189-c04bd29110d0", "indicator--824d9499-034d-454f-93fc-270387fc7821", "indicator--752230ad-d3ea-4439-8ebf-4b2eff548f03", "indicator--897c8cb3-10dd-4710-b99e-79b6b238e5d6", "indicator--d991bb0a-6100-45b5-9d92-12fc63bc87e2", "indicator--6a314b10-6b37-4492-8759-a8888a31ea5d", "indicator--60004bfa-664e-44f7-99af-854a0e6317b2", "indicator--8f4c3196-7f6d-4433-9923-fc3e96787fb2", "indicator--5a89ba00-7782-4c7a-9ea5-56e2ff7ed5b1", "indicator--9e523c24-61ee-4af9-805f-21d3a11bbf76", "indicator--f994dcad-9043-4b19-8803-0fa85e56024c", "indicator--60331e7d-fede-4a9b-9125-68f5ef5ba1b6", "indicator--bf953ee9-8f91-47fd-a2e5-599444c9b4cb", "indicator--d2da69c4-b8dd-4907-a113-070a0e97fd73", "indicator--5841aa38-d720-4faf-a0b2-9b8815896930", "indicator--9c63b829-312d-4d13-a43c-ef2a1d858c4c", "indicator--5ec2bc82-52d1-4ac8-acac-d9f3cb46affd", "indicator--02d3480f-27eb-418e-a06b-0c0081d191ee", "indicator--844cd62e-5306-4d3f-85b5-0ab05715b4b8", "indicator--5c62a30f-9dc9-4fc5-9638-0ebb312778ca", "indicator--b7aea4fc-e758-436b-9e03-61683b63a1a8", "indicator--2a61f72b-db46-4a08-908e-a7dfc2dc71c8", "indicator--f2be1e11-eae2-4b0d-b0b4-6c9b554daa91", "indicator--ba36369c-9740-4c9a-8f33-64956920b90a", "indicator--e77a1e47-30cf-4995-b3f3-8d8a9523d7cb", "indicator--e87ee7d0-85b8-4262-b674-178b5ada11cc", "indicator--5e726fa4-2064-4d7d-ac55-a937d89f06da", "indicator--5423a473-a36d-4ef1-9701-34bcf92049dd", "indicator--52f1bc35-dcd2-4333-a06b-16b89162f5c4", "indicator--2c59f73e-2fff-4107-bc0a-87730f372544", "indicator--7050d3bf-10b6-4077-b3a1-8c307e883ccc", "indicator--51542068-76aa-44bf-ae2c-fbcc0abdc8f7", "indicator--72201570-1139-4fa9-bf97-8a8e07e1c487", "indicator--08a2d198-e00a-46cc-8a6a-b2361544f915", "indicator--28bc3364-c938-4528-8d3c-ebeed2691174", "indicator--f08a08a6-a40a-4ae0-8ccd-3645f6998106", "indicator--abef74c2-b223-4421-b476-f25642c633d6", "indicator--2a14e5af-97b5-45f7-abe9-d4cdd146b9db", "indicator--f83265fc-3623-48be-b318-33485637a9b4", "indicator--088dedbc-b33a-4457-9d14-7c3dba215b3e", "indicator--c68f84f1-e0bf-438d-83c0-8688ca2e411a", "indicator--73d568e9-90a6-474a-9d05-93b138eb0e8c", "indicator--be2856b6-68ec-43ca-aae6-fd2ce5c44249", "indicator--d6d0c08f-04a3-4de8-9f80-3aa30f507cb5", "indicator--a66b0853-4c21-4809-9453-6a2b5e45d34a", "indicator--0799ad45-b72b-493f-950c-2b76fbf69fcb", "indicator--e299001e-9728-483a-abd3-e21d4dc0b898", "indicator--7b5c00eb-1fff-4d6e-b570-4b317a7bb2f9", "indicator--d3ab4804-b640-4d16-b0c4-22f3ed71ffbd", "indicator--e00a592b-73af-46aa-8eb7-d547168edbb5", "indicator--c2a6397d-aa4a-4b81-842f-8ed85cf00ed3", "indicator--f3d7847c-8ce5-4645-b1a2-4b1433062a2c", "indicator--fdf07297-4508-4475-b686-bd49c6b810d0", "indicator--a061a910-20ac-4955-a402-e27815eede49", "indicator--0d041a6c-cc2e-4f25-a757-071b9ecfea3b", "indicator--8f890cf0-8795-44f1-8759-ddd09af7afac", "indicator--f79bbbb8-10b5-40b9-8f3a-fddd3b6af06c", "indicator--e159dceb-ab77-4aa9-a624-8a0df4db5730", "indicator--5153528c-4be4-4204-b7b9-0248ffbab5a2", "indicator--00910b26-be13-4259-bb55-d870e8492c8a", "indicator--26fc9cca-4b48-46dc-854d-378098ecabf6", "indicator--cfc82302-e96d-478e-b7a6-bbaf08ccd251", "indicator--28326572-662f-4d81-8b10-e3a723f7117a", "indicator--3c5e9882-6abf-4733-8add-20fe415ada38", "indicator--669080cd-0657-4c9a-acb9-169eb13c962c", "indicator--3fd5d631-2546-43d6-828d-215fe20e7659", "indicator--66456448-c444-4dce-bda9-6b3b1d07407f", "indicator--b59b2458-0319-465b-b7a0-9519f83b61a9", "indicator--ccad2d5c-eaf0-4836-9c59-69931163834c", "indicator--d9f9a05f-fbee-4433-9316-fb76f47c3c6e", "indicator--22ce4145-124b-4060-900f-6681a4c35c00", "indicator--6385ad92-f42d-41f0-a057-ce6dc964a509", "indicator--0bb3ae2c-cf70-48fb-8e3d-53705664b56b", "indicator--4196cd6d-55e8-4fc4-bddd-50a227d3ce8f", "indicator--76158737-37ba-49e8-bb90-da703925c05d", "indicator--cda0783a-30a8-41bf-ac14-772fb4d12f5b", "indicator--14b40cf8-de7a-4e9e-b5fb-06ef5c67c71e", "indicator--ced2b704-b18c-4a02-85c0-f814a947f51f", "indicator--9af10397-f282-41e0-8d83-a0fa415a7308", "indicator--c6d09478-42a6-40c5-a3d3-285e4c6ac292", "indicator--757c26f1-6d16-45a0-9c6f-badc32819eac", "indicator--c486f671-fc6b-42ea-a3f1-76dc3c4a695e", "indicator--077b23ea-3f50-4905-8572-afae485f4ab9", "indicator--b124d958-e832-48fc-927c-2ae06bf94e3a", "indicator--35104e99-d7ba-447d-935a-adc9bf5dde1a", "indicator--349af2a4-d15b-4503-ae1b-257459a507b5", "indicator--1f66daa9-e140-4bf4-9758-33fecead9fc2", "indicator--17a0e975-595e-4fd2-8fbd-5244ddeae04e", "indicator--a33e42b6-db61-4df3-9459-3b07ff918ba1", "indicator--e9f15ba4-3fcd-4a9c-b0bb-15c4212bd65f", "indicator--8d70976b-0c29-473e-ac9c-340f10344ae0", "indicator--b5b1e05e-bcce-4b0d-aafb-123ef8d4aaa7", "indicator--5b230c3a-f3f3-4985-a8f5-69a494f3cfeb", "indicator--10a0ad34-4622-44af-9b52-7536acf2c3b5", "indicator--9327712c-7b4f-43be-b891-02af41b458e4", "indicator--b8c0ad86-5bec-4881-9c82-5b82917ffc89", "indicator--83cc1865-fbc3-4f60-8eff-c4b29543e540", "indicator--2f2069ba-37a2-46fa-8b33-2bf9cb8566dc", "indicator--2293a6d5-6dfb-4295-817a-aea1570242ee", "indicator--ef108874-08b2-4920-b11a-27e7c5c3f52b", "indicator--e4438609-6ffa-4728-bec1-a7782e0ec8ca", "indicator--253cee49-cf15-4779-a0f7-5a4567dbe0f5", "indicator--f32dca4d-777a-4848-a406-2f0c9cbbfb5c", "indicator--1d0f5234-6861-4151-a734-c5169ddcd6ff", "indicator--38cde52e-c028-4311-be77-f06b8392aae7", "indicator--d1ca032d-bd1e-4589-a26f-a2cf34b79763", "indicator--eb9d7313-bf6a-4b77-b3e2-fb47663613c7", "indicator--77f5f407-edb8-461a-bf62-a8e37d02d279", "indicator--eedd1a0e-48ee-44c0-85f8-63994da2ba42", "indicator--ad8c0002-b9b9-4196-b4a1-f2deee811cff", "indicator--fdbcc752-a4e5-42d6-8b3c-a77e4dc93ec8", "indicator--e610c6e4-afd5-4e43-b6ed-779650056495", "indicator--7440a34a-0ef6-4746-9f8b-53cb82405e9f", "indicator--134289fb-1ab1-4e05-88b2-ed5dac0fce7b", "indicator--e13cfc73-459b-4708-97e5-1bd9f2e55316", "indicator--ba8cdc69-264d-4976-b7f4-17f55039856a", "indicator--a0c08a50-ed04-4408-8fc4-54fd9de8486c", "indicator--22c5baf6-91c4-4c3e-bbf9-c880ee5f32b7", "indicator--fbf275fb-de3b-4c4c-8225-cca3e60cfad6", "indicator--12fb8a06-413f-4103-8a31-02ef2e6f86ba", "indicator--3cb32bcd-0368-4c45-a81f-8deb1427cd6d", "indicator--70c81116-a6e8-42b4-983d-96dcfcf446b4", "indicator--4d3b4d43-5a90-46b7-8bec-d84bad7e8405", "indicator--94af2563-d591-4d9a-bce0-25f7bfe97ae6", "indicator--fce9bc69-7d68-4839-b796-8dc82d31bbe8", "indicator--3e156511-cbf0-44ea-9c76-05771afcd71b", "indicator--cac3bc9a-bb50-449e-9892-f17477766c1e", "indicator--e52e9ea6-588a-4246-89c2-c2da1ea9e0af", "indicator--99b56961-c3d7-4548-92ae-d0744d64152a", "indicator--4d1abf1f-64c7-4e25-9e2b-6890a60204bb", "indicator--d6ed060e-69c0-41a5-bf0c-5d3db3e36d6f", "indicator--e6dd7af9-73ee-41f4-9112-18bcce7bed90", "indicator--3ed211f6-f88f-4933-afe6-3860747a4ccf", "indicator--46729a6a-53d3-481d-a2e7-96aa0ac2362f", "indicator--84f55a85-2b4a-41e0-b8d8-4727c4a0b3e1", "indicator--26496a72-5157-4498-bc5a-3422c9eb84e0", "indicator--aa450e8d-a73e-4b65-adbd-de61e50ce55a", "indicator--97a8d753-99e0-46d1-bede-85a6fe0f8a95", "indicator--b7fc6701-6d69-4dc6-b022-7ab5351b1e51", "indicator--7c079ff3-ee10-4f48-8a5d-1d59f3537ac6", "indicator--923b5394-bedb-4004-b922-e559b58b817e", "indicator--576949cb-8bab-4615-9ba6-15795cac054b", "indicator--67b4792a-e9ad-4fcb-a076-e10e5a346a55", "indicator--e06f5e9f-116f-4670-87a2-0bda4238b691", "indicator--7b8e64e8-ec31-44ea-8440-0e9849c9f039", "indicator--b3f5adcc-daf6-4479-a915-9173b8fdac1e", "indicator--93f824fc-233e-4c09-9234-20e9fa7db799", "indicator--5c45b7ab-a8bd-42cc-b2aa-8a05e7011ab1", "indicator--260a4008-5ff9-43d2-9b77-f79340840c1a", "indicator--c1cecc31-2f85-4df4-9385-540b8b51af3c", "indicator--55cc9ad6-f978-426b-bc2b-c77f435146a9", "indicator--839bdf0c-4f9e-423e-a497-951afcc37b86", "indicator--a4cb16b3-4c4a-4f8e-ba80-9ee0227c4005", "indicator--4a5e6e65-73c6-46e5-b862-5227a40ff1e8", "indicator--0c9d4600-81a8-4a96-8a48-f9afaefabb01", "indicator--76578a98-47bf-4c7f-8319-c0697d00a7a2", "indicator--e542f216-8965-4042-8c1a-bda3b64e3e06", "indicator--0d89c2ae-5a79-4c9b-b45c-22b1ab83bebf", "indicator--79b51dbd-f6ce-41e2-8863-8e68e2331fa6", "indicator--e429c127-e77e-4653-b6a5-127ecedba295", "indicator--337ce118-74b7-482d-9825-2a523f483a44", "indicator--51d54057-786a-481c-aa49-bd955b156bb9", "indicator--ae69624f-8c1b-4ffa-8839-cbf42ccfab7d", "indicator--5a63e145-06b8-4e62-bc9f-bf91c9f727fc", "indicator--116ebb77-8001-4c2a-8536-b26568953ec9", "indicator--8da965a1-0c88-401a-91b7-f374fdd0a756", "indicator--cd46e67a-6c87-4aa9-ba33-422c3608b73b", "indicator--91b35c30-02bf-4d3e-844b-e803a879ad13", "indicator--84cc49ce-1761-443b-8a54-2f0f9620ece7", "indicator--8b35e1a3-b721-452f-9507-5a51e202894d", "indicator--dddff3d3-95cc-4b0f-a6d6-2d7bcd7d9672", "indicator--ed59fac6-bd41-47af-b1e9-123afb7e3128", "indicator--d78f4784-eae0-4d93-b2bb-cb1f3fcdaa4f", "indicator--37539fde-24b9-4564-bbe2-53915b4c9d4b", "indicator--99e74e3d-cc4a-4ff4-b7cc-5035ce2ed830", "indicator--9c605f5d-bc98-4ca6-9735-ae75fc304e34", "indicator--7b373d6f-7678-4f10-bf59-dd56bce93a73", "indicator--43e6166c-de9a-49f3-8b78-9b6faa87eb45", "indicator--51dc7e5e-bb3d-4da8-b287-b89abddb56b5", "indicator--1d0e351f-1ece-44f9-87ef-9ced05349008", "indicator--8bc024d9-4561-4cba-9be0-42063fbf913a", "indicator--603497a6-ced9-4c59-a1a0-53e14437c313", "indicator--229888c7-4f0d-4e6f-944f-e888cddf2d29", "indicator--b50bec31-1139-4037-9541-2bbb46020f6b", "indicator--5f2a08a0-208d-4cf2-b049-08e227596d59", "indicator--b877bbc2-5256-42d6-a5fc-fd0f85a898b6", "indicator--f36af7a1-c716-45f1-ae16-153799e4931a", "indicator--c46316c2-7187-4a85-8518-ae1a6de47718", "indicator--b32afb6a-e460-4d8e-9fd1-066cecb0c28e", "indicator--3bf33942-695d-4ff4-8f86-d5fffd4e9b5b", "indicator--8f63f87b-5453-403c-8973-412e265add3d", "indicator--10cd8d5d-863e-4309-b27e-da18b361bd4e", "indicator--359b3d3f-1139-4349-8583-72d992eb14c9", "indicator--2d7e38f2-4637-44d5-bc69-6597367942a6", "indicator--1d0d8081-1655-4496-b7d9-5e7ee106f6a0", "indicator--ce9bad3d-cf1a-463a-8e36-17fef16dbcc9", "indicator--d5d396d5-a412-47e0-bc7c-ffce63e7c6ed", "indicator--5836adc7-3686-402c-ba7c-7fd59041bc1d", "indicator--f40fbb0b-5fad-458a-b9f7-ff412212d8cd", "indicator--bb8aa7a3-883a-4fd8-b925-e7344984a28a", "indicator--6bbb0565-8bcf-4940-a536-bc700de7dca4", "indicator--86de81ea-0a6e-4ee4-be4d-0562fb515806", "indicator--607c4f64-3cdb-4986-a0be-39db73e52de5", "indicator--ddc8bf09-2cb3-45a3-982d-15cd8561eaf0", "indicator--cd659b66-5d54-4b01-a89b-a0306c08687d", "indicator--67d7a1de-b516-4e97-b679-a77faa8d4d0b", "indicator--c1fa3c80-5eb6-49da-89ec-f1ad382fcd92", "indicator--6ade513d-23f3-4421-9b70-878a7eb7fafb", "indicator--7554a875-dd85-429e-bcfe-2e2382c4b138", "indicator--a33b5fe4-235e-4762-8cf4-020e8fc6c7d6", "indicator--f79f012b-3c4d-45bf-b88c-73b4cbd5585d", "indicator--15db7939-b130-4fe3-92d9-d94c64c57e23", "indicator--30ed4999-d84e-4b81-9f3a-a9432f116dcb", "indicator--479f7bcd-0763-4825-9d39-7a218cdab240", "indicator--4eb67c75-d19d-476f-8bd9-08b396e08461", "indicator--8d31d65c-afb1-441d-a593-840fbb85ce7e", "indicator--53ddc1ed-8a88-46e0-a635-767bae9eaa6f", "indicator--c7f66deb-b9c1-43cb-aec1-60df37268cdb", "indicator--520c1c16-b8bb-489e-8310-b9fa90073c61", "indicator--84609682-4f90-4540-9a2d-81c9c01d684f", "indicator--a29f9e97-408c-4af6-8e69-c112a8b3255e", "indicator--5a97d531-c076-457f-bc28-59444ab9b13c", "indicator--6303d687-43b6-497e-94cd-ae339d46c436", "indicator--e2529980-6a2e-406e-85ac-7f4a636fe117", "indicator--3c2073c2-1abd-487b-b13e-e5f3aea2bee4", "indicator--17ef03d6-799a-481c-af74-6da93439b845", "indicator--7a2bf439-8cfb-468e-89d3-9e22f417b8da", "indicator--ca6199a5-349c-4fd9-a082-c79f50880e60", "indicator--cfd33d00-4b60-4b47-ad4f-05cc8b600307", "indicator--d986e9c1-6abc-4a60-8624-d2d53524ee35", "indicator--bed2d4bb-5b21-41c5-be0c-645c5e840a38", "indicator--72992ae4-0997-4e62-b786-7c938d9634f7", "indicator--697f0574-4d6b-46c0-8666-430bc0800a27", "indicator--ee56ba63-e6d6-4b3e-b0cd-bc0e80007c30", "indicator--759fea2d-5422-4bc3-9ecb-92793a9975ac", "indicator--26cb2881-bf21-40ab-906a-2bb38db14903", "indicator--6b352388-971c-4676-ae2e-8f0ff7a72d61", "indicator--78e6eb89-c6cb-4f84-b112-d3421df13732", "indicator--c96867a7-8379-47bb-b2cd-9dd989fd3972", "indicator--106cf214-35d2-429e-9eea-b5f967365d40", "indicator--e69e4d60-728a-4316-b0d5-a1e8ccdbc509", "indicator--c99b471f-fc96-404b-a404-b641ae403e0a", "indicator--3a467582-c916-4ce1-99f9-eda19f6fda64", "indicator--1835b1fe-0cb7-4f2a-b88b-4412b96fc32f", "indicator--4b747251-cba8-40aa-9eac-7fa57fba96ae", "indicator--7d185c30-e160-47e6-b1bc-149773561c6f", "indicator--b05b5b62-bf6a-4e78-89e7-b8c8c32c65fc", "indicator--5ae38b47-c2e7-49d9-bcd0-eaa57e3d7730", "indicator--b4029a02-2fa4-4521-b063-a7a3ecdd5607", "indicator--73133ee8-a9fb-4872-b73d-5c064314237f", "indicator--01b6b93e-c502-49ab-806e-c92284410787", "indicator--ef5a805c-7a2f-4396-8cea-05ed70392bbe", "indicator--fb67ef57-4a17-4229-9e70-10816ed7a111", "indicator--d3ca0ab9-dc54-4eae-9e9c-6a99006bcc52", "indicator--ca1c760d-fd22-490e-9d79-c5140c35e2e3", "indicator--755c28f3-fa1d-4a89-bfca-9c6f767329b3", "indicator--5d986053-50d2-4243-a37c-64668e9fd772", "indicator--4ed18d8d-5238-4a33-a505-0acc9ec375cf", "indicator--e8a9c10c-54ed-4d29-ac4c-5c39351f69fa", "indicator--d441dcda-69a3-47ec-a43e-2cccbd4326d7", "indicator--dc7dbcdb-0822-463a-b000-cf2854deb241", "indicator--96c03478-0056-48f6-b191-0e1b60ae2e94", "indicator--a44392f3-2c6c-49b5-98df-66b29f537696", "indicator--f02d5510-e84e-4a3b-8c74-43b1c70b5bba", "indicator--2be22977-91ef-4086-a7cb-586d37c77a7e", "indicator--754f786b-246b-4145-b68a-269a31cb318f", "indicator--f15e0deb-3e32-4c87-b125-be56ac02d549", "indicator--aa9ea293-663b-470c-b27a-50373a80fd63", "indicator--228e02ae-5b2b-41f9-b012-6fbc121c84ec", "indicator--3f09cd1c-78eb-44b9-b677-1827a2eb7f3d", "indicator--e5e1f05d-8a6d-470e-a1cc-90831c5bd2ca", "indicator--729da5f8-739b-4434-be5b-fd7c3febe0f8", "indicator--e0abc134-a608-40cc-9cd0-e8c55066e546", "indicator--9a13d35b-3bed-4808-8ab9-7a4ea476b728", "indicator--67660f12-d22e-4eb7-af4f-91d20e0094c6", "indicator--4c286ac3-a8ce-4b11-a1ef-b5c5af48d397", "indicator--628276b1-90f1-4326-9f4d-19a0c4946e5b", "indicator--501bbebf-ceec-4f99-a7db-64be736398d1", "indicator--c63ff8df-5c94-4b0c-8644-4b30fd1560ef", "indicator--1431d034-e35a-4679-bef5-f20d92a0f189", "indicator--639eed6a-a5c7-4ba3-ae1c-a9f772f74c7e", "indicator--c827a9df-b704-4a75-9c14-a6c017a09780", "indicator--f2a61a30-05c3-4e24-9d15-df5f45cd41ea", "indicator--5558ad9e-d4f5-44f2-a066-93988fbab277", "indicator--ed2bd0e0-3a78-4435-90fa-95c488396556", "indicator--2d2b8eb6-dce6-47cf-a84a-c956288f5db7", "indicator--74b471cd-8aff-4856-903e-40f6a70400ff", "indicator--0285248d-2baf-4407-831c-31e45660922d", "indicator--88e5b587-bedd-459a-a1ab-252879baddab", "indicator--05bd07f5-2357-485d-854c-e6b118891e46", "indicator--076e0c33-eb0f-4376-9fe0-490ab56a89d2", "indicator--f5412379-33b7-4f1c-8220-a934665b5ad9", "indicator--5e6dc128-5139-4c34-a2fc-102458bccaef", "indicator--1cc82549-bc9c-4a8f-8cae-85b817392447", "indicator--aec8d9b4-de68-486b-b6e9-e7fc43dd3755", "indicator--60feff58-d5da-469b-a875-8b8d399ea72c", "indicator--d64a9aa3-7a90-4e44-bfc9-0618d8ba6350", "indicator--38417088-00a8-4a58-bc91-fbae7fda91f2", "indicator--1620440e-5cfd-4124-9c07-5ee58d2ca2d2", "indicator--a52587d9-505a-47dc-b629-b3b63394830c", "indicator--875776a8-8cc0-4b65-8eb5-22c239a3cd44", "indicator--3a0ba363-3079-4ec0-a053-df79bca945d0", "indicator--69fc6bd3-bcdb-4f86-9b53-444f132dc95c", "indicator--6ab2c340-708d-4c92-9aa0-f81b27aff1a5", "indicator--64c66f94-8957-4204-b681-045c09ba341f", "indicator--bfb05fe6-0fd7-433c-89d3-dcc36028d15d", "indicator--78a1a7d2-ac9b-4750-9562-fa538c8ee676", "indicator--a0ef96a0-d70f-40e6-980d-0423fa9c7257", "indicator--1384648b-7193-402d-a12e-9fc93402f0f7", "indicator--53755052-8734-4de5-a822-e2881627b843", "indicator--2d7d2cd3-c395-47a6-b1aa-61431f216a09", "indicator--776ac31d-117c-46c2-b08d-911f0911d245", "indicator--6f14e75c-292c-4acd-b14b-4fd7ca0a0a75", "indicator--a4c2467b-3141-4fc1-9ea3-d952a8e56a2d", "indicator--7c5630c7-4b4b-4ffc-bb9b-1cee85bf0d6a", "indicator--17a489ca-cfc5-4308-afd3-85996c018c03", "indicator--f8693631-b45f-4d42-b609-104d9f614ab5", "indicator--4c4d8130-6a13-48c9-8c80-9ce29f59a551", "indicator--0b665a62-132a-48e6-a431-060cc4f0d157", "indicator--b501c468-5967-475f-88ee-0317480dfbc9", "indicator--e06e5b4e-ce06-43d5-8ea7-1b5deb76a3c9", "indicator--bd439b0c-1f17-4866-b214-771e97d6f836", "indicator--a03dc0e8-a7ef-4e70-80aa-ee03f43b4e83", "indicator--75f16067-69eb-4f9b-a82b-66410c091b77", "indicator--833ec465-d30f-4a21-aeef-5675fd1ee464", "indicator--3c60fc70-0dd9-4192-98cb-5e41b999a046", "indicator--375e8a05-1c95-4a9a-aa81-a6233587a023", "indicator--96c49cf2-13b8-44e6-83dc-34c91eed18ba", "indicator--b618a63c-1779-47b9-81d2-8ba04ddefdea", "indicator--ee3b194e-d400-4761-84ca-efd681c7f375", "indicator--3f1b7bfa-b357-4abb-8a61-3780f08b94d8", "indicator--394fcf39-bc39-4a08-ad7d-01df54650f42", "indicator--60118925-dbe0-4962-b264-02afb4f267ea", "indicator--c676a4cb-5332-4df1-b1fd-d7168c2b7dd0", "indicator--43e66414-2615-4663-99b5-67695f3564f1", "indicator--a85044ff-6e96-446d-a070-adf6486a242d", "indicator--3896ab2e-78b0-443a-b00f-29d863a2d3da", "indicator--40acd1bb-ba58-408b-9c6e-83823812465d", "indicator--9c2577f6-cda5-49fc-9370-393d3610c476", "indicator--98e6d303-e914-4e11-a05c-d80b97402612", "indicator--c405a0fb-cb89-4c9f-8be0-8a9a93327203", "indicator--947a8204-1d8e-4383-a0c3-8548a5f628d5", "indicator--e8fa8133-d000-4850-9b26-a5abe718f2dc", "indicator--94507918-092c-42cc-afa3-faba54b30e4c", "indicator--e01c46c0-fbac-45d7-807c-5dfdeb952b3c", "indicator--eb4a95a1-dc9d-4ebe-ae73-bcb52177ee96", "indicator--21d88989-caf1-46ab-a2c6-a39887950ea1", "indicator--9fac2cc3-2bb3-4d16-8ecb-5f5f3d751ffe", "indicator--15f78039-3e5f-4fb7-8f7d-86effa8e508e", "indicator--b42e689d-b0ae-4d6c-bb82-e18216550cb3", "indicator--44548630-2580-44fc-8521-62a53969a999", "indicator--1ebe5670-c78b-4b16-b2ae-be5ba6ce83a4", "indicator--6cf1a616-bb40-48a4-b8af-fc6f1b975c45", "indicator--d2a9c4c8-43cf-4881-9436-dc7c8049efca", "indicator--55a6bf4b-5c61-4bd6-b29b-95d3f9eb6493", "indicator--b3b98fa8-2afd-4504-aa23-02d67ea59a38", "indicator--7626ff81-8263-441f-9cff-1ea13579a99b", "indicator--ba5fb3e8-9b40-402e-9a0c-784f11aabeeb", "indicator--67521f35-c57b-4ff1-999c-b750e60f5ed6", "indicator--e7e3647f-5d0e-4aad-8d0c-3359be88fea3", "indicator--82a8cf36-8b99-43ec-8354-1dcc36700b03", "indicator--60e170b4-3c47-4a64-8fad-ca8278959f8f", "indicator--de7fc1fa-5cde-4618-b927-a662c816e204", "indicator--0ae8fec0-c51e-4bd4-a332-d95c3e2ab750", "indicator--b22826ed-6e81-4170-b834-82c5a96b7482", "indicator--27167e63-35f1-43fc-8985-37cc9410082b", "indicator--244c6f76-1386-4946-a0cc-572ab1753db6", "indicator--ca360c87-3a58-4b5f-9c04-2fceeaaa2d31", "indicator--31bf2f0c-69fb-4847-ab2d-11b5d44395f8", "indicator--a17fd839-d84b-4911-9f53-023af53f9142", "indicator--0e2be9c9-dc92-4b4a-bdb8-381b5921a613", "indicator--e111de0f-97b2-44bc-9af4-abaf80b88caf", "indicator--6c1e08ce-f96f-4443-9b56-9fc75956b58a", "indicator--3e8f9f76-3345-41ca-ad54-af5a3d220b9e", "indicator--5899e9ac-50a6-44b7-bc29-419f959ef23f", "indicator--18c6a50d-bb56-404b-97a5-59a56c68cf56", "indicator--49e9d286-ee85-4910-9086-7b1fa8084489", "indicator--22b86372-1450-4f64-9061-2dd1ef30e26b", "indicator--e0b466e6-7e33-4367-b9f8-ac35a638197c", "indicator--12aec00a-d85e-44ad-93d4-2f4f65f3ec9e", "indicator--5999e8ea-067d-4556-90ba-16ac0729c6e8", "indicator--b643a5d2-d7c2-4737-a6a7-3264a922e4e8", "indicator--b5d2eea7-cffa-486b-8a18-ead33d3ea5f8", "indicator--a7cdd55c-2d53-4d01-9de8-35439859571d", "indicator--8c40cb7b-b33a-4e7b-ade4-d7c4b255b5c1", "indicator--b559eafc-d0bf-4fa5-bf3a-50b6b5a9fefe", "indicator--cc243d58-c35e-407b-9d47-a8ed8de28f6c", "indicator--b21d4652-65a4-41d9-b61b-285f606f7178", "indicator--08657b2d-d3c9-43a5-aeb7-d68edf7e7f3f", "indicator--204eba40-a99d-4160-a56d-01baedd7ddf1", "indicator--0a24a4be-802f-4f23-9c8b-712478d91b2d", "indicator--c765dae1-8104-4859-a185-a91266974261", "indicator--cc8de11c-80ae-468d-953c-e6e29d1a45d7", "indicator--7511c473-7e17-4d6c-a42e-ee4b091eac10", "indicator--893bdba4-ae8f-43c3-9041-4050fe6a8bcc", "indicator--0e86725b-b41e-4f4e-b728-aa46426f4edd", "indicator--32cdecb9-de03-41d5-8238-79ba9f25b0d8", "indicator--614b2c68-0db8-41f3-91c2-dc47bb209a61", "indicator--98ed78b2-fc98-48a9-aafa-23bc0e5cd9b7", "indicator--6138a1cc-e495-4231-93c3-e769692b54a0", "indicator--5ea7a628-8476-437b-89b4-17c82e052322", "indicator--fdb412ba-6295-4252-9fe8-b63adbdbbc1d", "indicator--08f86439-990c-4093-bd8e-69e640fef5d0", "indicator--98247e87-8d09-4d02-9504-b7c9bdc58527", "indicator--9c7afa52-ba3a-494b-b285-b9995ea32054", "indicator--b3f2ee34-e64f-4cda-9945-699a82b147e3", "indicator--96988f86-adfc-4731-b789-9283536d1f45", "indicator--ebf14cc1-d7ca-486a-82c7-13022613ee38", "indicator--62a8d3cc-6390-4d83-ae22-8db2e5158eb1", "indicator--88599c8b-0e9d-4aa6-9e5e-9d8e2c62c356", "indicator--bf571455-df30-4cec-af6d-a41b23fb8012", "indicator--70b93b98-40f5-4460-a7af-45189138aa57", "indicator--3a1ba994-9cf5-4ccd-97e3-c60aec298bab", "indicator--5bac4dd6-24f2-4435-a310-45bdde216075", "indicator--6c430bc5-bece-4ff5-8e42-21c0bfc09890", "indicator--ca8aad60-f812-47e3-a5ee-c084d7cb9f80", "indicator--da7261ec-c1dc-4486-a4c0-3bb50900c123", "indicator--8313e404-f283-4612-937b-516f89944867", "indicator--857f6947-7fc8-45be-942b-46dd6fe1f9a3", "indicator--a9d4a6ce-bba7-4bb7-b5bc-80c895a6d4ab", "indicator--031cd23e-5649-45a6-8ef3-2f28c4fa8861", "indicator--036eb2ef-0643-4b3e-a01b-8d220c987e7f", "indicator--dcca092e-b89b-4d19-8a37-d9a8c2bdb30f", "indicator--ccf58f31-6825-4991-8d6d-78dc3c2148a2", "indicator--9b8deeca-5adf-4060-9c43-f3314397f299", "indicator--92c25e9a-f573-47fe-91aa-629f0d7d47f2", "indicator--612f4d75-d3df-4fb6-a319-f9c7149a07b8", "indicator--3f466796-ac88-40a5-9dc6-093c9064e351", "indicator--35a4c114-ec16-4073-90bf-31a86e6a0df0", "indicator--b9bffc7b-5f4e-42ba-9e6e-09453b279907", "indicator--6590f8ee-7b35-4b73-bf3c-9d5d4477b4f7", "indicator--e165493d-b782-4ec9-b945-527222c0c731", "indicator--2771b4bf-5542-463d-871e-98b25e58fc30", "indicator--6791f448-7902-4623-a789-2bff717a473c", "indicator--e2048178-eb01-418b-b99c-9fef63890aea", "indicator--bddbd196-dbe6-4146-8969-0debd76914da", "indicator--0ef782b5-818e-47ef-9965-6efcd58a3081", "indicator--1ddedab8-fc4a-4701-82a6-6908ec2617eb", "indicator--a3e47093-16ee-4bc3-8bb7-931d15c61f8f", "indicator--ba07df96-4d75-4677-800c-5c25b8de82ab", "indicator--1ff4345e-5520-46c5-beb8-76a7a4372bb2", "indicator--7781509a-356c-4dd0-bfe6-b7c59c09900b", "indicator--a1fc90f3-da7c-4942-afe8-2fc1d08d9d58", "indicator--eebb677d-4f5e-43c4-86a9-59cece8377e5", "indicator--07bfe5bf-9a30-4636-b875-66b441125ff2", "indicator--7292ea72-87c6-4cee-8e51-217703701572", "indicator--44c1651b-825c-4c87-a13f-69bd4c8592ad", "indicator--ca4651c1-1155-48e4-afb1-981a8fa5e4ae", "indicator--8e742fc9-0efb-4bea-8a62-fa732d44866d", "indicator--10d0e3ef-75f7-45ec-b77b-b83ed954a3d0", "indicator--20f11a72-ae8d-436a-95bd-d04297ce08a5", "indicator--f66844a3-9be1-4b58-bdf4-8a5e387cf8c8", "indicator--4153c2d1-dcaa-4783-b0a2-7efec7ebd64f", "indicator--76285d3b-74f5-48e5-97a2-1b9ed985cf76", "indicator--ae6fd854-8ab0-454a-baaf-92e1bf7da633", "indicator--c5c4f277-114d-42a8-980e-b68115aed60f", "indicator--60e958d3-7b73-4a26-ae53-dc2c5f624164", "indicator--fa7a6429-cd56-480d-b61f-bbc8130259c9", "indicator--eb87bb85-6a99-4160-92fe-8d13bcd63cc3", "indicator--1f01b62c-dc2e-40b0-b511-9e0d9dcf5532", "indicator--e31c9812-4677-48c1-9ec0-e3e53ced4182", "indicator--c6ab8141-1e04-4810-b198-5ac152b4fb69", "indicator--fc0757c6-4c94-4c1b-aac5-77cbf0dfcf23", "indicator--d2963999-520d-4699-b9fe-8bfbf781ac10", "indicator--80fb46d4-d4c1-4916-a67a-6fcc071a9d9b", "indicator--a30187a1-6c9b-434f-aafc-380df6c21e9e", "indicator--2c4fef2f-dd74-4e40-8589-2481b55ffa98", "indicator--0589381b-4109-4d3a-8655-b1884790d12a", "indicator--4cbc0ea9-f536-4c64-b5b6-ec3a208dd891", "indicator--2f346f35-fc56-4d0f-ae57-efe54867d1c6", "indicator--c8f47c55-8289-4f89-b25a-b463ee86fb1a", "indicator--8da59d0e-2af5-451c-aadc-0b5c6b47e9c4", "indicator--75a86e26-4109-491e-a65a-edea8bda0521", "indicator--dff896e8-d20b-4b71-9dd4-b16d2efecc86", "indicator--cb681bf2-7c5a-4799-b6a2-42f0d9e4b1a7", "indicator--a8e8b9ca-6e6f-4829-a598-e4f6decc6b98", "indicator--b4c15996-09c3-4686-b90d-16f68be100f0", "indicator--606cdfff-269a-463b-bf08-749221774844", "indicator--e8b1d1d7-d87c-457a-a694-b7e647ea1ae0", "indicator--59a4ff6a-070b-46ba-a9e9-f3993f1b2f6a", "indicator--4167ab8b-f690-4717-86a4-83fa23ca9df2", "indicator--21efb344-fcaf-476b-9822-cf27c3037b57", "indicator--03ebee8a-9043-486c-afb8-2ac22d1d8e3c", "indicator--bf0ff085-1e08-44af-b5ef-697766df1492", "indicator--6ecfba22-de1c-4268-9600-becce67eaa08", "indicator--d6870c76-0d20-43dc-8648-9f3140bd7a6b", "indicator--91a2ef40-5eb1-484c-8f54-00a9cc4f0260", "indicator--dd3c2151-06ee-46e7-badc-3753138de4fe", "indicator--1710c293-ba9d-4bb8-a5f5-8eebc2ed578d", "indicator--214e2348-dcee-4626-a3c3-1d4703630e47", "indicator--8d4d99eb-c218-4d4d-b55a-d510e5756bf1", "indicator--6e71c1db-8827-4ac6-8a68-22b0e2af9559", "indicator--918387cf-ff12-4144-9090-81fd7747de39", "indicator--f6360081-05a1-4ed2-9410-c495d7e774b6", "indicator--aaacf6a8-22ed-43a1-97a1-fdf06ab43e1c", "indicator--cd792e62-612b-4326-9394-5609684f20a7", "indicator--b105ca55-e2dc-4a6a-83cd-0651f4fb3126", "indicator--06719933-6b22-43cf-8c76-9868e507208e", "indicator--6ae15b81-aa9f-4669-be3e-8de6885137c5", "indicator--d44093a3-c770-407c-bfa7-7b4d176b7cd9", "indicator--e5701167-8b13-4ebf-a351-daf8b586ba39", "indicator--8ef77cb0-7059-46af-aef5-7184c44a53a5", "indicator--3f2a8092-4d35-43d7-a871-94781d977735", "indicator--1d203b1a-cd5f-4def-a08b-9b0ec4b323e6", "indicator--ba0d49ed-d9f7-4992-afaf-7a49273c91e1", "indicator--ed38a64f-3f85-4e53-9237-b5d5dbab34c2", "indicator--75a5486d-a721-4bed-9478-ba24a59e3a5c", "indicator--fa91e9d6-1ea2-455a-8ddc-512c8837530d", "indicator--909fcee7-cd64-4ab3-8a67-f9251d0dbab0", "indicator--e674b569-7db4-4ba8-ad29-3ff2a15851e4", "indicator--984d7685-8306-4d93-913c-99b3a22ddc78", "indicator--fce005c1-9fc9-45a1-887c-a9f00e5799a2", "indicator--49c9a622-c272-47c2-9000-dfa8ae57ce79", "indicator--53728b9c-a82b-4d6b-9832-b7ec131a1daf", "indicator--68b2bb92-3adb-4a30-9b9b-d444096892d2", "indicator--5b83f9e3-5588-4207-a6f9-78ccc2af0c6d", "indicator--596c4fb4-2151-4b45-b056-42d5977b7770", "indicator--20e8316a-fbaa-4c61-b5d8-f83d9d84ae2b", "indicator--52496ed5-8448-4a6a-8259-59852e6d5aa1", "indicator--02a0a3dc-051a-4a5e-8e15-45c31cdde7b6", "indicator--7715ee01-3799-48e6-908c-deab0656cb62", "indicator--08534478-76f9-4608-9201-4065382a704d", "indicator--7602955b-5a5f-419f-811d-7bceca20d2f0", "indicator--f33d3675-17d9-4f75-9d76-a7f8b1f2c33f", "indicator--ca0c2df4-310d-4757-bc6e-2e38cb77aa95", "indicator--723aa12f-2329-41e7-8d75-ee23fdc25b90", "indicator--69ce730f-42fc-4f4e-af5f-6fcb9c6155b1", "indicator--b04d0e37-29f2-44fd-8eec-8c6f87b4c29b", "indicator--1ba1874a-3ed4-41f2-9b86-943889e19ad7", "indicator--e0255fbc-79fa-44c1-88c1-195ea1b8d8dd", "indicator--cb09f746-f626-470f-83f4-06d716d211d0", "indicator--2f282829-4ebe-415e-b097-f963e3b566c1", "indicator--2a242c9d-ed4e-46a3-9b2d-ee0044c9e36b", "indicator--ff41f65a-0bab-4748-8525-34816fc1876f", "indicator--302fc47f-83dc-4895-ade7-d0e4c4d90b3f", "indicator--ff69b0e4-cc9b-41db-bfc2-2533c7d61125", "indicator--e2218e51-92b6-4f1b-ac7c-90515bdebde7", "indicator--bf78c183-c4f2-4e53-9f40-8741686ba88a", "indicator--31e525dd-01a7-45a7-b9a2-4875c5ccdeb6", "indicator--bddf13ae-82b8-4fdd-832a-59be09799c13", "indicator--0c95f811-ac47-498a-b6a4-f300990dfbe4", "indicator--341dd8e9-4b31-4b07-91e5-9bca5dfa9d17", "indicator--3ffe5ef7-3fb2-4a3e-b87f-002d9767c41f", "indicator--320e602e-aae7-4f67-97c1-9540611053db", "indicator--b9f2f1a3-b595-4912-b57b-cb18f09bc1d3", "indicator--17f97b10-f1bb-498e-b1e6-a72fb3762921", "indicator--bee75213-3edf-47c7-98f0-5204cc7f4a44", "indicator--1476a605-a805-4e1b-b620-90190c88d6f0", "indicator--40ff8754-c3be-46e0-b112-b727a2ecfc07", "indicator--72cac501-bd47-4439-98d4-29d3a3e32e32", "indicator--4575a247-5e67-4b33-8ae5-72efc88aec99", "indicator--210ae951-a58c-4229-91ff-bcc9801b31ef", "indicator--a33dad68-9ce6-49b5-b2f8-58b8e8f8df50", "indicator--c065894c-b30a-44b1-835d-ff9ce1b868d2", "indicator--a4062f95-352e-4e90-a808-5560f46f12be", "indicator--46b0f7e3-0ed0-4dd0-9a9e-24bb9e8cf407", "indicator--5c816d24-f780-44a3-87fb-54ec0fd072d6", "indicator--6687c943-0cfc-4a82-adb2-eb325f53d855", "indicator--6171629e-aca0-4fdd-8f10-d6cae831f73d", "indicator--5a4df1c7-f4bb-4a7a-ba09-dd8b65121843", "indicator--adaa4473-479c-48cd-91ae-bd5b2b9c24f7", "indicator--096313ac-5ded-4167-b25f-43f911940847", "indicator--fc1e454c-3f9c-467c-bbbb-9bb3753a4a87", "indicator--c46427d4-eaca-444d-b9e2-43283233c192", "indicator--9fad9271-cb6a-4afa-b3b3-d8c4043a091d", "indicator--95cf4127-a576-425e-a5fc-6695e4c4acce", "indicator--45a5a048-4376-4131-af52-4b09a3a000c6", "indicator--60b9f6d5-13ed-4180-9503-a5974849b94e", "indicator--ff4ce834-0df6-4e7b-9e6b-aa16ca74e714", "indicator--621aeaca-8979-4587-ab80-3e1ea674a5f5", "indicator--8c30db0c-66f7-4c34-aad9-3db47818291f", "indicator--a6cde41f-5451-4c0b-a02b-cd697f1888aa", "indicator--e1164e2f-41cf-44e3-b588-1e52df261022", "indicator--560acd34-8e22-4a3f-a57f-138214a96535", "indicator--dfc1b1d7-f576-46a9-8c53-864cd7326806", "indicator--4590b1fc-ec42-4edb-b549-3998e1536f2a", "indicator--6a7e0bec-93e4-4d04-ac55-7aa0a53abd4e", "indicator--b0e7d02a-1767-40cb-9046-a963071b8548", "indicator--633b452e-ce99-4ff9-9076-4e9fe5c86d29", "indicator--bdf23761-2642-4e37-8b21-4d97314daec7", "indicator--dd06f198-b518-479b-ac34-585628cc12c5", "indicator--e411406e-8c4f-4b53-bac7-cf732a7605f3", "indicator--9f32dcfe-22a7-4960-8723-835d7a378354", "indicator--cec94d7d-4399-4497-9298-c53cf61ac2f4", "indicator--0aa25aa2-9964-4cbb-a036-703012dfbf5f", "indicator--612235f1-3041-45a6-b681-eec3c72d812d", "indicator--d4f741a5-ff50-49a0-ac1e-b706b60c2815", "indicator--29350756-03ac-490c-baae-f4ae37c879ab", "indicator--07c82e53-337e-41ff-af25-4dff79f78079", "indicator--e86e8a21-54fd-4dfa-9b44-a03f91c60c81", "indicator--4f8f83b0-b399-4f51-b7d9-b15ebbc1a795", "indicator--32928295-661f-4f5a-b042-2512e1eb9710", "indicator--c68eeb43-ce44-4aff-a04f-6a4c79d87383", "indicator--db5b128b-9d01-4661-ac16-987072fbfe08", "indicator--83ab7813-f1b3-40ab-923c-d8301584920d", "indicator--f5f49d2e-afdc-4d93-9750-3acaeb1328e2", "indicator--3ef702fc-7436-4498-86a4-b35506c6631f", "indicator--9f88b829-7ad2-4a80-8f49-fbc79d6e2639", "indicator--e5bebf2c-af66-4173-94a4-2af9c1c35c6b", "indicator--2c3affa1-375c-450c-a90f-5be9f904b4e5", "indicator--4dd75fed-2a9e-4e51-8957-da5f8536a3b0", "indicator--8c6c1c51-d382-4389-8fe4-d99da6e6cc08", "indicator--ce6c6136-140d-4247-ba6b-a79573d91cd2", "indicator--fc3fbdde-662a-4778-a050-ed82379a41a8", "indicator--7057f1a3-1a88-42e5-b84f-ac6836d2fdb1", "indicator--c9054cf8-ea45-4bba-af98-8da80921043a", "indicator--c2cb8fd6-3b79-4dd2-a731-5fbc3e0c863d", "indicator--5135fc05-8d60-44c5-aff6-24e78426e842", "indicator--ffa363ad-0141-4973-8b98-73ded8b29946", "indicator--f2b49175-a2f2-4d42-80f6-0503321e1140", "indicator--04281871-eadd-4d76-a53e-50fdc9941b91", "indicator--734a1578-f919-4fbd-afa8-05f918f75039", "indicator--570efc52-4025-4322-ba5d-5e1329c69ffe", "indicator--8a30ae8a-a765-4d1b-a72e-6ff3ad8fbba4", "indicator--8fc3021e-bf2b-47c1-92d2-f66c46703473", "indicator--24cddbb1-7688-4556-b598-5f8f020763d9", "indicator--8f670190-75e6-4d6c-9118-7ebe2b4fa66d", "indicator--eb2ab949-a981-4f96-8092-b276f3d2d6f8", "indicator--0bfbf00d-8caa-4b81-a815-2874793b8e94", "indicator--a1dec52c-9b01-4403-a9c4-7156fc1093fd", "indicator--0b5573ba-3d25-4c89-8b26-54af78ac3346", "indicator--6f9215a2-4eea-4683-930e-97074273de2a", "indicator--36eb08cd-beec-4f32-b67a-6a8dd9adb981", "indicator--c6cfdf3d-5941-4c44-981e-e8b331933776", "indicator--b72de176-a1cf-418e-93b2-6af6808c931f", "indicator--8e8e5bc1-ecc5-4748-b9f2-c363ffd2ff74", "indicator--0e899f82-2520-4620-ad66-fc62ece3a642", "indicator--c9ae60c5-379e-48f0-bb2a-209e178c1f32", "indicator--cf8455ab-1f30-40af-876c-1fbe80fd2d35", "indicator--f635fc6f-028f-4e5e-9012-0d69c18b7dc8", "indicator--ba23eeab-e80f-4a83-8af6-d64950124f7d", "indicator--df7a56aa-e260-4cdf-8b49-b9e52ff770b2", "indicator--de655f9d-41e1-490b-9e2f-7cab5fa6dab0", "indicator--cdf9522f-45de-4450-bf92-ce063368c3d9", "indicator--2c7aa601-5929-49c4-9953-91222dd652c8", "indicator--a01cb4cc-0eca-4839-a776-bf293fa4ae90", "indicator--0af46fb9-6d7d-45ea-a99a-8d7845226a6c", "indicator--d32c0da9-6215-4a0c-8dc6-e9854c49cffe", "indicator--49b59ed1-6ec5-4170-ba55-897f2fd95f5d", "indicator--f6c12140-dbdd-4789-bac6-cd7885fec574", "indicator--6beff73a-0c7a-4976-bced-1e4901bab938", "indicator--1bf914ed-d9d7-41c3-b121-9587db104520", "indicator--ed2ee94b-16d4-4065-bc6e-ef3d7108661d", "indicator--263869cd-da1e-4fcc-8521-d6b35685ecb5", "indicator--16174540-926c-4112-8f68-b2087ec747e8", "indicator--2467969f-a69e-44a6-8c4d-a3f812df205d", "indicator--6666c237-9508-4819-9862-af502ea5cf4c", "indicator--fb0a12d4-5a32-4775-a878-94a5e94b2c36", "indicator--be4b4d31-3600-4bd3-adfe-caa92656ffc7", "indicator--6320a8e0-8365-40ca-83a7-862a48db8101", "indicator--81d7cdbb-f196-4413-8d03-844c34f90978", "indicator--4f4a429b-67d5-4391-96d9-d3c64db91a5f", "indicator--d0e3ca09-e6a4-4b8f-afd9-2a87a289eb77", "indicator--b163d029-e871-4657-8735-902ac7b56305", "indicator--43905e6d-15ae-4881-a53c-1923541a5607", "indicator--af27e9ac-0c37-4e5d-b74a-bb1f0b6b0068", "indicator--efdbb111-0135-412c-91ec-49b823df99e2", "indicator--388eaab9-b7d9-4ade-97b4-8c0962a06e37", "indicator--03029f64-b6f1-46fa-a0b0-dd8f5f634f75", "indicator--09791b52-6120-4a3c-9a84-db96ef0431ea", "indicator--3c7d64cc-52be-4e99-9f0d-d2d75a8923dd", "indicator--ddb8356f-fb33-42a6-b86b-66c78018386e", "indicator--fe1ebf79-2cea-4ec7-bd14-7312030f034b", "indicator--ac30ee05-ee56-4f57-8b16-09b7817c4443", "indicator--a59e40fb-3f73-44c9-bc4c-9c83ef448be3", "indicator--df65aecb-81be-465f-896b-ece9d5ab92e7", "indicator--61d00fc5-3131-4ad5-8309-f921b4964392", "indicator--cec7e1e4-ff18-481b-af25-8f567087f473", "indicator--3726d83e-5226-4b95-a1b6-8359792a53ee", "indicator--31d02286-d30c-4446-95a9-ab0a954b494e", "indicator--6e70aebc-e155-445c-bf2f-2c99484d6355", "indicator--f20032b0-f4ff-48a2-b37d-ff6a4c465869", "indicator--ab97cb47-bba9-4e25-894a-8d914db35af8", "indicator--00207b83-744c-417d-a7f8-faa560e46127", "indicator--0d929ec4-3db6-4807-90a6-e4b796f01c53", "indicator--365de54a-76c4-47da-a839-2d347a74b83d", "indicator--7beec212-5581-4c7e-8f8e-7790cbea9fbf", "indicator--896b847e-fbb3-49dd-b956-a8f04dfe59b2", "indicator--c75062dd-81e8-4922-ac28-07dd07a5e573", "indicator--22839fac-6be0-42c2-9b8f-ffcf5e43f33f", "indicator--8a6192a1-2702-4e25-97e3-267422e3d12f", "indicator--39e995c2-2049-4cd7-85a6-dccae9ac5f50", "indicator--202a85a4-a80d-462a-985f-2f510aaab871", "indicator--8f386090-4df9-44e9-ac61-11a6a382a421", "indicator--a8753d7d-b887-433d-a927-cd6fca12baa1", "indicator--e100be9e-3bd7-40cd-b2c8-6a53762444a6", "indicator--09ce1e5c-e5a8-4c1d-8696-c6b4aa2e0f99", "indicator--d4b02d48-c007-423b-99e3-a786c7a351da", "indicator--43407f9b-d6f1-4a16-9346-9029e23b7fa4", "indicator--98e89742-5492-44ea-8b85-e2dd71ff0d0c", "indicator--1cff51c3-f862-4155-9a86-2ca0ff6239bf", "indicator--5beaa0e2-d666-45a3-9e28-6dd58d6312d4", "indicator--e3fc7bc4-bd6f-48ec-8d1c-ae7d7a8d4f61", "indicator--9cf4e8b9-0fc7-4c78-88ae-7c605f23a7ff", "indicator--4064025b-4bfa-4c9a-b4f9-bc5765dfd748", "indicator--2825c7da-6756-46ff-a074-9e0ae77b572b", "indicator--3b5f471f-bd54-4ddd-9d23-b5760da88e14", "indicator--b71f29fe-bbfe-44c4-907e-b8999b051b68", "indicator--0011d401-1c31-4c7a-8681-74bd83b48267", "indicator--cac99cad-81d6-444b-80e0-b4e6f41100fb", "indicator--72cf5a98-bd6b-46e0-92d7-43b57f36c007", "indicator--1f790b28-2449-4ddf-ae92-009161624473", "indicator--b0f3571b-59b5-430b-a2e6-c1428a91150b", "indicator--c7f941af-734f-402d-9877-8036fc3f2df0", "indicator--20dd9ec7-b8f3-4426-93f8-adce44707dd6", "indicator--79b85c4c-5de2-46ab-bd9a-80efc7303679", "indicator--cb91b929-c531-4b10-9f70-346b8d6ad81b", "indicator--3c3def59-885b-451c-970b-33958380fa1b", "indicator--ed088326-5d0a-4108-9bc8-0c10c5ba08d9", "indicator--fd6085c1-7347-4f0f-ad9e-23d7f8ee83db", "indicator--49066a80-05f9-44f2-b8f1-a210f3a51bcf", "indicator--7a77a881-de6a-4c5b-b3e0-a0b1b1c21f84", "indicator--73f35d12-92d9-4a27-8072-f30f3d594741", "indicator--f8c29d14-5b7a-4334-8884-4115d369cd87", "indicator--7b4027c0-a41d-4438-866d-9a601d0e06e9", "indicator--bf3921cf-7122-46c2-a6a5-8a01343f9b2b", "indicator--1b35cfef-8bbc-4b35-b3a0-49e0ca9abb93", "indicator--3003e2da-d3f0-4652-a4a2-a1e166995ffd", "indicator--09a34cdd-3ac3-44bb-99be-957342d9f402", "indicator--1717d4f0-d2d1-42c7-8ca3-e0fae59eabd5", "indicator--28c1b7e8-a701-47aa-ac05-f0cce2db66b0", "indicator--a17fbd71-fb8b-4cad-8a18-8d45fb50d5c8", "indicator--69a7966d-c80a-4fd1-9df8-65ac2c262733", "indicator--530a8546-89e0-4487-919c-aa21a4772237", "indicator--b41267e7-b20b-42f0-8073-640a1489ce99", "indicator--6634972a-9f3d-42f9-912a-5a6945553fc8", "indicator--d6eb750e-6586-4577-aba2-932a6b7461fd", "indicator--bbd0d6c5-6b55-42a0-9b1f-753a97b39e3a", "indicator--4d1651df-4f9b-401a-86ea-f0664f3e2fb4", "indicator--8e885aa1-8989-4136-b23f-8007e454edde", "indicator--d7b9932f-5e13-4f28-8f73-4f12d94ac982", "indicator--bb9f6723-d543-4a52-a648-a028b8bfde12", "indicator--8c839e8a-19b7-4b44-b593-a1285577b9d3", "indicator--9f090360-83ef-4358-bbbb-46265d4e4501", "indicator--2d885956-ec76-446b-be1a-42ab87c01093", "indicator--58803999-96ca-4112-8fe4-373fa7685801", "indicator--8a7f62bb-3abb-4802-a88e-f15583406f46", "indicator--c59c2988-c7c6-4090-af36-40d520e738d2", "indicator--4b35d821-a4cb-4f2d-a039-89edf78feb97", "indicator--42e4907d-cf4a-45da-9a6f-4d191fc27495", "indicator--64d421ec-61bd-4a3b-b0c6-5cdee5253854", "indicator--7815b7a0-7a31-4422-8c1d-d6d14fb998b2", "indicator--6ee2cdfb-87e2-4fc9-b5d3-d278b7f21e2c", "indicator--50382aed-bfcb-4405-a498-df990e3eb8f0", "indicator--9e653fd6-3fa6-48f1-91c2-af1b25ba99f0", "indicator--1dbd1c74-22d2-4034-8a17-b648b9caccce", "indicator--6169a359-ffaa-4f37-8eb5-128d76285482", "indicator--fccab28c-40c8-4e0b-bbf6-bf984339a654", "indicator--6a6fc8c8-3ad9-47ff-8935-f8c96da01cb4", "indicator--5526b438-1203-4c28-8d14-e02869bfa22e", "indicator--194d7609-531e-49f2-b52b-6ff4f7cba0e0", "indicator--9fc34594-fb27-4bf9-b7f7-3d8164a4dd67", "indicator--649caaf8-229e-49bc-8d96-bc9dd9aa1f9d", "indicator--52954e1e-dd6b-4540-be91-48fc787ddd53", "indicator--16156ff5-1edc-4bc1-b38c-192bc6e35c9b", "indicator--5c0feb9b-9ba1-4ff9-910e-1e06db7a17f0", "indicator--04314639-4c6c-449c-92da-5b75920636f1", "indicator--16241e80-ba72-4d1f-83c1-ba4ffc601300", "indicator--6c25d0b5-c252-4334-a554-6fe9d8ebf249", "indicator--29ae4523-bab1-4934-bb71-86946814d9bf", "indicator--b0637e3b-d3c0-4da0-bad1-0e2580ff3d06", "indicator--6eae53a3-9dec-4d5f-8906-9730841127cc", "indicator--19f08784-6081-4f91-a2ef-e451486854f8", "indicator--36f5a9d0-292b-424b-87b3-18cff768b5e3", "indicator--02ef1f27-eaab-44e9-9006-ec9fd0ad2da0", "indicator--fc136dcc-43ea-45ac-8b0e-88719fead798", "indicator--b07678f7-07c7-4397-aab7-9d47980afe56", "indicator--8361da3e-c12f-466e-ad38-1f22eb76c33e", "indicator--c9879f4c-bc0f-4e01-be25-1c1ac4ff454e", "indicator--b356daf7-6d6d-4fed-856a-33a7b0e51452", "indicator--7785735a-2f42-4b86-b022-a34bf577bda3", "indicator--53d4579f-cd77-4fcd-9862-744dcd525568", "indicator--7721366a-be24-4db3-9f7f-516f20762316", "indicator--9138cfed-dd05-46b3-b33b-78082c97b0e4", "indicator--9e8ced3b-91de-4587-a8e6-8b980660c52d", "indicator--66924d8a-f2ef-430f-987d-a2e4a5cab255", "indicator--98149bfb-df5e-4fa8-be31-61718a6eb868", "indicator--b0174b64-5bc5-4ca1-a440-ae23078ae82d", "indicator--d65b2908-9705-4d7e-9265-13f6c4204467", "indicator--b0078718-254f-4121-ad10-efd0f93817a6", "indicator--9ed06e4b-086b-4989-919a-1eba3ee6aea0", "indicator--3dda6d0c-80ba-4da1-a632-50bc660ee1f0", "indicator--9cb14b78-5704-400e-8964-4a76c2ee60d3", "indicator--bb09a430-6f59-430c-89d6-b71d4739e1d0", "indicator--df5512f1-af73-4aef-bc89-c817e7abca1f", "indicator--9a3b40b0-83b9-4b12-9569-2129bad25949", "indicator--d2ca8b25-6ba9-4972-ac6c-d44301938a4a", "indicator--3ba3cb84-efa6-4ee2-be85-9b13e019989e", "indicator--dc0389c7-5ab0-4107-a0aa-46347918a457", "indicator--cb9d4616-db12-416b-80e2-19741208a4b4", "indicator--a4ed3052-df9c-416d-a9a8-2d5c416dc528", "indicator--82f0a07f-ded3-4ae4-9e5a-f3d23b3f9cdc", "indicator--1c408e8b-c4f9-4720-b1ce-a2f562663d91", "indicator--e320b6a1-945a-45da-9d94-eb93f0c13f3b", "indicator--19d50f22-76d2-40fa-b1ac-a80633852e1b", "indicator--0220f869-d040-4004-8865-95729487720b", "indicator--0e55235f-9f1e-4cce-9665-9f2ecf69cb69", "indicator--6247aac2-6837-4cd5-947f-b1d520c00653", "indicator--b8a5335e-43d1-490d-aea2-7bf4905e00d9", "indicator--9d668275-90ff-4a27-9a9b-c945180c317f", "indicator--3a6b351e-64f1-4e53-b7f1-95d5befca13f", "indicator--2ca76af7-2ceb-4e4b-b572-c9d47f1b2749", "indicator--2cbac689-3718-4fbb-84b0-9d941ae07d23", "indicator--e0221fa4-40e8-42a1-9cb5-01e6fa01afa1", "indicator--a81a280f-d90e-4f54-a5a5-9a035f8a750f", "indicator--b9a3e188-b2fc-4510-8e25-d877484d706f", "indicator--6f067d73-297a-496a-b29e-286277f651ef", "indicator--6e67defd-2c2b-4fe8-83fb-cf35267be965", "indicator--d16e78db-c341-4fa5-a0d4-a4d8257e0289", "indicator--fd47284e-511c-4331-b23f-33f1af4d27ef", "indicator--0799dee6-5a4d-4099-be5c-7667e9302f4f", "indicator--e464a48f-de67-444d-9d45-90b2e575f442", "indicator--089534a9-7186-4920-942e-18b6543cacfc", "indicator--001a0600-d350-418c-8cbc-9889137b531a", "indicator--4962d999-634b-4689-a70d-d54ece65e675", "indicator--3e9010cc-7594-4ac6-a5c7-95f384dca649", "indicator--bf4c4e54-da46-43f1-a3ff-b868385fc11a", "indicator--878d0163-198c-44c6-8fa3-3c0dca65a62f", "indicator--c0e6ccc1-fad1-4008-8118-82a9000c2dd4", "indicator--bcd8e884-c16c-4772-b47a-04e77529521e", "indicator--826220f0-6efa-4d2d-b6b6-4399702cc2e3", "indicator--ff2beb85-0b02-48ab-a951-0112d8899464", "indicator--3bc631c6-df5e-4473-874e-7d67aa54917a", "indicator--43183d08-0532-4c32-a4a2-dc4b8e76f762", "indicator--e2500260-3ecc-4da6-9724-2c1d7c67113d", "indicator--837bfadb-ec61-4024-ba14-d9678af89ff4", "indicator--ba236dd0-94cd-43a0-96fe-6e80e5208a69", "indicator--2505a59d-a665-4f4a-9b41-7a1c1803ed7b", "indicator--2c72e353-3cd6-4720-9787-a81de89a1b2b", "indicator--435d5fb7-20df-43e5-8e71-5a840ca2479d", "indicator--62723ba4-4a2b-4eb4-b482-4873dc696e59", "indicator--1b36eceb-5b92-4a17-a362-b920b74b0a9a", "indicator--250ff145-a1f9-4472-a1a7-cab08d751913", "indicator--4a19f241-7a45-4a33-8d08-1a8c37d614a6", "indicator--632dc166-31bf-4304-be68-c0e4dd1c7381", "indicator--0a873f71-aaf1-4b51-abf3-f01ac9c83573", "indicator--a7aa4941-f309-41a1-8eb2-37676a05e006", "indicator--03540fb9-51b3-462c-ad2c-2bb0eac22d54", "indicator--a09a674e-d833-44c7-8a50-4046636369d3", "indicator--98a4cd90-48cc-4394-9047-7595c0320b13", "indicator--ff217521-7eac-42ef-b0b5-a509b7b7ab06", "indicator--6dc83b53-91ee-40e4-82b8-3e879b3fc347", "indicator--baea6e41-35f4-4216-a966-8cff685208b7", "indicator--800883f1-d07e-4079-97cb-d58b69e3974c", "indicator--8a7101de-2b0c-4358-b730-647b6489b5a0", "indicator--3d962f4f-1321-40ba-a179-6191940b9220", "indicator--2ed375a8-84c9-49ab-badd-bdabc130fb4f", "indicator--236abc1b-3eba-4a69-8ebb-bfe5551d2fb9", "indicator--f8adacfb-96a2-448a-8c0a-0aa46912336c", "indicator--f584bf43-7675-4030-8a83-9b80588c7d95", "indicator--baf24374-89b1-4af9-a597-170ca3b691b3", "indicator--423a5872-a0f3-41a2-8461-bb10db1bd8ae", "indicator--208b85d0-7d7e-4dbe-8c5d-38feb5aa8f4e", "indicator--4db60ab5-5498-41ab-a325-162455b7306c", "indicator--b026b489-4d13-4ef2-b164-160abca61d95", "indicator--a0180954-5c10-4567-9eff-19d8fc600414", "indicator--8e2c5ceb-f3d6-4668-8e1b-742a2e976fd6", "indicator--11356d1c-eee9-44bb-abcc-fbc1714747ec", "indicator--4314b1ca-14d4-4ef2-bb6a-42c0c75f0e35", "indicator--0f6c2577-751d-401e-a5bc-d22626fda71b", "indicator--8de4114e-a7ab-472c-b795-6a45576b4b9d", "indicator--1b048f54-5c12-40f1-a562-c84a2a5f165b", "indicator--fad7f077-7e11-496a-8853-dd4c24625057", "indicator--765e20e7-4bf0-4cc2-8d4a-ee0508eab727", "indicator--006f460f-480e-448f-8405-68a4df698ab9", "indicator--9bdd7dd4-7eeb-47a5-baf1-6958257ff453", "indicator--f154b225-00e3-4bfe-bc8a-1e911cfe65db", "indicator--b50364bf-7356-4b20-b13f-2236259969ac", "indicator--1c3810ee-7ed1-4001-9f1a-7d08d4ef9825", "indicator--4a292051-b522-4776-8680-2c19d6bc77df", "indicator--aa610a68-eaf0-411e-8b19-0cbac4fb561a", "indicator--0a9d81b6-a789-470d-bd0d-5a1aaf7c214f", "indicator--8a7fd27e-c377-455f-9070-80cba7c8a6d2", "indicator--c01d316f-ad5c-45c1-80fa-a18f970981f6", "indicator--60308285-6047-474a-959a-c8cde8a11a2a", "indicator--04ca06c7-9299-4792-8f14-600fde1fc446", "indicator--b8f783e1-10a6-4386-aca0-7e60bdd96047", "indicator--ac68c646-3c02-468f-82ca-51a49ea6903b", "indicator--d6e5f059-b762-4f3f-92ee-5f2ad42286e9", "indicator--6d63970d-d306-4e64-b890-7cd343c6c858", "indicator--753b8fe9-93a9-493e-9b3d-017479a70fd3", "indicator--31143179-d94d-4524-bc5c-fd3eeb616976", "indicator--20e447a9-d5a7-4b1c-833e-e962b9a6b61a", "indicator--057a4d96-1cba-4ef4-a79c-69661856938a", "indicator--9ef7b864-37a5-47ee-9d5b-23577a7b3594", "indicator--86f593df-c500-432b-8384-58c814b0613d", "indicator--fe38fe8c-b975-47f5-a35e-c2176e357e0f", "indicator--d64f1b29-f2c3-4718-918d-a4e56a73483b", "indicator--1ecea2eb-f2cf-4bf9-83b9-5ec6de983811", "indicator--eddba688-6687-4ec6-921f-69b3454d1c80", "indicator--84196a46-d0bc-45d5-9d8b-63b9be680d0d", "indicator--e7772acd-436d-4359-9ccf-6139977f82cd", "indicator--88db2b6d-fb64-46b8-9cdd-fa8a44aca685", "indicator--0398fd95-4675-4d2a-8829-90177d555d1c", "indicator--2a33a184-6053-470e-80bc-8de722c35ad8", "indicator--d717b00d-b957-42e3-a7b4-34712d20cf23", "indicator--ad6a642e-503c-452e-9ff7-183418a040e5", "indicator--4d30f9cb-b27a-4083-83e6-f21b32e7175d", "indicator--a19c1ac0-2aab-4746-8cd9-3eb3c9e87c4c", "indicator--b3bc8ded-6402-44e4-8888-e621084e7956", "indicator--fd145028-2a3c-4d6e-87aa-31bdd4e50ef4", "indicator--4978fb7e-2aac-4d14-9abd-cee83f7580cb", "indicator--c9601a45-e68a-4070-9b24-3fbd41ba18a9", "indicator--f86bb5ea-e4e8-490e-879b-43b67c14c9d4", "indicator--c6358a07-ad5b-4f01-b2e2-a207b4b7110f", "indicator--63975653-3d94-4943-b481-3404527876c7", "indicator--b37e1734-4ef2-4998-9e03-ef92cd9eb893", "indicator--6541b164-6c85-48cc-9e5b-3dd478c4b53f", "indicator--f6ccef8e-56a2-4407-97f6-36f92300d6c7", "indicator--7130c1d2-9046-48b6-a396-77339433d5ed", "indicator--74640c41-fe37-45ef-976b-2f19eafca5c8", "indicator--ef1dc131-86bd-4502-9101-612a8d719814", "indicator--9732f318-8211-4f7f-9f39-c66751358a71", "indicator--c2a51b42-3498-40ef-96fb-8b98880b4940", "indicator--8a486a03-8319-46e5-bcae-503d37b43988", "indicator--4582cacc-44c8-4c05-9308-8afd35c8413c", "indicator--e7bcd250-5691-46ba-92a6-d439610d335c", "indicator--bffd50cf-0000-4f6b-88fc-1a3b9ebfeae0", "indicator--53093e8d-72de-4a8c-9380-1c855d8c5b9b", "indicator--aa48702c-3511-442c-90b6-72e1fa223a8e", "indicator--60561752-c60c-471d-bf47-e340e3250e99", "indicator--39ec3c37-0245-474c-b0b5-be2dd5dd67c4", "indicator--e743d668-7ece-4e49-b4e3-63e18a4d6e7c", "indicator--553aad97-78b0-40f5-b32c-a3d4b7d3293a", "indicator--d1b118ae-e379-44b3-b38c-fb107f0468c0", "indicator--411978bf-0b58-4b1b-b985-a0f72f237c7b", "indicator--01663c89-0b7c-40e0-b2fe-b0a24dd22a9f", "indicator--99b93db5-551a-4da2-b915-22b991acb06b", "indicator--f90e5d83-1739-4942-8ac3-2630e819cccf", "indicator--97616876-3057-4916-9dfb-86e9d56e59e7", "indicator--9e38ab3d-d9b0-4e4f-9dea-7551d8e88a19", "indicator--9486598b-b668-4c99-bdf5-d04dcdf9f333", "indicator--60b25f3e-ee0c-412b-9961-9bf0fb88d7ae", "indicator--0557056f-1e34-4c74-9d20-d0661036d323", "indicator--997bc6f8-cdf3-4a03-8eb6-9bd8a4cf36db", "indicator--003817f9-8670-45af-91f6-05fab25b0033", "indicator--3120d41f-79e9-455f-9333-b92235165af6", "indicator--b9155920-6f40-4f8e-9013-c6f678aa5733", "indicator--e3bc42f1-a732-445d-a04d-e43c08c98663", "indicator--f6a7240a-bbdf-4e17-bc13-600cf5b074c7", "indicator--388d331a-7bd4-4ff8-9f74-d696453cf2ab", "indicator--25b68d2b-5693-4028-b4a0-4a975aef598f", "indicator--76504ee8-f318-4c03-82b5-2d135a68e69c", "indicator--243b8b4b-ebb9-4e88-b3cf-7aa43e520745", "indicator--dbb2da4b-03cc-4aaa-956a-fd7bc70701e8", "indicator--fdddab67-6940-4163-b000-17094b29bba0", "indicator--1d12ab7f-f52d-46e2-8f5a-bc3583601afd", "indicator--cb3ac050-96aa-4ca4-8adb-ced5a0b95252", "indicator--7f69b0c5-d5b4-4c3c-ac51-8aabd0d52afb", "indicator--1d8e6070-6d83-45de-892a-4ff9e7ec67b0", "indicator--d4fa29c6-fdda-4d0e-8995-ce9a70e926d0", "indicator--16ab809c-821a-4848-97fb-58cd1c66fe53", "indicator--3d6ad88d-b41d-49ef-b2c0-dc2b200bc115", "indicator--ebb0ac10-37ec-4af8-a872-e6cf69531ced", "indicator--20efa05f-2a41-4e98-a6ff-644545e3acdc", "indicator--a5a28376-ff4a-47cf-bde0-e32fc236ca3b", "indicator--24e44429-496f-4893-b4a5-d67ce37f3811", "indicator--97bb0c00-69cc-41ae-9baf-f0450c9c81c4", "indicator--1029d1f5-762d-410e-94b8-058775d8a389", "indicator--5fa224fe-a451-4fb1-b6b8-447e12dc3a39", "indicator--19181bbc-48b8-443c-b93e-51f11836a9fe", "indicator--4c95858e-adba-4167-82c5-53dad7bb1806", "indicator--0114cdfa-eeb4-4c5a-ae3f-0010a1c8a532", "indicator--e5dc8af6-1704-48e2-97c9-04be93f25558", "indicator--23db741b-c582-46de-ae45-6935de1698e1", "indicator--4d16d30a-767e-4a6a-a152-805e324b3725", "indicator--5b1d82e3-bf34-48c7-b1d9-9525e021264e", "indicator--09d103d5-cb76-48b2-99e2-04f8e0c9cc2c", "indicator--c9681cf3-3b4d-42e4-b1d3-284c1848cd69", "indicator--4ef50069-2ff8-48ea-8b77-9899b3a50d63", "indicator--75b6462b-1122-4122-92a8-e2005c46e99d", "indicator--2df865b9-a245-44f3-b485-0fe894d1f121", "indicator--0b2fbd46-9c03-4334-a308-7b5f6a90d586", "indicator--e0d5e621-755b-4d93-b0db-b8f5cc8cfff0", "indicator--29536d88-162e-479e-9073-bbf84929bda9", "indicator--8e199b28-0fb3-4629-b7c7-54e87faf2c4d", "indicator--a440f0d7-4ad4-4e99-9afb-085d166cbdfd", "indicator--8b739b85-4628-41a5-89d7-f97f61daf849", "indicator--19bc64a7-8722-4e1c-9f42-3b0c10a6da50", "indicator--30fcfb63-7892-452e-803d-6889ca132991", "indicator--35c2019b-190c-4f69-9451-e4837c63128e", "indicator--f796f2ed-87cd-48c6-88e8-92a3afd39570", "indicator--d5ca0325-3638-4724-8bd9-2d5f2464d8d0", "indicator--725135d2-c0ca-4a26-b95f-813d612d2b64", "indicator--d17a1633-d36a-40bc-8486-07293ce8f40e", "indicator--534f1c42-0949-400c-acea-423effd46e78", "indicator--1900ce0d-9d4c-4719-b508-16191294a129", "indicator--22689481-071c-4483-8f3f-12b01c67882b", "indicator--032b6b22-995d-42d3-9a30-72ec543ac5d6", "indicator--8c668758-1c70-42c4-a7f2-d5884c6865f8", "indicator--fce03690-6d8a-4a6f-93b9-b2ab057e4502", "indicator--475e5778-cc8a-4893-9558-6ad6e8607350", "indicator--afbc4886-99df-4df2-b352-b0592bf2d57d", "indicator--108ed106-87b2-402c-b5c7-d0d7a73f8d87", "indicator--c748404d-fbf0-41f6-9b1c-3a0485dcff21", "indicator--66c06d38-55e6-40fe-8ba7-b9b158c36211", "indicator--c2fb2c89-687a-49ce-a268-cba9872b620b", "indicator--76297658-4c4c-41fd-8611-fbf35120058a", "indicator--1a95037f-d454-46bf-9e0a-3462098a20a7", "indicator--e3c23b86-f63d-44db-8a02-92f1d0bf6dfd", "indicator--c165c13f-f1a5-4e9c-bc21-d15e66783626", "indicator--ee173d48-e287-43d4-a934-e2edd314e92e", "indicator--e538e22e-35af-46e1-ab0c-b23fd732204c", "indicator--32eb3477-07d6-49ba-9c80-86c5452cdadc", "indicator--58006aa1-e6b9-4dd8-afbd-87350d36eba3", "indicator--9f95e199-7e87-43e1-91e8-b8565566f85c", "indicator--40f3a231-cec3-4bce-904f-fce7102c2f8f", "indicator--2a862719-f889-4bf1-827b-374f1bfe0525", "indicator--02f38636-14ca-4bc8-b21f-75d0f1fba1fd", "indicator--0d28b619-8b3b-4412-b315-52d1d88a9587", "indicator--a59dda9e-a71d-45c8-a6a9-b4452fb189a1", "indicator--20987bb2-8cd4-4e8c-a3eb-fb5e54ed2b0d", "indicator--06d92099-69ad-47e9-8119-c06a2d6255f2", "indicator--621be5c4-571c-4d84-ac09-cbd45b3a8c52", "indicator--47fe7f7d-12f2-4740-9894-f7b4502f5f01", "indicator--ed1a932a-bad3-4798-9ff5-0ab9e20a6f10", "indicator--cd03fb32-cce7-4f2b-bc65-ae4f0592fd29", "indicator--85959b11-0438-4098-8b99-2958a735a6f0", "indicator--1833d3ba-bc88-4768-bf88-a069bb468bf7", "indicator--0d293b4e-0a1d-4608-a911-babc01a1710d", "indicator--da015ce0-844f-47d5-9127-8686938f79ed", "indicator--1788c7cc-650d-446e-a7c8-7dde05feb4f3", "indicator--2184f284-0445-47ed-b93f-a1273cdfb9b7", "indicator--95dffe31-350e-42cc-a540-b1cc90df52bf", "indicator--bc892765-65a5-40fb-a410-a93b61d91aaf", "indicator--d392184a-50f7-47f8-aca3-17085a20790d", "indicator--5af7eb0d-d827-4d0f-957c-af36d83a40b3", "indicator--7a87487d-35ed-4a3b-856a-5daa9b2c691d", "indicator--de7b2f15-85ef-41ff-83f5-ebf9e1ea040a", "indicator--e0277146-d5ac-49b9-8b92-14e5ff9b0393", "indicator--b746b46a-b2af-48f3-a846-e719fde143c9", "indicator--97814db6-aeb6-4ac1-ba20-d4ed5e6ea6ec", "indicator--fae94ca4-7469-4c1c-9f4e-61d8f92cfce1", "indicator--aacc8982-05fd-446c-95c7-31e35b489eb2", "indicator--fa42cdce-ebb7-4ce2-b01b-bf655bec8b0f", "indicator--fd6ad630-3a77-4692-b51e-76f488f135d6", "indicator--f6361b61-5f4b-476d-8070-a518913c4eb8", "indicator--a2430e78-4ea8-41a5-bfa0-739181a627a0", "indicator--a82ca71c-4e3e-494f-9b78-9a40ac34b0c6", "indicator--ee8bb315-7705-4df5-b026-8194e3eab344", "indicator--7130128c-c0b0-4383-a9b5-95ce1be3187d", "indicator--895a7f65-27d9-46fd-ba7b-b663b59637b5", "indicator--c1bc1162-75e1-478c-b2ba-06be8f84dda4", "indicator--18d1b5be-fc8d-497a-9599-b9fb3e969107", "indicator--9c77153f-2b34-4af5-a97a-3e56c0e5b8eb", "indicator--c1058447-9241-4152-9921-f40b27859378", "indicator--cb7c6ca1-f02d-4bfc-9597-bcf7a0078e33", "indicator--33cc3b8a-bc02-4bf8-aecc-2d2bb93743a1", "indicator--d4fdd72d-cf4b-42fe-826b-a0a75a220ed7", "indicator--a62d1baa-5d9c-43c8-8f1c-334e0e1dd0fe", "indicator--58eb9100-06f7-4292-a027-f860e46d82f7", "indicator--3c845c5c-ce01-4ff7-a017-98a6fcd75183", "indicator--edd9f1bd-813d-440c-8ce4-d99d4c896491", "indicator--c469aab5-210d-4bda-9058-9ab2e8f103e4", "indicator--e4c286d2-bf34-4d07-9cff-60f81dde302a", "indicator--072505fe-8e76-4f38-8b7e-dd8fcbbf3029", "indicator--ad761322-5d34-43ad-b928-d66baefa41c1", "indicator--7a8e9713-d2a8-4d4a-bc63-098e588fe9ce", "indicator--048d718f-7781-48bd-b5ca-f2c9f6a5ad7f", "indicator--b0942d9a-efac-4907-bc70-fb5a3d615ccd", "indicator--58560c40-d2f4-4b7a-aef3-6faf10067cb5", "indicator--d52482af-e858-48a2-90ab-c87e9ca7a4b6", "indicator--1a8906a5-655a-4443-8fc7-ccca66514f82", "indicator--d9dd4ae6-4455-4916-abfe-32d465ea2c10", "indicator--dc2302e2-29d9-4e24-ae94-9e9f098fba4c", "indicator--e49bec8d-cdaa-43de-9f64-c6626007cc10", "indicator--cfbe6ea0-6c97-40b0-a1f0-c934b09e2ab9", "indicator--5af42854-8102-4eb2-a5f1-41c3ffb0cc20", "indicator--4c52b14b-5819-448c-a8fb-af98f44c4b9b", "indicator--0a6571d1-db68-408c-a4d5-04c79749ca6c", "indicator--a80174c4-4dd4-414f-a8ad-9ca6cc4c37ec", "indicator--f673c3b3-9633-41e5-a1c8-9d69f22ff117", "indicator--03af3080-6bfc-4efc-bced-58a105773423", "indicator--db8f8bc4-269c-48d5-a9c8-14656d38d8d6", "indicator--4f3f1327-7027-4cb5-a675-62ff2639ff58", "indicator--1adf67aa-2e53-4e3e-867c-0b03fe6dd78b", "indicator--d1d8e32e-4caa-457f-85b5-4554d7a1fa02", "indicator--a0dfd396-20c0-4f1a-b52f-5444098bcf8e", "indicator--ef85cecd-2140-431a-8c14-1c3bf9ef8893", "indicator--55702a43-f96d-4794-ba02-b19bd1d13cc1", "indicator--d193bfae-8229-4166-adbf-b222f5b1f8a4", "indicator--afef556b-058a-4478-bf3f-09e4f4aacf88", "indicator--8e60f429-80a9-4053-a8d5-975324021777", "indicator--aa24d078-5662-421c-b7a1-09c8f3ad14a3", "indicator--d3dabd69-8bdd-444f-b687-7d4c6ef2ac0e", "indicator--170b2290-9f18-4ec1-be49-1c2d5ae5d285", "indicator--0606c8ad-ebcd-4c7c-bbdc-b7b174c2ac9c", "indicator--6cc2a7b3-8609-42c8-b34f-0e88bad8bd80", "indicator--3f50e7c4-aca1-4c26-a311-81606f441f69", "indicator--0225cbdd-585d-4bd1-8084-6fce5d52b3f0", "indicator--d1c26e6c-2cec-4631-97b3-c2f3f6a2cd9d", "indicator--e6a6c7e8-d9ed-4b9c-8ee5-ca952b381c34", "indicator--47b9cb91-39b5-4c52-b31b-52f460b1549d", "indicator--cd8847ea-9b78-4c27-9676-a1dd51edf939", "indicator--3690b5e1-df78-4940-83c1-e7e5be1777d1", "indicator--50ed4fb0-59f4-4f2f-a86e-44132b40a047", "indicator--1762ff11-96a2-45ca-b25f-b549fb12067e", "indicator--507f76f8-dbcd-40d9-8825-709e9b43fd8e", "indicator--e0f40f3e-7530-44f2-b289-fd5663be99c5", "indicator--2c844d9f-8d4e-4b63-b1a5-10f91bb47858", "indicator--f7a13143-51fc-43f4-b416-c98c4c9cd9e6", "indicator--2311be75-1eaa-45f7-8667-dfdf110601d3", "indicator--7f3ca3fc-321d-4241-a378-d2f031caa025", "indicator--416bd479-9bd5-4d9f-a6df-3b51da3a7a12", "indicator--496f732a-a3d7-4409-88bb-bfee15352814", "indicator--44a9fa75-c61c-49eb-97d0-4793a3a5debc", "indicator--569f70b6-db8d-446a-be1f-d143d660e9f2", "indicator--e53db97d-9f7b-4165-95a5-dfcec41633b7", "indicator--dced0d52-0aff-49a1-b081-5b1f78eab9f8", "indicator--d142d54c-cf79-489c-a98e-e7c2754eee34", "indicator--0554bb74-281e-4ed1-b211-a4462ed1978c", "indicator--1df8fb8a-2ad9-4961-bf18-5995c053f3f4", "indicator--8bcb424f-86fe-4253-87b6-1d9693e2f48b", "indicator--86c3328f-b03c-4915-9f54-5d83bc280fdc", "indicator--ed7ba0e9-ed09-44fb-a541-df51488be565", "indicator--ee2ced71-73b1-4d26-a743-0cada4c13d2a", "indicator--941daf2e-a4a5-4c77-b07e-2268a22882e7", "indicator--a6b2b72d-192b-455b-9de4-14825738ad96", "indicator--54db5aed-1afb-4238-8feb-69f6fa6a404f", "indicator--28d34e5d-ceee-40ae-95cb-3d342dcf1513", "indicator--34bf8b1e-a343-4074-9cb0-b53c3527310d", "indicator--ceddc63f-3dfb-4956-a1fd-d02150dd768e", "indicator--1d9ed170-1ab3-4cfd-8fe1-ca900f454cae", "indicator--77066100-6206-4025-8e0a-fb09a6f3ff23", "indicator--106c9d6e-7b6e-4ee7-a712-fa2fd789be43", "indicator--1ff29bf0-32c9-4e48-b930-14ed09ea4ce3", "indicator--eb8b1922-2946-437b-bb7d-6558a44186ed", "indicator--6d6ff799-d133-4712-a1ac-afc9c54a1699", "indicator--6d07e164-097d-4448-bef1-ebd3d1436325", "indicator--45401d43-ef5d-4fe7-9a6b-8b9745988eeb", "indicator--1a233139-64bd-4287-b1c2-015dea78158d", "indicator--ea62f8ab-455e-4c02-8192-451b57fe8a7e", "indicator--8eed37b9-67b8-4ff5-bff0-f3814df44704", "indicator--a1952bef-83ec-451b-8980-fbcfd6e9c697", "indicator--4bacb6c6-306f-4a03-924f-c31ca98998c7", "indicator--700f77e1-f954-49a4-8fba-39132b4e56f5", "indicator--f416094d-a859-41ad-9662-ca1429f006dc", "indicator--766b466c-fbcf-4786-a617-463f5f18db4f", "indicator--fdc402f8-a5bc-4037-905a-84139bd6d8ec", "indicator--8f173662-681f-4d9b-b61b-b3168179deea", "indicator--9d331c78-357d-4663-82e6-e5ca175f7468", "indicator--baccdebd-5806-4d3b-b7d7-d81f75a492a9", "indicator--145be544-579b-49a8-aefa-6c151121ee90", "indicator--c5b81ef0-293d-498c-bbcd-bed1c47fce5d", "indicator--1c470895-766f-4f19-9979-9aac9e02ad99", "indicator--c7a49826-539d-4b5f-b03e-7dd61caff40d", "indicator--1f886689-79e0-4478-a4c2-73ee35fd4be2", "indicator--6a35da38-26f0-474b-9827-3cae8e69c4f3", "indicator--2313fa25-df53-4253-a519-237f6b96be38", "indicator--e794e9a3-a613-4e0d-9ef9-d89ef9c804de", "indicator--feba1513-800b-48d9-aec5-b8e1062e0429", "indicator--efc19208-2367-492a-b373-2cf26069f14b", "indicator--2f84e4a4-e4ff-4672-a667-7ede7aebfec6", "indicator--f5a83c0d-3474-425d-b833-382efbb24e4b", "indicator--cd5fd6b1-a8a7-4298-886b-d968474561fe", "indicator--25b9e481-6143-499d-adb7-2c0ff0e118ce", "indicator--e9b3caea-38ab-4b4d-9969-ff6baba8a93a", "indicator--6973792e-bd98-4cdd-a8b9-47cedea10a73", "indicator--971301bb-5883-416d-ad84-68d685733066", "indicator--2196bece-4a4c-4f49-b1d2-3537c99c0451", "indicator--250f8e2a-6160-4c6e-913c-91cdbcc82efe", "indicator--d96a051b-1b79-4dd4-b925-eb54ec26cbb4", "indicator--a06b3fd1-1ee9-4b53-a118-60d82538ccfa", "indicator--4bf6c44b-f17a-4fdc-88c4-8b63590540c8", "indicator--8365cb2e-f2db-404b-8575-15a2b43957f3", "indicator--c3efbffb-634b-4c94-9fdb-c1f42d8b08bb", "indicator--b97b9ce7-0354-4f35-affa-8819ed33cf2b", "indicator--e562e195-9b83-495b-b606-89d5d826ebe9", "indicator--3ffa7d5f-5a54-4abc-97c0-07c40d571c59", "indicator--d6f467d8-693d-4031-b471-5718f3d91f58", "indicator--43e099e3-c12d-4b6c-ae7e-adea8977cdc7", "indicator--a7393020-4ba8-41fb-89b1-465a1cf91a0a", "indicator--3c1b00e2-ed19-4657-b245-1a63b16a5ba7", "indicator--c066aea6-34c8-49e2-ab4d-ab6e3114f715", "indicator--f85de16a-608d-48ce-b276-6a62106d22ef", "indicator--5ca2b35b-6788-4176-9f01-0b312baa2aa9", "indicator--b7e7608f-9417-4552-921e-ca8635e846c8", "indicator--83dd48b6-823d-4a50-a8a5-34f061863ae6", "indicator--3b2117b8-c799-4eca-a64a-d1f5240e6652", "indicator--b813ca58-dbb7-43ef-b697-29501baf4734", "indicator--86cf2a92-7c0e-40e8-a011-8dafa2bd36b7", "indicator--66511de6-f8f8-4d74-8f52-6075f87c35eb", "indicator--e7542117-6396-4cb3-9fc7-4198ebd5f255", "indicator--a4a9316d-a88e-4ba8-bba9-641240421d21", "indicator--3715a0a3-0023-4e73-ae30-0ef052d4e046", "indicator--a9ca17b0-5037-4d13-b26b-4457223ad286", "indicator--252d888f-f001-401b-bd14-301b712806b0", "indicator--5f9bb639-d548-4d68-a1a1-addbf7671ef9", "indicator--e185bf2a-b9bb-4287-ae3a-bce9f7fd6dc1", "indicator--2c854c17-d6d7-4e9b-8393-772f0f056276", "indicator--5cf9bee5-0e30-4249-9859-cc494d36b1a5", "indicator--7c587e0c-6fb2-439c-8346-3033442d438e", "indicator--b9ec1d13-f6d6-43ed-83bd-6ba4787f920d", "indicator--e85b620c-55b7-4790-bd28-41541009dfc2", "indicator--f6eaf770-94d0-4c0f-99de-82c43688aed6", "indicator--fa81bfd0-166b-4904-9cfe-412d6e6e0481", "indicator--d61bdf8f-120e-44e2-9bdc-fe1387ecd09d", "indicator--4ccdbd60-277a-4470-8111-7228ebbbe540", "indicator--42136253-96a2-4cbf-98a1-6052e68b0c80", "indicator--048a0ed0-b4a3-474d-88cb-b24a305cb822", "indicator--0b74b988-69d4-4801-88a9-c80a4fcd07e1", "indicator--4c6265fc-50d7-4783-a8e7-df0f637a0fee", "indicator--475bf9db-5a3a-4900-a534-b5684f50a5d4", "indicator--3556f1de-ff85-4607-a602-6e1a56826aa7", "indicator--63b0986a-cc0b-4e05-970d-ab4723224b9a", "indicator--5cefc7ac-14a0-480c-87e0-62931b97a029", "indicator--45b1b1dd-778a-4454-9a3b-c69610e679b4", "indicator--b9e00250-62bd-44cd-b3b9-4d65cd76156e", "indicator--976776cf-2d56-4c9d-a1b0-b2df88228332", "indicator--939bd219-6ff2-4bda-bc8a-81ce52ccb13b", "indicator--526bb531-7148-42d9-8ac1-235fef12c1f0", "indicator--89e146f6-570e-4017-8687-dccaf9128bdf", "indicator--75c96cfb-63b9-49ef-b1e1-3173a8a69a62", "indicator--b416eabd-e9b6-47fa-bbdd-7416c70aebde", "indicator--b2e9e409-64bc-4a48-9a90-6f9411dd157b", "indicator--702c5cda-9d68-4d1c-b79e-a4aa7f86167a", "indicator--d768016b-8b3d-48f1-a0f6-c093f384d42a", "indicator--1035a323-b120-42cf-b990-7c5c44388981", "indicator--5996eeed-59c0-4c77-a1ee-ebe947c172e9", "indicator--0e4eac8a-9fd8-46eb-9589-3c1df82d4267", "indicator--09d10b5e-61b3-42f2-8b96-323e6b475b6e", "indicator--1df7a0e6-4064-4f73-9060-ef13f67a4542", "indicator--21c830db-a2dc-4558-aa7e-12a8ecfd3eda", "indicator--7a800218-2127-4ebc-a549-0f639a9f0ec0", "indicator--26d000ed-0ab8-42c8-8256-a90d4a97932b", "indicator--e7c6f99c-8736-4e4d-9eba-3387ade6fcca", "indicator--71e6ca6e-2f62-499a-b5c7-209cb081cca2", "indicator--2d366b5c-931b-4e93-98e7-52dc256383e7", "indicator--b046c180-ff4f-4971-b11b-a48a88cb3905", "indicator--63326449-c89b-458c-8705-81feb5cb3285", "indicator--bb62efc9-ba79-4748-abaf-40950e4c31e2", "indicator--a720e408-91fc-425c-8015-7521ccc54048", "indicator--63817e86-4f58-4cab-b9b0-d652614a7793", "indicator--45079d0f-a9fd-46bf-8963-223a659d739f", "indicator--a4d9fe5a-019b-471b-a105-d0863c544112", "indicator--154e654f-2792-4ec0-9df5-92c08d46c0de", "indicator--4a1690d2-29c6-49b4-9b5e-af9ebacc919e", "indicator--8390196d-5b0e-4ec6-951d-5348bcac03ca", "indicator--7c588329-8d3c-4782-95a1-07bd696286bd", "indicator--f4e9967a-ded6-4fdd-83fc-c3165fe99ee5", "indicator--bff0c1da-68fa-4307-8381-8c58387ba093", "indicator--fc2a066c-894a-48c0-8025-75f1e875bdaf", "indicator--16d1ff3e-842d-49e5-9a8f-29e9ae6eb86f", "indicator--3b98b06b-b2d5-4c52-b5d8-24aea333ae6f", "indicator--955e4261-28ba-49e0-bfe8-e022ebafaf96", "indicator--9809e8c6-8a7e-4005-9122-ecf49d7e9f30", "indicator--41244daf-1fe6-4683-b704-184e4f36929e", "indicator--0767b441-5397-4b09-a38c-10c5b248109e", "indicator--f91360ee-fdc5-4d2f-b29b-6adee6d12333", "indicator--22661b1a-4bdc-4f9c-8af6-f607a837cd3d", "indicator--bbb03238-a4be-415c-9c7f-47c419ff6275", "indicator--0ea2b565-0405-400d-a026-d55e4b7146e1", "indicator--d1f7c519-8e0f-451a-add1-7ce74f9553a7", "indicator--2540e2f8-fdb5-4f67-b096-a9678fb9aa24", "indicator--564ee783-dc95-450a-827c-ba146461b7f3", "indicator--0497727c-c2bc-4a31-bacb-cfdf9f9a5658", "indicator--f179f2cc-7e89-4498-9696-77b7becb76ae", "indicator--19cf3072-97ca-4ac9-bcc9-b0220a68d990", "indicator--2216e91d-8537-4ed1-802b-21b349b35db0", "indicator--a80138aa-a9b6-4c0c-9acb-498ad1dcffe9", "indicator--61e8fdbe-9ca6-4da9-97c1-4162dd841e0c", "indicator--ea101671-b716-4d63-8fd3-22dbaad4135e", "indicator--92c9933b-d8d7-4492-b07b-7b162f9f8e9a", "indicator--d50076fb-ed06-48d0-a38d-a041ee2bd975", "indicator--ff5537cf-1ce1-40e7-98d4-12b3ea0df1eb", "indicator--4f1ba8ce-da09-4def-8fc1-6fd2c156aa66", "indicator--a6ce62dc-370c-4acd-bbc7-5fec5450a736", "indicator--decef7ef-3a26-4543-b8f8-0acc579728a0", "indicator--70419fd6-2837-4643-9682-36e8d913cf52", "indicator--c84bc280-508f-4c13-a0ff-43fbfd18fc99", "indicator--5101cf20-1cd9-43d8-9a27-515afcfcb6c4", "indicator--5a905962-6a40-47de-bd01-c8fdb0bc4094", "indicator--fd237ab6-215d-4309-825c-9d2bf163d1a6", "indicator--43b96c99-10ac-4495-a82f-b6a96f0a1caf", "indicator--80f69d3d-5df5-49a3-88cf-c4f8b7f79da9", "indicator--8a895ec6-60f9-4df4-abe2-ed747d110876", "indicator--3f4d450c-c8af-4885-9fa0-cedf8d56c158", "indicator--4316c64d-ca02-46c4-bf88-cc8362f616f3", "indicator--81b27a86-44fe-4bfc-bf56-03621e6fb9dc", "indicator--464983ed-4422-4220-99f7-1642a59d15be", "indicator--ef9b3ae6-efa3-4b9e-9e57-f9dcd8b3372c", "indicator--6728e520-2813-49d2-9147-6e4ad075abb3", "indicator--611cc143-e2af-4729-8dd0-52922d4e34cd", "indicator--0cf766f6-57c6-48ba-94c9-1df7d6e1922f", "indicator--ad1a3f99-2adb-4dae-8943-cb454243d639", "indicator--b3045ae5-96eb-4a25-9d8b-626bd69007ad", "indicator--b4d9b56e-24ab-4ab2-84ed-4c8ac6cf7bd1", "indicator--797e7f35-0c0c-43c8-b894-43140a06ced4", "indicator--93533b4b-be44-4611-93da-4d2c823c175e", "indicator--4bcada27-b7e4-47e6-b2db-8d50dacb58ff", "indicator--e5637f9a-853e-456f-a9c1-24146f2e4004", "indicator--233e7e51-d419-42a6-a248-aa0c05a095f2", "indicator--dc4ecca0-358e-4548-8eb7-3425c8476ddd", "indicator--7d3237b2-7730-4171-b5d8-272d447d934b", "indicator--0b0a1b10-43fd-4b09-b538-d2597563f99d", "indicator--428866b7-94fa-4339-b21f-2a408d1b1d13", "indicator--2f0cc852-d050-4480-80ce-87cd733f53db", "indicator--55bae2c8-fd1e-44b6-9386-933ef227d635", "indicator--c762e323-a386-4fae-8a45-0d2b84735648", "indicator--bba94118-69ca-4e9a-9b90-24036f42b841", "indicator--5365a56c-1438-4c88-8c13-bdcc204e2cc0", "indicator--ec766c82-01e0-4e42-9a04-a639e69f4b40", "indicator--1b498897-d549-4c6f-8033-443e4d757d94", "indicator--0d626607-2ded-4467-a849-6c9ea4116500", "indicator--cfc246d3-5651-40c4-968b-556b686a642b", "indicator--d6cc3829-9cdf-4b0c-ba39-15d51a858691", "indicator--5e51889c-b0bb-4762-9141-dabb836bdba8", "indicator--903a73f4-baf8-47c6-b387-a9d8bf7bd58b", "indicator--5fda1562-384f-4867-a0bd-049db6cefb5b", "indicator--4172cdfa-67c2-40a5-936b-97c3cd9b9fc1", "indicator--dc5f4609-b04c-405e-b301-c564d82a3d62", "indicator--011dc356-744a-42ec-9fa4-2a8d116a3379", "indicator--59b0bb3f-b412-4a41-9f1b-07694b44e80c", "indicator--4766b282-158d-4952-9cf5-570dd37f93f5", "indicator--473c6f9d-7e6b-4660-a5ff-7b03ac49c1ab", "indicator--1fc72986-9ff0-42c4-85a5-2a0f65ff91e9", "indicator--a76213d5-a05d-467f-9cd9-2c36400c7110", "indicator--883470c6-c12c-4d43-af71-8d89c680d7eb", "indicator--d7e7dce7-bdc5-4ba0-adf5-cd068ffb0e71", "indicator--5c6ee274-7fff-432c-b3f6-feb8d70852a7", "indicator--47cc6186-3449-4f08-9e59-73b050263665", "indicator--6ee5cb6a-26fd-4187-ab60-2d4605f1b966", "indicator--8ef09e91-f349-46c1-8494-871cb3cfec6e", "indicator--9eff9c61-2298-4e33-90f3-d234dd54e142", "indicator--defd1d03-9674-412d-9eef-3cf6a325d00e", "indicator--1c0afbf0-5899-428c-b524-e3febbbaa9e4", "indicator--699f485a-0349-4493-a7ae-381badc89068", "indicator--7691b928-da7f-4132-ae6b-c7bb0ac6d53c", "indicator--92f40fe6-4066-444d-9f62-a2e0655cdceb", "indicator--be6d1942-823c-46cd-9c59-e2a003732bc7", "indicator--79aa6f3c-3f13-4af5-b5c3-1be3f3a1e0ca", "indicator--0fd02e2f-295e-495f-9e25-67206ce15601", "indicator--890ced2c-60c4-45d2-a862-b6efbda288f7", "indicator--5501a012-6f4b-42f1-bdfd-4beeca0b271d", "indicator--9c75707e-fa83-4265-9e84-c375cf713e61", "indicator--6f102e41-ce43-4025-9601-5c21e60f704f", "indicator--f74fc19c-22dc-4b98-b561-600ea1cafaf6", "relationship--b2b7bbce-1bbc-4171-93d7-2488bceff371", "relationship--a0bb612d-35d7-44f3-b5d3-af0d80a6e2b6", "relationship--3ab717bc-8350-4cb0-acec-619a1e8f2cb9", "indicator--f116c9e8-a1da-4e02-b840-1637f4d493ba", "indicator--968c9da3-6832-4766-8fa9-a21fd796275d", "indicator--1348a83f-bef7-498a-88da-9ca16e08239f", "indicator--6de26366-626e-48cc-8d27-8fbd80cb4a53", "indicator--7718b56b-7c58-4d33-ae9c-a69ac1db5f11", "indicator--106f8d64-3242-47d1-9541-af727ff793bf", "indicator--9f7d2738-24ef-40a1-85b5-48c7d5d50655", "indicator--e785c6da-5a25-4f3f-87f0-2421a6d30c8a", "indicator--6a3cf878-33a2-496b-a206-f0669df9a3a5", "indicator--e806b2da-f5b2-4015-afb3-855964643707", "indicator--d49aac98-b0f4-4050-bb4a-92f3a3821c40", "indicator--0a1a6891-1da7-4aaf-9180-714b999682d5", "indicator--7aabea9a-a4e0-47a2-b630-1bbab8fd010e", "indicator--45ebbe37-d005-47b9-a42d-e717dfd3b344", "indicator--d2c732a5-4147-4a6f-900a-fbb8a21660ca", "indicator--9296bd59-a150-4712-a366-82ecfa383ff1", "indicator--9b6189c9-25e6-41b8-8bd6-c83628d3a691", "indicator--b4ae1a7b-db9b-46ee-acc3-60b130fc75c6", "indicator--e0a83924-4a1f-4162-b446-941b889b2585", "indicator--9c7c1152-a3f8-41e0-91b8-74b4c20aac9b", "indicator--dfabf4ce-ed21-4330-a90e-4b12a69be408", "indicator--a5bdfff9-46a9-49f3-97e2-ae7cda5a6915", "indicator--66240fdb-d70a-43dd-b127-7910ce731375", "indicator--ee9eaa93-4782-4851-955f-7097a6725281", "indicator--12b09207-2093-441d-b9fa-7d2283606ad7", "indicator--05d9313a-f807-41ca-bbd2-ba0a572016a5", "indicator--8ba14a6a-b6ae-4132-a81a-a1ea511ffa0e", "indicator--298c093d-c978-4751-ba55-815e53d83804", "indicator--e949eed8-c05c-469f-a6b2-73c2a407e645", "indicator--bcbba2a3-fa83-4960-b375-ce1810e2b27f", "indicator--b255fe88-41c3-4e4b-92b6-a9c4671e82d7", "indicator--cc9b3e21-57f1-45f7-bc5f-46f62bca3717", "indicator--12bd6d4a-b32b-4e02-b4f8-c6031fc1c66d", "indicator--040d1f32-2de0-4147-99c3-6e848e93b54c", "indicator--aa2469b4-9886-4e35-8e9b-ba00699cc65a", "indicator--fc33904b-674a-45fc-a507-e30649bc0ac4", "indicator--e37a8aaf-baab-4b4d-8eb2-94be5a9034a4", "indicator--0b525c35-8e32-4aa7-8615-e42c6884036d", "indicator--4dbdc0ad-8089-4fe9-8925-c3e9ddf1bcd4", "indicator--5154631b-c820-4772-8e14-7ae81ecbc2db", "indicator--cd986b8d-0df0-49d7-8939-0b7cdb78587b", "indicator--1649ed59-1ccf-4dec-819b-16dd48059474", "indicator--9076cb31-5a19-4ec3-b394-3a3e8c618755", "indicator--c9c6de1c-3c05-406e-8721-02e6af9205d8", "indicator--b6e002d0-6989-4192-ae27-3f4119e82368", "indicator--b3468bc1-049f-4c6c-9276-fdeae24cfae7", "indicator--79521110-b395-4c57-bb36-f0446f139e56", "relationship--5227d4df-a632-4001-aec0-8b8ef9b80593", "indicator--fc5ce5d4-ebf0-4190-a0de-8d5d4cbd821d", "indicator--402de88f-f261-4231-a7a6-daab7b51625e", "indicator--b9bfeb9d-ba74-4a4d-98cc-5241964cbc2f", "indicator--4e26ad72-153b-4ec2-b964-a6b8d28d2912", "indicator--f92673bb-4bc3-4de2-b3aa-fb42cf716f5a", "indicator--f9a7bfd0-48dd-4b4f-900b-d19eba50475b", "indicator--cf47ce08-2ec9-4cd2-8271-7c50ef015ff6", "indicator--35e8f5fa-7113-48a9-ae24-29ab06300cb3", "indicator--0b382551-2607-425b-9fbc-c5e939a5dc66", "indicator--fe254817-73c5-4391-9da1-ac7e63eef4c9", "indicator--dfff1526-4e7b-434a-81ad-6cedf3fb1cbc", "indicator--13a1de9a-17a9-4a04-84e6-d5cc1c331c1f", "indicator--956d843c-28de-454f-8e2f-9460322241da", "indicator--878a8be4-dec3-4872-be73-ac46a327ce4c", "indicator--6663cfd9-450e-4c98-bb11-caef8e908f90", "indicator--c8beaee9-fae9-45e2-bf55-51f433e4c694", "indicator--de1dd6a7-9442-48bf-bb76-5cac5c7d034d", "indicator--7003dab1-7311-4263-aa03-369dffc37d06", "indicator--5a442d3a-eced-488b-b245-9618b0571a81", "indicator--5a3c9733-54de-489d-b434-e9c19115a12f", "indicator--20112dbc-9f78-4d37-bb52-7d42a63a7873", "indicator--73de7dee-c4f5-47eb-81ac-1c84e7d28ef4", "indicator--0309f566-200c-46fe-9c71-1612d54f8b2c", "indicator--c07f7ce9-7b69-4bc9-9af3-0f1b5866c33f", "indicator--bb97ee57-dd18-4241-85dc-9b7105897ba8", "indicator--7c216826-eabd-4570-925b-a33bc6dfa95d", "indicator--ba0f3ed6-235f-40b6-8663-2838b0326cd1", "indicator--889e6c64-6c2d-4cff-8afe-6c42079f8537", "indicator--edc79aa4-2420-4241-a57d-f9dff6012029", "indicator--8b1a46ff-41e7-4142-90c6-d99d6f1ca51f", "indicator--78ed15e1-e867-4e63-82c9-809a92a4373e", "indicator--85e621b6-de18-4781-8426-477647109173", "indicator--811c0eca-0fae-4931-b218-61f3df71685b", "indicator--4eca9439-6252-4e85-8ef7-3813d9c476ac", "indicator--a00c5de0-b785-4412-8ba8-6f72b34b7e4b", "indicator--61f483a5-c0af-4898-9d89-67b5466baaa2", "indicator--0b201a9d-258c-4ff4-a4d1-4e7f68790f64", "indicator--8f6152c8-3aeb-46e0-8e2a-2a0540c9960b", "indicator--1803141f-2af0-428b-b6f8-004c75198d59", "indicator--09a16053-231a-4c0c-afcf-8b837348f612", "indicator--e90958f2-9ad5-4c7f-83b7-899014f0365a", "indicator--21b3e2ed-a899-4c75-a112-e814e2b62e21", "indicator--6d6a8d42-7cf2-4d06-8696-67fc64969e28", "indicator--83030801-c650-446e-a82a-be43a051ac35", "indicator--8d85c101-e170-464a-a695-2834c61c6b38", "indicator--098dfe90-642e-43b9-96b0-5c0a1e66e68f", "indicator--631bb065-d81f-45e8-ae98-55d903dec9f0", "indicator--e1678ee6-017e-4bb8-805a-fc9e2e0b9d61", "indicator--d6b71ea6-601d-40fd-9db4-644e0807f406", "indicator--b2cdbbb6-a49c-470d-8e02-2269945d4fff", "indicator--564f58fa-f07c-46a4-8cbb-36cab58f9160", "indicator--884feea5-7b54-422f-965f-e35423b3d12d", "indicator--ddc3d218-bfbc-4b8a-9f0a-e7d2e87388ce", "indicator--aa0eff1e-471a-41dd-bfc4-59332bc2450d", "indicator--7748c6b7-b26f-42c3-a632-639c91875769", "indicator--7faea370-c44e-41f2-8236-1aeb5a17f56d", "indicator--03d22bad-eb99-42df-8607-b0f86870b39c", "indicator--d5111ed0-deee-4e0d-a283-08364b0a2d8c", "indicator--b1d06576-3879-4704-9d1d-fdfa400c76e4", "indicator--35c1ef9d-de7d-4aea-864d-e607492f8313", "indicator--ee04461d-c889-40a7-9176-eb50372080b4", "indicator--cced908c-5d1f-49db-908c-a047623f642d", "indicator--ccfc2426-d9ba-4faf-abcb-9fc0b8edfb0a", "indicator--3b228bc0-0cff-4da2-ac3f-0932e27ee3d6", "indicator--4415bd8f-128b-4244-a623-28295a7ee0ab", "indicator--52d44786-9250-4a01-aaa9-37a199560a23", "indicator--e3bce525-2806-4978-98e4-5ea62138c256", "indicator--ca842260-dfb0-4142-802b-944a0380d808", "indicator--38702222-186d-4730-9c4d-b1832f25f005", "indicator--91093fd7-a0e6-4e0e-87e8-d462338139c4", "indicator--a4d1c0eb-3dbb-4919-aee4-48ba2b7d1756", "indicator--f8989ff2-13f3-4175-b66e-1e559c1390d8", "indicator--612d38b5-6887-49d2-bb1c-e2cab35aa381", "indicator--b4662158-23e1-4746-8b95-ab54ed88acdc", "indicator--fab7d258-2b1f-4690-b186-c2f5bece0785", "indicator--0312e975-3389-46e8-9b6f-5bb455a749d4", "indicator--2ca13f30-5d73-4b58-818b-3e874741dc2d", "indicator--90670770-d6bc-4431-8a1a-10cbe1d0af4d", "indicator--605fda91-b8cd-4a7c-a08f-3d4e2aa2d841", "indicator--46a5fe0d-faba-4979-8e95-33e023835807", "indicator--5d4ba4d7-ccae-47d8-bb55-868be08359e4", "indicator--4e64ca40-b111-4e47-913f-7ba0365e5c0a", "indicator--ecb76e56-8968-432e-a799-bc6edeb83acd", "indicator--7e60235a-4dab-4983-a048-f7026eb3049b", "indicator--b3323e99-928a-4677-a9be-34fa47ddc3b1", "indicator--b8ee561c-2cba-448f-9505-3cae771f31ee", "indicator--89f1b9e8-4623-4f8e-8967-d43af4db0613", "indicator--0459bf11-cec4-4d68-85e3-a093561ef365", "indicator--d90828ab-7382-4565-95a9-ed119b665126", "indicator--72da52ab-f0b1-47ae-b049-f1080897f5ac", "indicator--581066db-227a-41f8-b03c-8dff85b10555", "indicator--46e197c9-c611-4edc-a266-59a70f278844", "indicator--90e99e3c-a0b7-40a2-82fb-dd7247568c08", "indicator--e7906ce0-9836-48fc-ab84-8c0d7b02402b", "indicator--7adf6eb2-5a6a-41e3-95c3-bdba8f609568", "indicator--20ea1da8-df6f-443b-adfe-9f65638daf05", "indicator--8b63bf2f-08f4-4319-ae1c-7ffeab3d4861", "indicator--4fec544f-7832-4e55-910c-43ae33f3daf5", "indicator--7deb00ae-9dc1-4692-8882-5a369c03200f", "indicator--33422f42-6bcd-4d0d-b5b3-11f9efa9434f", "indicator--34d6daab-648b-411a-ac11-e8392dfe52d2", "indicator--1b4680ce-8f42-4547-97d5-6be708f31f9a", "indicator--e0aca13e-788d-42b5-8ec0-0711eb418291", "indicator--7ef5eb16-8ba3-4e2a-9f07-72f8395d8511", "indicator--b5002990-8329-4266-a015-dd5c94b462b6", "indicator--984a1e8b-fa32-49ed-bff8-e437a186d259", "indicator--06a3f481-7bb2-49ec-9f1c-00ee350027f6", "indicator--ed09dded-ac70-4238-a08b-9b9157911b08", "indicator--98c8d289-373f-4b0b-a51c-c9ef76fafa07", "indicator--8742d439-7e0b-47a8-bd90-2e2b0a13c1f7", "indicator--8313957d-0d1d-44fe-b41f-9b140935d994", "indicator--fabeb9c8-9d10-4735-aa6b-dbc839e644f8", "indicator--9ece4fbf-7ba8-4fd4-9297-08c2bab496b6", "indicator--89922546-a8d5-4106-b706-2eb52336b9fc", "indicator--d262f41f-86be-4797-bbff-98d3744d390a", "indicator--1f9d39b1-f686-4d30-ac0f-acd7c475775e", "indicator--79d92dba-9fe8-4f69-9a93-2567f7013987", "indicator--c6e670d6-7270-4c50-987b-8e126fabe2f5", "indicator--b572367d-1144-454b-a395-be8823aa7ff7", "indicator--d6bf3e41-bda1-463a-b5de-fb0bb14c04c3", "indicator--60f2dee1-623f-4b81-b3b2-de76b595659a", "indicator--dda97938-27c0-479b-abd4-7131b0d458b1", "indicator--b089f4a2-a570-4811-bf7f-851649fc6e53", "indicator--f4434f77-bd83-470b-86fd-de5df30163d0", "indicator--0eb4f9ac-ff14-4451-a466-05eed9ef2510", "indicator--c90c59f3-187c-4ec1-a7e1-7c4c13c81682", "indicator--f75c4a90-15fd-46b2-8e08-903884e236ac", "indicator--72c75cd0-ad74-4f41-9abc-2bc632509aac", "indicator--acac4520-b135-47fb-9342-3107e14f5e01", "indicator--2dfec0af-72de-4379-bcab-7b8adcfb4488", "indicator--116c7908-0d41-402a-8cfc-4567d22f1d1b", "indicator--671ae7ec-7a72-4396-9fe6-196954d74c32", "indicator--76edefec-2d95-45cc-ba8b-8f8e65667e2b", "indicator--d977f276-0aaf-4282-9677-bfd953b1f7e4", "indicator--3287fe56-2a8b-4e87-b711-93d8f80d9120", "indicator--570feb27-7d58-4c47-87d6-25a6694c5735", "indicator--2f54146a-9b01-4693-9326-6ccdb306c290", "indicator--c8b0cfb4-d5ca-4614-82e9-b80c2df19f2b", "indicator--fb1825c8-4156-42dd-8706-8cccd44b06ea", "indicator--ed2bc52c-239b-4135-9c14-6a8da12c33e1", "indicator--d5d182ef-a180-40be-8d52-28b928fba25c", "indicator--847f6375-9b9d-4e09-8c8c-485ea1cf5e49", "indicator--3ed8b604-0261-4097-b98b-af436780d2dc", "indicator--e65ba142-59e9-40d0-af64-4c4533be3ad7", "indicator--431aa179-83f5-4026-bb7d-953f0fece396", "indicator--a3b341a4-d431-4704-850c-51353a8a5e5f", "indicator--90328eb0-eb04-4df4-a409-ca8099d51285", "indicator--59e6e776-3a6e-4f9c-b80f-2a18e27d85f6", "indicator--5ee06e2a-cc53-47c6-8afb-e06bf446db32", "indicator--2c5bd13c-6e3a-485a-856f-80d243e41d34", "indicator--48b97c41-9e4c-4835-a9e3-cdbe45d9b9af", "indicator--64045c07-a9f1-4e5a-8ac3-bcd7ac32cb80", "indicator--a95afcde-2d78-48c0-bf42-6d735d696a43", "indicator--dd485ef9-44d4-4e21-ac33-e5d95541c98d", "indicator--5650aab9-0134-4904-b35a-86318bb1b3e5", "indicator--ae1efd71-c946-4fdd-b3bd-56d17d7cdeee", "indicator--1f5d45b6-f8d6-478e-bbd6-bb80944c1303", "indicator--979fe1be-3882-4db7-bde2-6abfc4b45710", "indicator--44575c79-fbe9-4b1f-9ad7-58e0871f41b9", "indicator--d4a208b1-abbb-44e2-9160-259b2f3d9d7d", "indicator--e3460052-fd7e-4059-bfcd-5ca698a63a30", "indicator--339d3462-b8db-498d-a6df-bd97c8b31197", "indicator--6f725ca0-0ece-411b-a4f2-290c79b76378", "indicator--14fe4b49-9a44-4eaa-82c0-8a336f2654fa", "indicator--b38b62d5-4a8f-4540-94ef-5955695fc28e", "indicator--399983ed-6e77-41b5-95e7-41dc66058625", "indicator--8ee653db-161d-478f-9c61-59fd7cee12af", "indicator--515ec99c-286f-44be-901a-69a2de1bcdb6", "indicator--910bac9d-fc0b-44d8-90de-f2148202cb26", "indicator--5deeb6d5-cdbe-452e-8556-22290771cdc5", "indicator--8e1a15c1-847c-45b6-81ef-f7ef337a733a", "indicator--6a362d7e-25f4-42f5-ae4b-35b88be27074", "indicator--123fbc06-e032-4fd2-b568-82a14fb26533", "indicator--0c833e4b-491b-46b2-8da7-049c5fb5fece", "indicator--d7bb137e-05dc-4048-a6fb-8a7eeb354a59", "indicator--5647ab0c-cb38-4ce0-a5ce-8c2bb8cec2e7", "indicator--f29831df-6891-4889-8a7a-7941d2b9cb30", "indicator--79d2b914-2013-4e25-ac7d-3f590a83ae83", "indicator--cae08f5b-aa65-475c-9315-1ad83db9bdb8", "indicator--ecf0dfa1-46e9-4dab-89f9-8a4b9f76d7f8", "indicator--48773c81-fd9a-40d9-972a-acbe6e40d661", "indicator--2fbbd291-71d1-47cd-8be8-35ae442f9d54", "indicator--9eba89b7-4411-4f7d-8ee0-de13b755211d", "indicator--51afcb4c-c95f-4eea-82d2-81aa01e116fb", "indicator--fe6799f6-2fd3-4384-9a1b-6e54e5051dbc", "indicator--ad65bbe7-f783-4994-aab1-eb82885f90a7", "indicator--a55bf613-db6a-4f8f-825a-679426ac85d7", "indicator--655d1769-48bb-4dc4-b468-f6c604a5a9a0", "indicator--f11b8235-5862-409b-8c9e-64bab55f98f8", "indicator--53d3b69f-a721-44d3-b9b9-6f604145c88b", "indicator--18fab03a-21af-4a2b-983b-6b611a74d1e6", "indicator--876a8c4f-ae2e-4e06-bce6-89d7a19f0cd1", "indicator--89ead486-43de-4c07-a2c9-a3f0ae5dce24", "indicator--d13d071b-9140-4a6e-8a53-26fad148af6f", "indicator--3bf23852-ad67-4abb-89f2-df1678726236", "indicator--c3579fa0-647a-433f-80d0-4c8686a940ae", "indicator--66ca3c5e-b42e-4982-b352-911744baf6c8", "indicator--64fce084-55cf-4143-826b-bfb4b44665d7", "indicator--f010b443-c2fc-4aa9-b4bf-d96426fbe93a", "indicator--0e37a7b2-6eb4-4d8e-9d7b-45446f339745", "indicator--617bd05d-6600-4bf5-8025-bdc5f938205c", "indicator--17bcd118-8259-4b04-9b9e-4feeca1fd6f3", "indicator--3c19ca02-179b-4f43-ae2c-d051068ac0f6", "indicator--d9a11276-3e7a-4ebd-b60b-9ca6dcd026a5", "indicator--a517a0f1-0ffe-42c3-b965-de1a7907ea02", "indicator--7256e5fd-97d4-4150-860f-70ae9be486d0", "indicator--612e2d17-0462-4842-8d26-13cccbc27bcb", "indicator--541b6cbb-6635-4fd3-8c27-3745dc6a4b3c", "indicator--b2cbe4b4-6fe9-466d-8fb9-c9ed3c9c3f9c", "indicator--cfb1afbc-e438-4d3b-bca7-0e0df3e34673", "indicator--2b5580b2-38b0-4c2f-ba08-6d6f72cf8842", "indicator--7148a173-6fea-4263-a457-68917d1e9e06", "indicator--9be01e54-db51-4b61-9aad-94090e0accd1", "indicator--ae156ce4-953e-491b-8a7e-699e5f62ff7f", "indicator--e073b8cc-c286-4e18-b1be-44b3e6fe3dc2", "indicator--71a9e588-fbda-4765-b7f5-be01bb753836", "indicator--f1217a07-392d-47fa-a4e7-f57e01c5978a", "indicator--b761f65b-54e0-4464-b5e6-24d6b03efe4f", "indicator--00bdfdca-3798-41de-a7a5-0952dc469bf0", "indicator--6b406bbb-4fd3-4fb6-ab15-f20237c3e815", "indicator--1d806389-c1d8-4611-b370-ad5c0f3c3ad8", "indicator--37bd42ab-6602-461c-8fdf-1d5493841280", "indicator--51c90bac-540c-431e-bd22-f60b443ce651", "indicator--8ae01f3a-9508-4b75-b87e-44ae6be9c78a", "indicator--c421f9d3-db5b-4eea-b06d-384cfe6c63a5", "indicator--e1caba54-f9e6-4e34-9b45-8148f4fbb656", "indicator--9d8053fc-ef40-46c3-9b93-a3a2a2181e10", "indicator--b55b57bd-bf6c-4fc9-ba48-eb39617e8fdd", "indicator--a62f121b-6b04-4d39-9890-8e2806b5b203", "indicator--42099b30-9509-42c7-96a0-90c129d5cb69", "indicator--c752331b-8529-4112-a590-3153898f415a", "indicator--d69cc4e7-76b9-43b4-b996-6b19db6d60a5", "indicator--7174ac05-ca59-4824-a9b2-2adcb3e44d81", "indicator--9afcb452-1b0f-466f-ace6-c516bde4a288", "indicator--20ed8428-25ba-4f51-b620-9ae93c300c6d", "indicator--5a8ea976-2a83-4eaf-ac71-b64b9f1b70df", "indicator--bcdc89d7-6623-43a0-9680-0b3c2868f53c", "indicator--1a1f174f-4479-4cf0-80c2-ab213ffe6014", "indicator--2085c2ac-d815-46d5-adae-53785852318a", "indicator--21cda204-57a0-40b3-8e0e-00233bfcc4f0", "indicator--ae05040e-2982-4146-a9c7-e435001f2d60", "indicator--2cb18525-d7fd-4029-a018-cf9e34658ff5", "indicator--da855aa1-0683-4a4e-bce8-4aa2153c957c", "indicator--6176dae1-3da2-4e49-b8c4-7c7783f846c5", "indicator--4bb9f3aa-b849-4fa2-ba95-180fa7160382", "indicator--5a6c82f1-6cbb-44fd-af9e-ad005ddf3737", "indicator--bb4f2de6-871f-41fd-8feb-e1634329effd", "indicator--f9a65e9c-ca8d-41cc-ac11-3c050f444bc8", "indicator--471448ab-5555-45b8-a4d4-4406e39ee9a1", "indicator--53df2494-eb3a-4fef-8943-e8e22c1ca213", "indicator--6a496245-5209-4514-aac7-1e6d372e0f4e", "indicator--0e8433e8-9459-42cf-a959-dd09d38e659d", "indicator--bcfab6d9-b27a-46ea-9c8b-2d359249c644", "indicator--4b8589a5-950c-4fdf-bbd8-a9b03d7b0ebe", "indicator--25dadf30-7f10-4c68-9a7a-824028b7e890", "indicator--51a72634-860f-4bc1-8d0d-f6a597595424", "indicator--c1268ebe-725a-4935-88ed-819d610f2f21", "indicator--dff61b4a-0a2b-41e4-a24f-ca35bbba25d8", "indicator--0a94bd68-86d4-4fe9-9f02-c6a207995cac", "indicator--7449e53a-3dc4-408e-a7eb-a3a3fa07d16f", "indicator--bdaba15b-a215-40d6-82d0-a82c651a4095", "indicator--98f6f53a-c1de-4d83-8aa0-1fa35d88870d", "indicator--cf0ac277-640f-45aa-b1ad-865bdad4bd41", "indicator--dc5ff837-c422-48a4-b8f9-5d8c7dd72ce7", "indicator--796d1875-9a53-424f-9963-f09cfc479848", "indicator--d6f94738-b8bf-40ae-9b6e-a4f7a330bc4b", "indicator--5297d3c2-66a3-4932-b0b8-d92d2509626c", "indicator--e06ef958-6b0c-4cca-afb6-8e77176ca49e", "indicator--56de1a4a-ad30-4c4f-882e-1d8ab6cb858a", "indicator--80a22c2a-75da-4998-bac7-56bd4972726e", "indicator--8df4c8fb-a496-4d69-acc6-59bb9c8a8df7", "indicator--521104d4-88f8-4a0d-bde1-1f7a7deae50b", "indicator--a3a3c152-3975-4137-82c2-3bac0a4a4fa6", "indicator--7a9ea7a2-4f0c-4eb2-9a01-48e206b5b28c", "indicator--bb8274c3-d646-4c48-9831-e0575b748916", "indicator--79ed384a-95a6-4333-834d-8043953349f9", "indicator--cc94f94f-1dc8-415e-b35e-8be13ef4fb3b", "indicator--a9a065a8-d8a4-46a3-ab9f-373522d14988", "indicator--c7a53e4f-990c-4dcc-bdbf-3aebc8d78b41", "indicator--4f845176-c252-4a9f-a0c1-f10cf594ed00", "indicator--aebaab7a-3567-4d48-b371-10947a976b67", "indicator--65a1ab21-15b0-4846-982c-f1534210efb7", "indicator--022e0fb8-fef1-48aa-bdee-a1f069fd82d8", "indicator--7a538c7c-4159-43d3-ab09-94e04f9836ca", "indicator--9d65d8b1-93c9-4587-8197-3084c2490b3a", "indicator--43c6d3e7-2440-4b77-9265-2285a013c855", "indicator--fda23777-749b-4675-89ee-a9b0adb7bbea", "indicator--6f84cddd-569b-4a9b-a8c7-555c5a9f43aa", "indicator--8f7d37cb-334e-4159-8285-ab4a2af34e98", "indicator--4e1d9fd8-4f43-48d7-8f45-7f5b918fd965", "indicator--17709bd9-cd92-4864-af09-43b9d9faf042", "indicator--80bed91a-c231-49df-b23e-85f8c27bb8fd", "indicator--b6b1e36e-9c78-4b3e-906d-0273c9ecfce9", "indicator--1018a6f3-3d7e-4545-a334-fb41b97a100b", "indicator--88150bdc-51e8-4436-a987-03d56489ed99", "indicator--e2005034-988f-4ed9-8a5c-8e2d8a876f49", "indicator--431558c9-c0ed-49ac-b340-30c96f32c450", "indicator--12256ba5-e030-4c1a-84e5-98d017bae38c", "indicator--a3302ece-6945-46a2-b40d-1af263e0d6e5", "indicator--b072a833-452b-411a-9ea3-6ab3688fcf3f", "indicator--c90d6f4e-61fb-4533-b1a9-8606caa09086", "indicator--5c2cd883-c4a0-410d-92c0-c8f5a8b82f76", "indicator--4d96beef-76bd-4c6b-b0c7-701c6a90ba9c", "indicator--ed73a12a-924d-444a-b343-8417c4d31b8a", "indicator--5e61059a-4d5a-4783-8e31-dab68554cf2f", "indicator--0a06f6f8-8dec-4143-a61d-05ffcf331a8c", "indicator--d0cd274b-130c-4168-b741-f191d2fc16df", "indicator--d3cbab31-1f37-4d3a-9fd4-2d0d5f39e5b9", "indicator--243efc51-8c63-4cad-8d14-8f241eb6f097", "indicator--ede34486-d523-41af-a668-10bd89a90006", "indicator--de90d0c9-d51d-4f08-b6be-9b4d4f5ba53c", "indicator--e5ce979f-7260-4e6b-b3ea-6469a0797112", "indicator--226097d7-6eed-409f-bee3-ffd1b5dd0a70", "indicator--15773550-b252-4cd7-898a-82300d731220", "indicator--e7b961d3-2e06-4a8d-addf-b1445d905223", "indicator--64f51497-9627-43de-a03f-0d688fe110f7", "indicator--94d92d1b-a7f5-4127-9a8a-9181924862c3", "indicator--b92ed5a4-a456-4508-8d39-e35b70f53ec8", "indicator--227cfc4b-41ca-41e1-b647-72648de3d5c8", "indicator--a1599739-c65a-4f2a-a439-5e8a6157dee2", "indicator--275952fe-e375-4b7e-8b7c-5cd37e90a9c7", "indicator--68bbc23a-5858-4133-8030-f145bd6bf687", "indicator--12f6bdf5-4269-4b6d-ad91-7d3735125d0b", "indicator--895b55a1-4ca3-4f63-b8d5-47b107072a1c", "indicator--14394a1e-fadd-42af-9931-d9f973458367", "indicator--3590b67b-2072-408c-8d29-081ad8d0c220", "indicator--71964c82-de32-4839-97cb-277bbbb248b7", "indicator--8efc3bfe-eb70-4eb4-977b-0c15ebe3d0d1", "indicator--2b61f927-deff-41f2-8982-cebad9c45fb3", "indicator--275b491d-643c-40b1-8ede-ab3018af8397", "indicator--5692cd73-583a-42b5-ab89-333caa1a3268", "indicator--77de6173-c3b5-4780-90d0-06dc1d5a3996", "indicator--1cbb18b5-a28a-4d6a-b6be-d641da914133", "indicator--cddb4dfb-1189-4776-94e0-6b09d1e1b288", "indicator--76dfa204-e584-4829-8f16-c889b393e694", "indicator--405d0d95-bc01-4efe-bc63-1e42539d6f09", "indicator--86e27fd3-c172-42d4-9125-90cb7bfbccaf", "indicator--0d074dae-fce0-4478-acba-5a649cc6cb60", "indicator--ef94cd51-f2af-4772-b301-acacfa84ff63", "indicator--19b6c5a8-fc82-4f69-89d2-e309f5f9fcdd", "indicator--340a79cb-48fd-409e-acf3-d312cde2bc94", "indicator--8c7ba5c6-2514-4781-aca2-16c5510eef44", "indicator--f5db234a-9927-4137-9346-1c9f34707259", "indicator--7f2fb946-1551-42cd-8ae4-81183ec9c805", "indicator--d476f214-027f-400f-9344-f5de2c30fcce", "indicator--09f9d28d-42dc-439c-9d9d-121445bf87a9", "indicator--4076750d-cbf5-442f-9a93-081c41a76f72", "indicator--e1fa7067-1b21-4c21-9b21-c4fb98c9cfe6", "indicator--aa966f10-39ff-43f8-86bc-407430913756", "indicator--13aff8dd-06e3-4e02-956e-3f79629d7c95", "indicator--a5f03280-e00a-41f4-9e80-7d4f0eca8db8", "indicator--80f7ba70-d458-4cfd-9ab3-36df19380e30", "indicator--1bad2697-6269-4a39-84e2-9fa564750700", "indicator--b5c790ca-9d78-481a-9c0a-e8e15437706a", "indicator--61d31077-121f-45cb-93a9-ed7d8bbe0fac", "indicator--1227b27f-f4e3-415e-901e-c394589ff132", "indicator--76c918e1-e4db-4954-b917-910c9efb2a74", "indicator--d1cce385-2440-416f-9c13-9b924eb6e284", "indicator--0ec82e00-ec6a-45e9-a175-f40fcec7520e", "indicator--e337c870-9d0f-4b5d-a3f0-9ea259feef0e", "indicator--037a6c2c-d86e-4bb2-9535-870145933ea1", "indicator--c5cb70ac-fdeb-4a80-b09d-0495d166eb47", "indicator--1630cba4-ae2d-4be2-916d-22a0aed43817", "indicator--74d3e680-ad2a-4abb-a5f0-1541adcc739d", "indicator--ad7079b3-0f38-46c8-8936-fb4dd5cce9ba", "indicator--a431079a-5a42-460e-b470-1dab3bb31f0b", "indicator--62d32230-e708-4b35-8dbd-dc324806e83b", "indicator--b4fb20a1-22ec-4a2e-96e6-18271b54a7f3", "indicator--3b52f166-7c66-4566-bee0-8d8784bcf5b1", "indicator--99f42cce-40f3-4133-a739-031610007235", "indicator--969bd37a-23a0-4e7c-9b7c-4c81920e5c90", "indicator--f7776ef8-b821-45fd-a163-5b0f33214ee7", "indicator--5deb0966-767a-419a-baba-f2763f9dab7b", "indicator--50c51974-7f11-4892-90aa-b0a896c235f6", "indicator--e83d9bc9-ef94-42f7-af4b-9eaa5ffb94bf", "indicator--7f5ed339-a48a-4cad-8c76-5efdff24078f", "indicator--bea13738-8270-4db0-80be-74c3491a1662", "indicator--7e35c9ec-b5a5-44e2-91e3-409d23b265a9", "indicator--088defb6-0c43-4748-a892-18d9030d3eb0", "indicator--eba5904b-f42f-48fe-bd73-81e47b8665f7", "indicator--9482ceee-6b47-4c53-8f0e-ea30d3c1cbcd", "indicator--4f54f756-d5ba-46e4-821e-9e4acc17e77e", "indicator--222c2425-328a-4f24-a1e3-52767a16850e", "indicator--4b052ccc-8962-4f31-876a-a1adbd88631c", "indicator--15540df1-c6f6-41c4-bbed-a2a588c36720", "indicator--cf570b7a-63c0-4a60-8d2b-1f31cab4a317", "indicator--1374e76b-6ad6-4b67-a195-e669092830b1", "indicator--b9cac40a-a799-4ed0-8fb1-f6358896fbef", "indicator--5d47091f-d286-4bec-aee2-621dbb8c6a6e", "indicator--e0f4dff4-5b5c-4e28-94e6-7d7b9cd835ba", "indicator--10a6232f-047b-488a-b68f-1d9ff26da7d3", "indicator--f369a04e-1caa-4dd8-a3db-9aedb8f26427", "indicator--4187e59d-c9f3-4cb2-8afd-0440207193d5", "indicator--096c5164-65e1-4a21-bfd1-a2842cb501ea", "indicator--d3c91874-86ad-4cae-80f8-838f15a10307", "indicator--44c73da3-85b9-4e0e-9427-1c8457dcd92b", "indicator--5ec3886a-b9b7-4a5f-858f-3957744384c7", "indicator--1fac6575-062c-411e-a544-d35ef8e02343", "indicator--1d7308a7-11e8-41a8-8014-5b2e566629dc", "indicator--83332f6d-75c2-4069-9a76-3f3768b36f81", "indicator--1daac13e-6f26-4967-befe-34bac2ce5086", "indicator--642620b1-4ecd-40e3-9fad-f8db4ad51bee", "indicator--9c565c2c-b705-44a8-bea8-436e9d7a1ed9", "indicator--84e51216-ab4f-4117-a672-f2be5b36b03c", "indicator--96129340-276e-48b2-9c40-957a0a6607bb", "indicator--c0eb2252-2c6a-4dbd-9186-e5f0ad769a5b", "indicator--0ecbf9a9-cb97-49f2-a858-c4b46e855394", "indicator--534508d1-388c-4167-99b3-984283b7d928", "indicator--2734df3b-4628-4587-a7b5-96565804b5ca", "indicator--8b3c86f7-bd51-45c2-984b-f7210cf3e82a", "indicator--6f4f4525-a845-4849-ba1f-b766cf219665", "indicator--d0258449-aac6-4313-b8b9-3115307dcea3", "indicator--1c7d05b0-df21-4697-b5ad-742673565186", "indicator--d8c91456-4e64-4411-9376-da8d4ca3b618", "indicator--bfec2464-5f04-4291-a65a-eb2dd9d479e7", "indicator--41c617cb-05a7-436a-92f5-9db42b720647", "indicator--0230ff87-5a6f-4f14-9eb0-95d78c622493", "indicator--15d102ff-6bfc-4b97-ad05-341f8d3595aa", "indicator--40e52e4c-765d-42b2-952e-c3ed46153ff9", "indicator--e46cbe4d-0222-4b78-a4b3-ca75bcdbf5b7", "indicator--04e1eca2-9d30-4c94-b24e-c5467e42c1ae", "indicator--a45c0f00-1d9c-4d5b-b5c4-3d5d6d57da04", "indicator--1f2b9240-9d3f-4b9f-a47c-c14bcc61a4c5", "indicator--fc7a3a2a-c50f-4abf-9998-823f2638054f", "indicator--009500ac-78be-47ed-ad73-d0974211c40e", "indicator--3cff27df-de2b-4032-a154-90d910877f5b", "indicator--5960f34c-f94a-40d7-ac7a-67ab83a616b4", "indicator--9094f308-b91d-4564-a9e5-027a640b3095", "indicator--c3bef2f8-d7b1-43f1-9292-0cb550ef5d3e", "indicator--25c3560c-2fa7-4889-8060-e5b5de8a429a", "indicator--0383f967-e79f-41d3-a231-a2a537f98222", "indicator--aeb26622-736e-4390-9d10-669a79ff228e", "indicator--c5b10c84-5389-4678-8ffd-943e2b6e1fdb", "indicator--52422ecb-8301-4ff1-b80c-fa80654dbeb0", "indicator--32825a4f-0447-4a74-8cef-c7b82c943996", "indicator--41cacbd6-46b1-402f-9b98-be80e7d37ab4", "indicator--7ce22869-46b8-48fb-94c2-039010e32575", "indicator--056d659d-8543-4993-bd56-ce49a88ee338", "indicator--a4a03059-3e7a-46d2-8a53-295fb4e74508", "indicator--c9eb4892-b392-4750-908b-76be34a17903", "indicator--3fb2510f-b8a8-4c56-ae0f-fdd52192475b", "indicator--6a8a36b6-5a1c-4738-85a2-5199a9f4f40f", "indicator--7a3b68f2-0e92-46df-8045-0967891c7861", "indicator--b446af34-df1c-425b-b39f-3c212576400d", "indicator--d49c01a6-9fe7-48f7-b65c-9e2b961e1cc4", "indicator--c1288ae7-b53c-44b1-8bc6-9ade73396668", "indicator--c0adbbc8-3bc7-4b6d-a921-215b13994343", "indicator--2c1206b0-1c4e-4da8-bc8c-7799b2645107", "indicator--e7279239-a613-40f5-b08c-657353d9990b", "indicator--083e945c-37dc-4657-ad40-10385fda57a4", "indicator--56853dd6-835d-4150-bae1-0a18164cfc7c", "indicator--d2581cdd-cbf5-434a-acf2-7c8c7b6509ff", "indicator--1f7bb9e6-49fc-40e3-afd5-42dd5df6c01b", "indicator--dad05d51-78b5-4b43-a771-adcdb2949e8d", "indicator--f09ef046-fb1e-40b2-872d-29c13cddfb13", "indicator--2461d5ae-1c0b-42f3-a746-cda44d2aa247", "indicator--5056fcc7-15fc-41ba-82d1-1f9908a3314d", "indicator--4329167c-4daf-4bda-a444-6e1aa591c557", "indicator--397effd8-4bb2-4285-8bd0-8d5e100c3aab", "indicator--e3ffecd9-168b-42e9-8e14-03d33056e7da", "indicator--4f3649cc-9da1-4098-99b3-33da1db54caa", "indicator--b5aa50f6-14d1-488e-b88d-b80fdb5c489c", "indicator--b93bdd4f-88a4-4d42-b3b0-6d0f127110eb", "indicator--58127fe1-73e0-417c-b591-1aefba51d9f2", "indicator--f5e72856-01f3-4427-b79c-85444afe2d1b", "indicator--874ef453-08e4-4881-96d2-49b32acd5d06", "indicator--224c3ee3-ffd9-4774-bfed-c1423457ad19", "indicator--7aac72d9-4356-488a-9b12-def9e5993f0d", "indicator--1cfa81f4-60af-4198-81e5-16558ecf2ea9", "indicator--d45846ae-7040-4ef3-a757-243bfe2d37ce", "indicator--3bee20fc-354b-43cf-984a-036f90af5292", "indicator--63650f8d-395d-4348-82d3-74b0cbb5e3b9", "indicator--25bf5208-a3ce-4e9a-82cb-7a7b23018086", "indicator--8aed2def-6a8a-4bce-9adb-4a0a9723db63", "indicator--65634180-857d-4d7f-9b3a-7f9d651fb135", "indicator--f7a11423-de4a-487e-9d60-301538655728", "indicator--68d3d8b4-de35-4c5a-840e-78d7bfe1f155", "indicator--4425365d-99cd-4035-b26f-b0711bea3a2f", "indicator--a30e2fc9-f41e-4fb3-b8ee-cf15271477eb", "indicator--1a1c3f0e-a377-4f38-a07b-06b154e4ff5c", "indicator--d721ab45-dd86-489f-bea5-9855c36dcbc4", "indicator--c7b0c9e2-48bd-4f14-a478-aaf8b4fc2c73", "indicator--2a036b10-229f-4f9a-abd1-b5ff5937ae83", "indicator--1458e26c-e93b-4932-98d2-0dd794f5021e", "indicator--26db0d8a-f435-4ae3-876c-59e67262c61b", "indicator--ed4d9675-42de-4ef8-b9b4-ab6b2a30a778", "indicator--49e003f0-6375-426d-ae1a-9002d1aa0450", "indicator--4bfb002f-c1be-494a-927c-06cef7da920a", "indicator--898c5d16-69a6-4499-865d-d574c1b5447d", "indicator--3226fbe1-4199-4475-b1cc-8bf1edb76934", "indicator--c0f09533-0865-406a-8ead-0660255ccb69", "indicator--f41edb3f-a491-41ed-8442-95d29b281972", "indicator--16c40a4a-a1f1-453b-9329-ac4e5899877e", "indicator--c007e442-7691-4a21-9967-81b760a728fc", "indicator--261ebf77-910f-4981-a933-295dce2d86ab", "indicator--f268bcf1-acda-4cec-bd55-cb8e404d87ca", "indicator--3b20261f-b5c9-4960-9f3f-65933a54d6cc", "indicator--51c4b178-8127-4f0c-9e37-d6c1bd21199d", "indicator--40b36f57-19ce-495b-9836-55189819631a", "indicator--632e3f4b-9178-487d-920b-cbfa06937145", "indicator--c56155ba-1e02-44c5-b61c-a6f8981937e9", "indicator--ed550a38-3815-421a-b3cc-7a472c8018b3", "indicator--947a3c00-86eb-4bf5-88ec-42a43a8deac3", "indicator--d56a5132-8c75-4fd8-a1ce-1a892f1f2db8", "indicator--588fc6d2-940d-445e-b602-19aff4ef158d", "indicator--f8fa6b46-9e4a-494a-ad26-854690993dd5", "indicator--48002e97-93fa-4f23-8aee-83b7052ff269", "indicator--49cddc0e-8560-4901-bebb-3d60d2b148a4", "indicator--aa04705c-90c0-4506-b78c-3474c2a28861", "indicator--95821586-5785-44f3-ade6-477bdd74e8ab", "indicator--09de7537-3625-4834-b1fe-e49bed7399ae", "indicator--6baf603f-2ab6-47a6-bedc-ab71507fb03f", "indicator--2e42336f-756f-4ff1-ad55-d571d48aa184", "indicator--2234d5f1-d6c0-43ea-a20d-cf87a8954c78", "indicator--d11d6226-afb5-44cb-8fb8-26d9fd7df6d3", "indicator--181951b6-9637-405e-b9ea-a38189ab4263", "indicator--aee351a0-0071-4b2f-ac79-17ba65a19e5c", "indicator--f8b85619-a3dc-44d5-889b-bb547e51fb38", "indicator--79e6d8b2-ce51-442a-a919-c7e1c5de7390", "indicator--48b0bf9c-3c8a-42a1-ac13-9bb20944edc5", "indicator--316c376b-515a-476a-858f-29781c96ccb3", "indicator--28a54dff-90d8-47c2-babb-34c20b027c2e", "indicator--dce3e294-a1c1-41ff-a078-55c432a80407", "indicator--f7c84f68-f2c5-4b1d-9ad0-8792a949cedf", "indicator--b12eff3f-2a50-4c1c-a3a9-8a27cc479fda", "indicator--5a7fcd21-556a-40df-bc6d-038bc0445de3", "indicator--47259a2f-0ea0-4ba9-90b7-2403c6b224bf", "indicator--219d9f1f-5ce5-471e-b896-0f11ec8af9e4", "indicator--49c6b041-55a4-491d-9b0f-478108da0d3a", "indicator--1b8f3fb5-2744-46e9-b61f-abfebcfb1a8d", "indicator--480f06f8-890b-4894-92bb-fca8e7d78686", "indicator--534334c4-8d06-4e50-8084-548cfb761017", "indicator--a7d66e7b-38cd-4fc6-866d-2193d2451b36", "indicator--3885955d-998b-48fd-835f-98992625f24e", "indicator--035c26d0-401b-44d4-a6be-441cef11033e", "indicator--a68e38c8-35bd-415a-8c59-8b87ac324680", "indicator--acc12193-f6ca-4985-a70c-27e9ab4c3870", "indicator--40f29435-40e3-47c3-bd4b-f3651a5c194b", "indicator--2f5cd1b0-aab1-4a27-a20f-678f5545d712", "indicator--88f96203-c64d-4bed-a6b2-d6f8dda9a38d", "indicator--5a2c1afe-d1eb-4311-a1d2-aea794bd43d9", "indicator--fb140e71-6cde-4d9e-99b8-0f803adee57f", "indicator--ef8a4a10-c1ed-4315-b1f3-6333ab15954e", "indicator--2ba19f73-f5c5-4e85-a652-919768d31616", "indicator--f08bdb54-94d6-452d-9eb8-15f0562ca682", "indicator--8fe1b9da-3b30-4b92-b06a-f64ef15229d2", "indicator--4714215f-afa6-4bf9-af12-baf07cddf3c4", "indicator--dd2b30c0-b673-44f0-88f9-aa0e5150754b", "indicator--26ba232d-1151-4fd6-9c94-5b4dbf9a0a2a", "indicator--47542150-7a7b-4085-9a8a-7f7fabcdd502", "indicator--bf4a62a6-6a4f-4ec3-9a36-c2dd4520d3b8", "indicator--a59084b1-7741-457c-9cd0-6505e9d11795", "indicator--81a9d109-fc05-4069-8b2d-c3c1bab808fc", "indicator--4b6b6b6b-d64c-4ce8-86f5-dd96be7daa9c", "indicator--79feec42-46f6-4c2d-afce-17f0ed07937e", "indicator--ee547e7f-03fa-45a3-aef0-56646996898b", "indicator--8ad01898-7cc3-4748-83af-14cb228bb301", "indicator--4370af1f-3c99-4065-a688-432df3518e4a", "indicator--59223d13-2bbe-4e1d-86e4-fb105406ddc7", "indicator--6752fdcd-5885-4ee3-93de-ef35e17fb212", "indicator--04db8469-4fce-4b2e-9563-c20e634eef78", "indicator--f1ac4fb7-dd08-433d-8cad-571cbad35aa4", "indicator--7648dfe5-90e3-4449-85b2-346b1e06b7bb", "indicator--25f6b61d-6f9b-462a-8f93-22228fe7dfb6", "indicator--54fa4027-59e3-435d-b743-a4bf6fe030f2", "indicator--015c1137-77b3-451d-963c-8ed715eb8321", "indicator--f2ab6cfe-ac6e-446c-bbeb-fb652e304f85", "indicator--6b0a479b-f7a6-4044-bb27-5962064c4db2", "indicator--a2737b14-9f38-4ddc-bf1c-1b3c55455282", "indicator--b65f0584-c94a-4b0d-91eb-7ff2e3555a53", "indicator--e82f88b2-cc7f-445f-ba7b-bca1b46ab295", "indicator--5c780f42-9a20-4963-98d7-e7629e4c0e5c", "indicator--7e7bf45e-a58a-4586-91cb-af9aaefdcf69", "indicator--cce4daa9-7803-4830-96cf-ceee2289375b", "indicator--1afb4632-73c6-4f24-ab40-f8a7130f748b", "indicator--86e601b3-a69e-49ea-9ca7-aaf1bf4707c6", "indicator--3846edbd-4ec7-4ce5-93e8-6bd8ca666221", "indicator--0a313795-162f-45a6-92c4-4379eee41fed", "indicator--02a58d6b-c24d-4816-b46c-cc1de069a6fc", "indicator--d4ad0f43-c841-496d-8620-8978e988639c", "indicator--5e9dd5ca-f813-4162-8e21-6d397e028c3f", "indicator--b6ca52f0-c753-4aa6-bea0-996459eea195", "indicator--02ceaaef-6815-42bf-8e6d-2f5b15b82810", "indicator--5f3d357f-8ee8-43b2-a81e-147192afde8f", "indicator--a99f7f6f-5e73-446e-9b7d-98a48025c214", "indicator--cf7776ae-3902-4cdd-bdfb-5cfed223110e", "indicator--ebe116e1-d551-4860-9d01-5f368a741757", "indicator--806815c4-3484-4d61-acb2-e948f052f4ff", "indicator--dc78ca56-92f7-477e-834e-7f8665d4f37c", "indicator--cc0baeea-c6e3-4b4b-bf99-8a27c0478f49", "indicator--6bd2bd63-7f9c-4ae5-bf8b-d5a1934e1c9b", "indicator--867bb80f-ae67-4fc9-88ee-aca625c3537b", "indicator--7e70bbef-9b9a-43cb-90f2-1fb42a0e5b05", "indicator--b5b57f26-ea20-406d-9f6b-cccf364ef215", "indicator--c78240c5-c79f-4182-97fd-c3b6eba36fa2", "indicator--9e0b0c10-8715-4737-a3a3-df9925ebdc4b", "indicator--99ca6a7d-78b6-4872-8e47-7240da55b0fb", "indicator--ecb30146-fb8b-4ead-b2dd-63bad1eea6db", "indicator--f16fe1bd-c8c7-416c-a1ae-761d88ab5cec", "indicator--d0aadfda-0681-4d10-8542-4e587d3151ca", "indicator--54163131-0b06-4622-8692-fa4ec215ec60", "indicator--de6168b8-3168-4f1d-93f7-f72c91903e35", "indicator--07a6e8ef-cef3-4267-bfec-9955953a26b8", "indicator--745ff4da-9584-48bf-b5ff-cf85072d7744", "indicator--893b2ee2-a7cb-41db-97a1-2e10fbc3f8be", "indicator--a3963bed-fddd-4fd7-a7aa-5698181db7b1", "indicator--2c949a5b-f59e-4f23-984e-062f72f28110", "indicator--05a29a5f-3750-4324-a83c-a5ac51137d49", "indicator--75631093-e25f-4aec-b66f-3ff58c2b61fc", "indicator--2a7ecbcb-387f-4488-a0e3-e83da52edb10", "indicator--ae381806-3a28-4477-9cfd-51e0e723db3e", "indicator--ba753104-7747-4726-88e2-5f9422662965", "indicator--4451a46e-74c0-430d-b609-7e416117638f", "indicator--e54f791b-0e9a-49ba-9087-9cd4d0d8da23", "indicator--b310605c-244b-46aa-a238-4d15a13378b7", "indicator--450034a0-4a3d-40f7-bac0-ce751d254de5", "indicator--d44efbb2-018f-416f-9d41-23ecfaa6a0bc", "indicator--31d5a240-b188-4347-a9a1-e867c9579fa0", "indicator--dde6c294-bd0a-428c-b8e6-4ea83497a9e5", "indicator--0c1480be-a7b8-44b6-a80c-04391c70a596", "indicator--e38d809f-8f29-48cb-ae5f-310511406896", "indicator--09611f9b-e82c-4551-9584-986185e884a1", "indicator--5ef22e81-b7de-4861-91bc-c855e1985f58", "indicator--7763008b-a7a7-4e10-a9df-61121da6f66d", "indicator--646a4883-5cd5-4016-a43e-55ee3e3acacf", "indicator--ff6bfe4c-e8cb-4f4b-8ad9-67899165c272", "indicator--a8623b54-d0a6-418b-bbdd-adf1aed5a911", "indicator--31f7298c-f837-40c5-96ff-b6982092ff46", "indicator--e25754e7-c02f-4df1-bd2e-1b964ad0f100", "indicator--5a1ed725-d7f4-41c8-bbfc-ef03d71a7ba1", "indicator--4803e44e-a892-4793-bd9f-5bdec4ebc74e", "indicator--b3cce005-5a83-4b1d-97d2-b45b459984da", "indicator--83f54295-1e59-4473-84be-58fc295d8b9d", "indicator--0afbfae0-92b6-407c-9265-95c3c9072211", "indicator--6914b026-bc70-4597-804a-7b0b9ffee3da", "indicator--5f6813f5-943c-40e5-a0bf-5c869d23d556", "indicator--e4459788-db52-44a3-8b5c-cc17babccc73", "indicator--34a4a8d4-7a2e-4dfa-8059-5e4f7442c82b", "indicator--5ad29fc0-d2fe-4c45-a5ed-6487f5dcc9b6", "indicator--8c9ba414-e099-4473-877f-b3a37b8112e2", "indicator--6a6b24cf-d71b-4c66-8766-fb43520a8f8d", "indicator--bb26b4b8-a7d0-4307-9c8c-7e1550b91eff", "indicator--f29e51e9-f96a-40ac-a386-50ae5e8dfab9", "indicator--09a27cd8-ae58-4273-8ebc-8c9825233b2b", "indicator--9d7ed037-6932-47d9-93e1-f827519c4b14", "indicator--7f11c6da-4bef-4ce0-8cb5-c546e228980e", "indicator--56480d92-2f5b-4417-aa75-4ec648b67091", "indicator--63e36571-c61a-4a6f-9db5-0391f4065072", "indicator--2871de6c-d8cd-46d7-90a5-f05b98eda862", "indicator--1afc64ab-307d-4f4a-8629-f9603851cae5", "indicator--5c8fb3f9-add4-4db8-ad75-529374e5735c", "indicator--3f2f55a1-7af9-416b-a2e7-10259a9e2618", "indicator--89094d48-b6a4-43ac-b038-9398914236c4", "indicator--1198bb9a-abdf-47da-82be-6f0008f32adc", "indicator--02f92268-f5e5-423d-a6d1-258139f558d9", "indicator--44e4d624-9d65-4e5d-a44a-543241fb401b", "indicator--e0b16b9b-a382-448c-b2f6-b5a8e6ee1ace", "indicator--56b51ab4-e464-4243-be5d-fa207d1a2987", "indicator--5df7f4f4-a236-4550-878d-a1b04f1e4114", "indicator--ac4b308c-becb-408e-8f7f-ffa2bba86762", "indicator--cfb77a1b-3ffa-43e5-908a-78ae338e86c6", "indicator--3142f843-3a16-4f19-aec0-b720571b2bac", "indicator--411bb5c9-dd1c-4140-8e85-99f8e05b3a60", "indicator--c67ab225-4237-4890-88b6-9c70e7ee82c3", "indicator--78433a31-20c5-434c-aab5-a5db59bed220", "indicator--506a3980-be6b-48c3-ba62-66d46d0da3e5", "indicator--f697129a-0d55-429c-8a38-e7ce067848b1", "indicator--e122acd8-1624-48e0-b6cd-35818d31b644", "indicator--aa3190b4-9866-4194-95e3-2d031929f732", "indicator--607445f1-c71d-4e5d-8f2d-c57955b51226", "indicator--deb10dd4-6740-43d8-98a9-ec12ae6eb614", "indicator--5e46b6d0-398a-4b4f-8ffc-0b2dbd278b21", "indicator--fa165925-55cb-48d5-9db7-fbe8f25c66a4", "indicator--e1eaef13-385c-43be-89a2-202f92a1e01f", "indicator--21be1101-3bb2-465b-9c7c-c0bf05b95149", "indicator--2e736517-0a4e-4bb6-bbd1-f1f31181aba9", "indicator--a549c93b-e7c4-4c37-855a-541256700496", "indicator--b60f64f2-6306-4bca-9498-a07ca1d9cd93", "indicator--df3cc6d1-0d59-4537-a94e-707346f719ee", "indicator--790a6121-e85d-49a6-8311-dfcb548018a6", "indicator--1ad25842-9efe-4aa4-afca-15278f7fe13d", "indicator--d385eff8-8563-4c0d-b603-05ea8da4c60c", "indicator--7dce961d-c5d5-4028-92c3-48856b43ff2d", "indicator--3513328b-db62-46a4-8487-98a711dd1d22", "indicator--d2cb3ae4-2627-400e-8d49-5e31bd920c98", "indicator--14b037f2-5ebf-413f-979f-dd21d4599b44", "indicator--c308a88d-9041-4950-86cb-264ca79517ae", "indicator--3e9ebfc1-bcdb-48d5-94a4-f5e531909bcc", "indicator--5678ca8a-1f79-449a-b419-e890054c013f", "indicator--0ba78cca-0252-41fa-9119-d484f597fa2a", "indicator--204aae90-7100-42cf-93fb-6508e50ac9e4", "indicator--ac5c7a46-3449-49f7-b523-2714b07e73bd", "indicator--8f3bf0ee-04f2-494f-be57-ebd92c7cc812", "indicator--967fdc4b-3172-4e2c-9248-057d42bb7704", "indicator--36889021-6273-450f-87a6-2cde71fb9937", "indicator--7793f399-fd34-4fd1-bca5-02a287f200d9", "indicator--bd6a2b6c-797f-40e1-ae3b-6cf4d23b2f37", "indicator--0fb01a3a-7f4d-43cb-84fd-f2fa2b9f89b6", "indicator--e68ec8f7-e3c4-492d-8e25-0ae1ed8fdaf8", "indicator--67b2e2f2-dde8-4146-8a86-b77266a64b63", "indicator--44f7e463-72be-443a-a19b-84be051ec684", "indicator--746181ee-8b39-4782-a030-a9943ab82da6", "indicator--000113d3-fd76-4d0e-9c6d-70756263ff46", "indicator--dcc72612-cfad-4ad9-8065-aa1036609098", "indicator--f2538fe5-e8cd-4870-965f-3f6182720cfe", "indicator--40deb03a-c1e7-48cb-9168-165b5a40146f", "indicator--a5450c4f-8521-43f8-a63c-76e04dc551fe", "indicator--e44782b2-4b4b-446f-9d39-d2b99e0d6e29", "indicator--86bb7b52-b620-4a62-8785-916525fbf55f", "indicator--7a34395a-23ea-405a-b68d-137745772467", "indicator--6be5e8d4-5e84-4ea5-8393-6f46ef70e066", "indicator--2c3a9931-3d84-4525-8723-59529595d20e", "indicator--dee1adc9-6f35-4894-98c0-01a69f628bf2", "indicator--0ba51d36-6279-4384-9fa4-eac5725b9e88", "indicator--ce844da0-e7a4-417a-a26b-2aa5ae8b2c98", "indicator--7d71ad53-b68b-4583-9d8d-15969dea16ff", "indicator--bb000f53-5833-4400-95ef-92bc284300d9", "indicator--73350137-aa91-411c-8343-553527a70d40", "indicator--36e1853d-0f90-4f85-93d9-5a45b38df208", "indicator--a5ed2345-135a-4690-bf7a-8b81f7486f97", "indicator--7fbe64e0-96a1-4408-9e58-570ffc7ee276", "indicator--3469a29e-3d0c-4b47-a818-ad4090f0be97", "indicator--8ca49304-202e-4bb4-94a5-7acd6b912d92", "indicator--aa072f94-20b2-41d1-9554-e67c4e59618b", "indicator--f2e65cb8-c7cf-4ab5-8b9f-ac98a1f7b586", "indicator--99eeccd4-b373-42f9-a8e0-b484db3f8b4f", "indicator--4cbe8d6c-d4ba-4daf-90a3-dc833fa7631e", "indicator--ac0ad7b6-6769-4f76-8a86-c8be392107f3", "indicator--06b5d168-c543-4ebe-87db-c66210613c71", "indicator--a084bdb6-4c69-4b83-a149-b8658e80e92f", "indicator--5bb6a12a-1026-4bfa-90cf-3a5b6eb47833", "indicator--6d281000-7a49-4798-917e-7ed48adbe535", "indicator--bdaff357-f20f-4cd4-9605-942dc29ab55e", "indicator--028074d5-c552-4a5e-bcc0-ccbc6fc77ece", "indicator--fba8d07e-c369-4c97-aed2-18da365a6ed7", "indicator--25943499-ed40-45bd-a1ed-3d33e5f9e3dd", "indicator--cc8ecff5-8aad-4a3e-9525-14500d35b4ee", "indicator--5f3ac927-7683-4653-881a-af00ff80fbab", "indicator--cc6ee92c-54f0-4238-af3d-5ed4d9495ec8", "indicator--f9af7193-e4c7-4a36-9bff-f626335a1d16", "indicator--f1d53912-9a9b-44df-8ac3-9ff1cb304670", "indicator--8148ec0e-e58e-413f-850e-eaa499ca37a1", "indicator--a5961c3e-5622-4e26-a4cf-5eee0fff939f", "indicator--922ac969-9211-4aaf-a589-16f5074332fa", "indicator--75dbd7dc-dbb1-4b8d-a71e-9f407345cc16", "indicator--f900b849-694b-401f-b887-7cd503c5b2e2", "indicator--5f49332c-2579-4aed-b1d6-9cb4bae8ea79", "indicator--446ea14b-b60b-4efa-b4a6-e41d32d69f88", "indicator--541c5f20-d18d-4629-9346-7d38718fbed6", "indicator--4437b1cd-c428-4222-b5b6-fbae558c0579", "indicator--a18f59a0-b41e-4ba7-817d-04b9c062c80a", "indicator--c059f769-094e-4fc9-8dcf-b722def438f0", "indicator--14f299c4-74b2-4f60-b45c-a7eafef7ca7f", "indicator--08ef9dfc-414d-4179-a653-643c1664b847", "indicator--78460bc9-d5f5-40c3-b066-7ee32b316ea4", "indicator--aabddb69-3118-4612-bb95-ddbe8a41be37", "indicator--c7f72448-58e2-43f4-9756-5df3531e7f50", "indicator--42e7d06f-4ff0-40df-bcf4-49d0765506f3", "indicator--b56234d4-f0af-4160-a428-a127b3ae041e", "indicator--381f427a-5ed5-42f7-838b-55ccd329ee78", "indicator--f3a449eb-15f6-421c-9328-219119253d87", "indicator--5862595a-a764-4203-9ae0-8f30aefd98fe", "indicator--aa4bb615-a71e-4e50-bfe0-1c7e58a6b0f9", "indicator--20ae387c-ffd8-45b1-b1e0-6299dc6b522d", "indicator--e4959803-ce75-4ce4-868d-1fd202d7e988", "indicator--7dcb37ce-dd46-4f0a-aaae-c5378324c955", "indicator--7799d458-9490-4245-a8d2-58ba357fc7f7", "indicator--95136358-6b6f-4aae-86ac-6b1151f672eb", "indicator--a3819678-8dfc-4bc8-996e-de2141302635", "indicator--2907c24f-1044-427b-9830-bc3a6c7a3fde", "indicator--ad42beb9-6f3b-439b-a4ab-753805ef5c08", "indicator--41049c23-3671-46b5-ac2e-0b33880cbde3", "indicator--346b6592-ed5c-4ca8-ae13-23c5d6e52b35", "indicator--f4560234-edd7-4df0-a14b-8d55dbecec8c", "indicator--668fec59-0476-432a-a83c-535f1bfdd65d", "indicator--82187daa-fc9c-4864-92cd-3743b389d845", "indicator--654090db-e634-46b1-92a7-43af2405a188", "indicator--92b4994c-dd91-4f9b-8cf2-f1b11fb3e888", "indicator--44bc411d-1477-430a-baac-0edf84a98fdb", "indicator--21da6bdc-b8ba-491b-a623-988733c538aa", "indicator--5e408ce4-6642-4fad-82d8-8f667bf5fd96", "indicator--6139e006-5f45-402c-bd3f-c280b6b59172", "indicator--77d47f79-66e3-430f-9f3a-085812d0b27b", "indicator--4eea1d22-af32-40aa-9ce0-4cfa6b2ff78c", "indicator--0d1a3b7f-a9df-47c2-a8fc-53f16ac7510c", "indicator--fe22997d-8c39-46c5-b567-365fd7541be2", "indicator--b07e44cc-44c0-416a-b0f8-8a24402c39a5", "indicator--f9a8bf42-49c1-42a9-93df-e07761407dba", "indicator--79fe3641-575d-44d4-8e94-3dfa5efe9d4c", "indicator--8063b3b0-3f3f-4a43-98fe-d72c793bfb8b", "indicator--19392b5f-b355-4911-8451-16321030ea8e", "indicator--a1d9163d-301c-4cf0-8acd-b6492f228c54", "indicator--3b0ee646-c89e-4f1f-ba86-a0a0fa2ca7f4", "indicator--e1698ffc-6adb-4ac1-9d9a-ebf2da051eda", "indicator--c28ce7c9-a272-49c7-bae5-a73b6c3056e1", "indicator--8794588b-8cba-457a-9cd5-50ec803a61ae", "indicator--7a387294-5489-4be3-b70a-e657b6900775", "indicator--fa3da78b-9d35-47d7-b656-cea18e2a6166", "indicator--01c0ca5f-fe4a-4dee-ac59-b182c98cbd44", "indicator--aced1914-2f81-4f69-bafd-3b0522be1fa3", "indicator--9ef182b6-f807-49c9-906f-906b9084742f", "indicator--79f955b6-8b46-411c-a8d3-3598ffdf18a1", "indicator--c7a4ad6d-5d26-42ae-bbcd-8003a06fe1d5", "indicator--800f53a2-6e06-4e5d-855e-37fb0b50ca56", "indicator--9d39cef7-42b9-4626-983c-35845e83ee50", "indicator--beea56ec-f317-495d-beb3-9dc9dd450226", "indicator--db52f17d-7757-4584-93e5-73ef83b46d87", "indicator--49dc4487-8bec-4811-83a2-be313a1c8f28", "indicator--3be1f3a1-a8e6-4e8f-a4b1-5893fc1f03bd", "indicator--8dc8f8ca-051f-4aa7-99cd-15ec0b2c0e80", "indicator--79d946a4-1edb-4886-90ee-3ca91d90216a", "indicator--2dc153f6-f3cd-4e2a-be65-51f0f4431451", "indicator--abb3f1a8-b7ae-4809-bf75-d4ad6283e522", "indicator--b59ad771-bd3a-41a3-aae4-1b152d1df3da", "indicator--3c4d06fc-100f-4104-a9a3-9e595d88a473", "indicator--51ddd5fe-9117-4b3b-99a4-00adc62ede57", "indicator--aafe728c-39c3-452f-b238-3cd9e989f211", "indicator--e1ea8af4-4a85-4b61-b3ee-c88a6f9e5102", "indicator--539bfb06-5440-40f1-8f19-5979816954b4", "indicator--b6b3e0a5-a605-4442-a58a-e4993c296c1c", "indicator--1862e846-5b61-457c-bbf5-bf1537317a95", "indicator--fc3b0be8-9249-41f9-95ea-aab5620e1352", "indicator--4c385033-67ff-4c06-bec8-c6ba6af852b8", "indicator--347b4952-651b-42a8-88e6-3da6cb2490c5", "indicator--288d84c6-63dc-42c1-8232-e928caef244b", "indicator--3e03fe5a-b0d3-441b-a00a-c0998e88e0c4", "indicator--4bcb72df-cd37-4963-acbb-7bb008c451c1", "indicator--65088f92-1839-4d82-88ed-69721de51c26", "indicator--7bbef49a-474c-4fb9-8e6b-eee89f527b4b", "indicator--c74b83c3-5ede-43db-8b75-bc6a5edb1120", "indicator--628c4640-b392-4fce-9d80-19dc938747ae", "indicator--40fa1dea-7d2c-4272-9030-4e25d853b27f", "indicator--06b97eb8-00bd-4a93-be74-baad3b21eae6", "indicator--dc1bc39a-ab87-43d4-bc39-a04670e2fbe8", "indicator--e9271e08-d3aa-459f-91a3-4ed40bec87ca", "indicator--c2319228-dcdc-43f4-88c1-76a3b82da57a", "indicator--bca7d52b-fe0e-4c2c-9f98-da6df4e30155", "indicator--27f563d1-d05b-4c69-85fb-82bb256d6e96", "indicator--230a8b08-b81b-4a0a-8b06-2d3bc7de0eb0", "indicator--b1ae5281-111e-4dda-b6c5-a7754cff779a", "indicator--6d305bc1-8be0-483c-9aa1-ce255c38683d", "indicator--89ba594d-7ca6-47cf-b9d7-df93c7714b6c", "indicator--4768787e-4787-4185-9c05-c4aeeb1dde46", "indicator--a7511dbe-947a-4553-83d6-f7f46e0bf861", "indicator--134b2ee2-2e25-4245-b9a3-ad73029886f1", "indicator--50f698b6-0d08-4915-9b8b-fc4f7b951853", "indicator--68371870-b5d6-4640-88a6-932b36c8f62a", "indicator--76e551ec-491f-4f6f-81f7-5c2e9138acdd", "indicator--c0d4b3b1-3ba9-42ca-ba14-c14c9247e4a0", "indicator--08c24edb-8b0c-4691-a8c2-fe1413aa6727", "indicator--a0a30613-a20c-4810-af72-e5b5b18e3568", "indicator--5a37db9c-cc81-4820-8a65-8f49f47f486d", "indicator--22dacfae-eeb7-4187-ac51-0a7385776a65", "indicator--2083f2c3-93db-47f3-a9d0-e5345f8513af", "indicator--516c6a0d-08a9-48dc-aabb-07d75bd3458a", "indicator--75d9eec8-fe0d-4f5b-b13c-7e7935ab980a", "indicator--f544206f-99c6-4845-aa97-ddeca1429567", "indicator--bcfe5bec-7e42-4bdb-a046-d9252a399a50", "indicator--de4b7903-eaa5-42e6-ad16-9a97438ecdf7", "indicator--1e34a978-5c6d-43de-b091-a6ce513da4d4", "indicator--1ffcd551-ef22-438e-9009-253d588a1b58", "indicator--91d245a8-864e-4d60-b750-e4f1e3dda891", "indicator--6ab59b61-d53b-4f99-8505-9f18a7e5baf0", "indicator--4e1fb9ab-bcd2-4f01-a52f-5372d08693e3", "indicator--bd0e9964-2c38-47b7-8837-bc2e4c928756", "indicator--bf8cf3d3-98ed-4a8a-9d0e-c5ca40491f63", "indicator--95fdfde6-9703-455e-8aa6-049f1ea7e1a9", "indicator--1b16de27-94cd-4d21-a3bc-b124d03ac8ca", "indicator--4f6ed90e-95f8-4a0c-aa1b-3406406de541", "indicator--808fa081-8078-47fa-be44-c2bd355ea4be", "indicator--df39c178-f38a-4b46-98b6-74b34e5b67db", "indicator--665bac74-de6a-43c8-9e7f-4d768197993e", "indicator--0d92c211-e10a-4b73-b653-91ab388fd273", "indicator--90e2560d-ce68-4f32-a68d-c94371205b6c", "indicator--3f328cce-797c-4996-a296-b16721363b18", "indicator--4b6cb6f9-1086-4296-a4f2-62f067c68fc7", "indicator--ad81fb89-3fe2-4f06-bad1-ebf5c6330db0", "indicator--c2aa532e-4753-4b52-b02e-6b5d0ba8a3ef", "indicator--98b72442-5be3-47a1-8b93-5bf43ab7c8a9", "indicator--e4709957-98d9-44bb-8cb3-9640ae3ad0ef", "indicator--e81923c5-07b1-40d3-92d5-9a12daf5848f", "indicator--99855d0f-a250-4bf6-af8e-8b1e3f00c8ab", "indicator--6181930e-75ef-4fb7-8940-d6bacdf425b6", "indicator--e6c9cd12-bcb2-4999-b37d-10d6931f7c13", "indicator--b40779ea-6a01-4995-b7fe-a10d01a9555d", "indicator--a2cbb7a8-9275-4119-bfb9-9010f8ed9bab", "indicator--bb49dcb7-2020-4a9d-9164-85239be618a6", "indicator--fcb1a1dc-5686-4455-a132-91ddc63fcd68", "indicator--1802bf46-8749-42fd-892e-d042bd77608b", "indicator--6f30c774-c633-42c8-b5ba-402716fe6492", "indicator--6fe6b0ea-9edf-416a-8f70-b4e5ff028989", "indicator--6c8f08ff-a3e9-4f61-8ed7-4c6b931af871", "indicator--e66f83bc-acd5-407c-9cfe-20d6744c7955", "indicator--fd7d532d-e84a-4121-87a6-ba22d81501df", "indicator--09f06f00-144b-4712-9c9e-2f0096291dd2", "indicator--81ec2eff-2dd2-45b5-beec-72a51353e512", "indicator--a706c8a8-be06-4038-8367-afe434a3f7e9", "indicator--b58cdc94-869f-4201-bf6f-010e8ac72079", "indicator--f1968e84-30b7-46ea-bb3e-ede740e5b2ba", "indicator--84ed05a5-9a19-4a48-8d18-9c32d6b3be8c", "indicator--608d4f98-b3e2-43e5-8b8f-fd1d575e4901", "indicator--003ebc92-0a05-4071-850b-5c7b6540ad7a", "indicator--3c50017a-6787-4fce-97dd-9586c5758d95", "indicator--c99c503e-4367-4827-9d6e-00d3955da9fb", "indicator--718ecb5c-f5b3-400a-a921-f1c891850ac1", "indicator--18fbdffd-8c94-4d42-bda7-9e71fddc6825", "indicator--dd0556cf-4807-4ced-8c6f-7eae4059e671", "indicator--dbce281f-dce2-45ab-9210-bb703223b737", "indicator--cb256a65-f4f1-4f60-9782-370df88430f8", "indicator--6fad74cf-4bd3-4066-a57e-bcf7aee7a00b", "indicator--2618adb7-b38e-45c9-918e-2ce1401935db", "indicator--f81d14f4-2113-4dda-83fa-fa2ec390e92f", "indicator--1f5604fd-0bfb-4776-b6e8-75a7350d75c4", "indicator--6ef49f54-d217-46f6-bde5-d35630f68391", "indicator--09e347d4-720b-47e4-a0d4-691ae2c6aad2", "indicator--81da266e-197f-4514-b9c0-029bc8db2cb8", "indicator--02fa172e-90c9-435c-85c0-27705a4df66c", "indicator--cb3ab7a1-3635-4fe9-aa22-52178cd70322", "indicator--d16089b7-bcc4-4eb0-9a1e-484ebdde5ed4", "indicator--8c2ecaec-8501-48fa-a23b-3288271ad0e7", "indicator--66d42d87-9695-4cbb-9da0-98f431978b66", "indicator--eb11f3a5-1552-4ff6-985f-4fa181bf6d46", "indicator--a0058acb-15dc-4b56-81dc-db65582b6082", "indicator--09658de2-5bca-404d-bf92-6b6d1a5bc687", "indicator--f9a6eee2-11f5-4c58-9331-ac7be6ddf960", "indicator--06a3c8a8-af24-4d6e-8ad5-b0574de0002e", "indicator--a2ee9bc0-db98-48b0-aa5c-5998199d3369", "indicator--e1706868-f811-455a-8ce3-8c39226bace9", "indicator--9fa7424b-691c-4f92-918b-65c346909907", "indicator--f4673397-5b54-42b2-87c8-97b239beebfb", "indicator--4b8b7bc0-e129-406e-9c08-142326a2b500", "indicator--016b697c-77d7-4a8f-8da0-a351ba3dfbbb", "indicator--3d1435c0-512d-488f-a910-325d784bfaf2", "indicator--5590beff-aa78-4230-ba41-e0f500e1f158", "indicator--dda9609b-64f1-4d03-8a7b-3c1a1830cde3", "indicator--2b5e1d82-32c4-432b-b1bb-1493e49948bb", "indicator--5cf65cf3-8ae1-4a0a-8335-0b6460b8953b", "indicator--6b158905-487d-402e-93f6-34d1be140717", "indicator--3f724796-67cf-4ae1-8567-77b2d976206e", "indicator--c3a49b73-f1a0-4f7d-9cac-78329cb7caa1", "indicator--b827ece9-c57f-413b-894b-8cdcb6308609", "indicator--2e3e359d-4b84-4cab-b77d-9bbbb2784a99", "indicator--7c390adf-92fe-4709-b1e1-433875d7f0de", "indicator--650595c1-8f77-4110-a54e-663b7a42c89e", "indicator--d1b748ce-8ef9-42fe-ac68-b094bc973be5", "indicator--74452bf8-83bf-46ae-97d9-879c9e05788d", "indicator--d0a53da4-7893-4fa9-86eb-58c933b691ae", "indicator--70f36b6a-4c1e-484b-b02f-d2d00d08e077", "indicator--7eae9bda-4406-44cc-a946-3647a9e4a9ca", "indicator--71fecf72-dd10-474e-93a0-af2836366a1b", "indicator--93f8ae90-4c66-4332-80be-39ce8c299ada", "indicator--a05d63a3-8fc7-4546-bbdf-cd3b82116eea", "indicator--91e33daf-4679-4489-b1f3-370b4662f986", "indicator--5efd8f08-defd-4850-ab69-fac5e1e11d9f", "indicator--b036778a-166b-49a9-9291-c02e1a8981ee", "indicator--7ed25736-e208-4d4e-9f1e-1297285a0b18", "indicator--61d47154-72d3-42c6-9321-8910fa5cf750", "indicator--fb336682-0a45-42e8-aed3-3e3e0f6986df", "indicator--5491bad5-b5b9-45b4-89ce-ffaaee7aa5a5", "indicator--c058d2e2-425f-4c64-b4b5-994ca39f5ef4", "indicator--db0a72c3-f3c3-420a-9a90-9c8ae25f490d", "indicator--b9f6fd7f-753b-4e24-be77-e5ef2c638535", "indicator--2ded0480-b5ce-4b65-aa57-f95073c017a0", "indicator--90d13c17-38aa-4efb-a343-c601e3774863", "indicator--527fe902-9328-4cff-a8ae-afe52ccb56c0", "indicator--7e32c87c-e383-4f06-a738-bce1664885ee", "indicator--f5db0de7-1cbe-4308-a98a-1907b2f8b9b0", "indicator--0b2627d2-3e0e-453a-8c8a-cba49d2a3c8b", "indicator--431d3b9a-e8c3-468d-8a54-5a39de4e8c4f", "indicator--8c433192-0d6e-48c0-a739-dabe3bc8108e", "indicator--5ea624e9-61c5-4287-a5f0-80bc3bc6835c", "indicator--694cc15d-1496-4fd7-b5d9-46e19f22c1a3", "indicator--2bffb069-b752-401d-af50-aead056563ed", "indicator--4aa34864-b92a-4cab-a692-d22e63c00563", "indicator--c3cbd131-9f52-4f29-a07d-2093a6ce2542", "indicator--a49a721a-a4f4-4e26-8a44-67e1f8c23f25", "indicator--b020ac79-6203-41ab-90c4-305b04bc536f", "indicator--30f95efd-49e0-415f-850f-9981687f3de0", "indicator--603da803-51d3-44a8-aece-416843254c10", "indicator--e33f9401-987a-4997-b4b7-7c9a7bf102f8", "indicator--acf1dd4e-cad3-4e3d-9feb-fabd6c84c4b7", "indicator--083f9279-f355-4e03-8974-6ae21b5c1611", "indicator--62a2481d-08cd-4bb0-963b-b764ccfd7f77", "indicator--0724df32-9a24-4b44-84be-88a37a624236", "indicator--3d665043-7973-44d7-95e8-6c3379cf5779", "indicator--b5e264ce-5175-4768-85a1-68a19e545b32", "indicator--06693d52-6e4f-4b2a-b171-420075c0e06b", "indicator--f4ca2b2c-f89c-442a-a22b-b550e184325b", "indicator--df0db88e-5bea-4236-af44-2b019c3be44c", "indicator--b09a4ea2-201f-4e68-a9b0-580604707cbf", "indicator--b558a3f5-77fc-44b3-ae74-5852967bb299", "indicator--b383c185-a332-472c-88c9-33a40a024d63", "indicator--b7f58bdf-d757-4bbc-bc41-8cdf24082d25", "indicator--bf4f3fa1-6adf-40a8-8b06-602202ec8c47", "indicator--134749cd-b68d-4e6a-aac3-1c67295c33ae", "indicator--5b750f0e-2dde-41f8-8313-ce89fcfb505c", "indicator--a289919f-643f-438e-bccc-52f793090c1d", "indicator--0c2671e3-2d7b-4bd6-8d26-a503ac35d62a", "indicator--c732aff6-0f11-4c19-b85a-d4eaba4ea055", "indicator--e2de6d1c-a90a-4785-a4fc-25f998b71f3f", "indicator--b7e64e65-b2cc-492b-b359-247295abbd34", "indicator--83f2ce44-e38b-4cbd-ade9-da1c467b030e", "indicator--6cdec18d-d944-4c89-966d-e9dd5fcf0b35", "indicator--517c7bd3-5cb0-4fa5-bd62-3f3fb1f5a322", "indicator--494326ee-5b12-40e0-b575-958bac7378f0", "indicator--71960458-876b-4b71-afc5-faf379cf93c1", "indicator--5b311721-5b7d-4733-9e99-8a1717feb954", "indicator--8b6dc623-2e8a-4baa-a39c-66076ec75772", "indicator--1a66cacf-31e7-4722-8ce7-ecbb4b365f59", "indicator--144ebfd8-3bde-47f8-aa3c-f672761c7df4", "indicator--a13bd97d-210a-4317-a464-d7b1266c07d9", "indicator--9f135a91-6dfb-435b-ae07-5a3c75a0dc20", "indicator--ca907f0a-7984-4a2f-a323-2377349b4d8e", "indicator--7b33a479-b32c-4c37-b99d-d38d4c369e5c", "indicator--d0997956-f2dc-4b80-91a3-751f3c07635d", "indicator--d4a61514-04b6-4289-8ad0-eb579ba19c4c", "indicator--11ee4843-2cb5-484f-94af-ae43d0dde573", "indicator--02b018ea-88be-4a36-ba08-6f1032d00da3", "indicator--93a0b4e0-b07f-4fdd-a5d8-50a8ec78ae8f", "indicator--2a7c232f-f316-4ea2-b6c6-91cc6894fab2", "indicator--b9f63119-c411-43c1-ae6a-ad4bf5797320", "indicator--54b927b6-4dcc-47d6-b7d7-e4c5ba807987", "indicator--5bb96e54-1d7c-47c4-88f3-bd2cde3a1241", "indicator--e009101c-b102-4777-8ff1-a6098d382b99", "indicator--8e6c0095-5e8e-4480-ad51-640144567b81", "indicator--95a749a4-4798-469e-87a0-e926e5cd87e3", "indicator--acc6aa3c-8614-422c-9d32-f9e7515f797a", "indicator--b35d3b67-24be-434a-bf96-d45472efc966", "indicator--f97336b9-3fdf-483d-a6db-11eab0816d33", "indicator--c7864865-adb2-4c8c-ac82-7fb9f99bda5e", "indicator--526c363e-7647-4b49-8533-e5154d34bef1", "indicator--e906c6ea-2880-4727-925e-d87396f099e5", "indicator--ddec955f-a857-47ef-bab9-ab093565a057", "indicator--eda2110d-8362-4741-ae6c-150548ad1277", "indicator--2193ad66-f583-4822-8029-f19d95ab18ee", "indicator--512a1519-3bae-470a-84f2-c7eec62e8755", "indicator--0459c861-125e-4945-b2fc-e9abd4f0478a", "indicator--6aca3a85-fe7b-4f68-a227-ea20e0eda823", "indicator--db65315d-629b-42ef-88da-a52872e4bb29", "indicator--e883a6af-2a5d-4f69-b01a-34e5f5f6ce0b", "indicator--7f1092ef-f6f9-457b-a99d-e7e840aaef11", "indicator--b91136b8-33c2-4b86-9ad2-a5160a7d5b5d", "indicator--c589655d-de5c-4193-8359-55d2d457e849", "indicator--4c146176-04c8-4224-9e7e-1b0eb66db06b", "indicator--30c92c20-cc3a-4d83-af3e-1ec7dbba44e2", "indicator--4c102b2a-55e3-4f1b-823c-c062dcf40936", "indicator--754a61ac-b6f1-43af-be1e-abc7d168b6cc", "indicator--e375169c-feb3-46f4-a785-d14acd7d5ba9", "indicator--40d693e8-1a07-4d9d-9b5f-8829509698a4", "indicator--61098c68-ae6f-43ef-aaef-cbf8302acb19", "indicator--8ba8a88d-de97-489f-9bda-b9603f809015", "indicator--3e5141f6-7e4a-46ee-bb32-c39b05e87c3b", "indicator--3a450ebd-fe76-43eb-849b-f5116cfcf99f", "indicator--2d482a9d-3337-4aa3-9783-c73b43508e74", "indicator--8473de8d-6279-40cc-8f6d-70b0830a8c20", "indicator--1d75da4e-f148-4113-8aa7-1e0a8f3fcf64", "indicator--b883a881-3f60-4d04-bf28-982be0a3423a", "indicator--d594202f-87b7-44ca-bab9-bf03eddcac1c", "indicator--f1651933-c17d-4081-8805-79e6d719d5b4", "indicator--aa4a5222-638c-4d76-b632-1f55f371f3cb", "indicator--40b13e97-dd17-4e1a-94f9-1a6c27429cb6", "indicator--ddc503b0-e585-4c5d-9d96-61b7ede8ce36", "indicator--2e697a26-7902-4c97-bbd5-a498a1d8f121", "indicator--212c68a2-9cb7-4f8e-a8f9-5a2d5bf42119", "indicator--4ddb6d5b-b773-47f0-9a8b-11e2f2d42372", "indicator--955f9c8f-1d78-4ead-96cd-c3f6208f52ac", "indicator--e6b39d84-5234-4c3f-8355-81f12de65175", "indicator--cb216be8-3f98-42f9-98f8-1a10fb11a08d", "indicator--3bb162f6-2261-4e8a-b009-073333436fa9", "indicator--db33b3af-9665-4eac-a6c0-1d429528500c", "indicator--ee4db4d7-dc8b-4baa-8dd5-258d3f7df5d4", "indicator--75ede0ff-34fd-48da-aa98-49e2eb152243", "indicator--ac73178d-e462-4977-a89c-830f28cc786e", "indicator--e7e461e7-1a83-4a74-9294-88f1f3257810", "indicator--2f4ca961-2403-43e0-a052-c5fc7fdc8a8d", "indicator--99661d29-c62b-446e-bbf3-be022b9f30cd", "indicator--f6747771-f505-41d8-a8b1-59a454d5bd80", "indicator--b69e48a2-e5ad-4978-9348-79c9dd4480d5", "indicator--9b3feb6d-3ab1-4f1d-b910-f6f6c042b1d9", "indicator--a314a770-e428-495c-8170-ed3d8b3d3467", "indicator--ed1752f8-3d63-405e-9616-8505ad6523eb", "indicator--d73a838b-b5ad-4b4c-b981-6a8ca3a31630", "indicator--c1d51c48-1fb1-4f81-aa3a-28a618a5e284", "indicator--6659a784-76fa-489e-b8a5-fb0cd1d3132d", "indicator--a8cf3353-be7c-44b5-9183-47c8f174e121", "indicator--a3a1ea09-6660-4dc2-b3f2-5992c84782a7", "indicator--85bca866-390a-4ddf-ba56-653dffecb70b", "indicator--52894173-fddb-4fb1-951b-a470676b1828", "indicator--ee121470-4121-40d9-aef0-a4affe26cf44", "indicator--27370543-655a-4fa4-aa99-122e3d48f223", "indicator--52c05932-b9f0-4b42-9852-a53666a4b42e", "indicator--5b6401ee-af75-4e67-9b69-15cfe14f9ba4", "indicator--d3183943-289f-4c0d-a762-d56379d28047", "indicator--5278dbf9-3d7c-49d1-a487-42adbab54460", "indicator--65b98170-e35d-4afc-9094-a6cce3ce16fc", "indicator--c255269e-8f39-4970-aa5c-611c69b56b54", "indicator--b6e39561-33ae-4cb3-9913-5fa64c44f41f", "indicator--c6c519cf-1c5b-416b-a8e0-2b8420c7712f", "indicator--d00e57f2-840a-4c05-8da3-e1712d53cfc0", "indicator--7b81ea65-8644-49c0-a464-ca91cd8afcae", "indicator--cfff8171-9382-4076-9964-849c0a62ec9e", "indicator--292f17f4-e77c-464b-8739-d23284e2f5d5", "indicator--e331f8d1-624d-48d7-9295-73b43695d807", "indicator--d2650a9b-a541-4760-9763-5aa893a2d4db", "indicator--f8a60452-657f-4383-aabb-9c22cb8b0617", "indicator--c138c704-5d03-4ee0-a4aa-4ae63ea49c60", "indicator--53d56c42-a989-4914-b83b-ccee393c0113", "indicator--2e19f298-40d3-4c14-8445-fb993436cbae", "indicator--a0462120-4431-4178-9168-a46e93cce37d", "indicator--9161068d-eaed-4c0e-a297-ae4b224251f0", "indicator--d2d2f965-22c7-4ac3-8a84-b086ae7eef60", "indicator--0925fcd9-6561-405b-b9a1-6b8b0103b480", "indicator--1b1f235a-7462-4976-bf18-fde164bb0c7c", "indicator--a09ffcc8-10a2-4dc2-ba39-ced196192368", "indicator--03c78f8e-1d05-480e-b068-b6171f1e9b01", "indicator--ca8866ae-9f4d-4eec-a290-f12cdc570334", "indicator--1d3ef2b8-b8f9-4643-a748-ebb25ec60ade", "indicator--10a6c96c-1433-445d-adb8-8539df1ab054", "indicator--3e81a392-63b6-4a8e-a62b-d4b1c3b19e42", "indicator--406ca4a2-3af4-4f87-af31-5a2cc81cebea", "indicator--b35d080e-7e86-42bd-abaf-9e8ed92b2964", "indicator--0f7ece3b-9244-4401-93cb-6bc507f1430a", "indicator--0ade6376-189a-4acc-b5c6-e164283efa9c", "indicator--7163a6ae-f6c0-4b46-90a5-c3d8ab8d397a", "indicator--cf8cb857-dd71-4a19-be3d-d46c86e3ae9b", "indicator--3acf6034-5436-46b5-8247-10c34c74a31d", "indicator--7726a480-7b32-4802-9a86-561ff66161fa", "indicator--8544f561-810b-4202-b9e5-e761909576b9", "indicator--a25c3bd6-b3ef-4e11-9ce0-53bf8716a233", "indicator--3c4e2fc0-aca0-4acc-a78e-9f0bcea6d0ac", "indicator--668ff378-896f-4aa5-a2c3-5a07d78e9fc7", "indicator--32ff6eac-cca3-4a6b-802c-b2a49b6974b6", "indicator--b2c44c2b-fc5b-45cf-9068-62e3bd5d719f", "indicator--7fa2083e-8642-4621-a76e-3caf7f83e3ab", "indicator--31735148-fb01-45dd-be4b-20f8b741c161", "indicator--c86c529e-0daa-4bd9-b917-da2c5248b7e3", "indicator--36fe9106-08bb-4d08-ba5a-60dcbe118eaf", "indicator--bf917696-b40b-4fbb-b410-f03b31b0c978", "indicator--07f3bddb-defe-4a52-84f1-a42e48566f13", "indicator--132aa48d-f79e-48a7-bea4-067d7251a887", "indicator--79d08b58-c061-4b00-a920-eeb287f83f51", "indicator--b2e76367-1b86-4b76-9809-18bc9c176ee5", "indicator--6b35b1eb-9f92-485e-8394-8496aaf082dc", "indicator--7f23951a-88f4-4e36-abfc-5ca2ba800ff8", "indicator--a57851e2-f3d9-4bb7-9ca8-1ec48b2e2094", "indicator--3ae58372-bc9a-4364-9402-4f58b215ebfa", "indicator--629cf7a4-cf80-45a2-ba5f-10b6f723e5fb", "indicator--0d1f13db-eff7-449d-a8a4-c851f4cb8254", "indicator--5e3b8098-0d70-40d4-b3fb-77307ce7a348", "indicator--2b947c40-b600-4eb0-a829-29f177fbf702", "indicator--189aba1c-fbd6-4cca-a477-578f18b5da97", "indicator--3c74def7-acb4-4aac-8c0f-d7b5284c47c0", "indicator--75d8d621-b073-49b4-abdf-00ecaf38b844", "indicator--4c0b0afd-b6d3-44ca-825a-c75efa7589fd", "indicator--6b7abe41-cf65-4ce1-b982-c1068591161b", "indicator--4cb72b31-23e2-450b-b7aa-70dea500819b", "indicator--0fa88fe9-5c99-4283-9e0b-2c2394968df0", "indicator--3bac63f6-e568-4215-86ba-719661ac05f7", "indicator--1ff867f5-85d6-4fa1-b953-40fb6ea0298d", "indicator--bc7e1084-b916-4d95-9c12-57ed4e85d56f", "indicator--6da237cf-4b1a-4b7e-8ffb-afaa37c18910", "indicator--f1514e2f-a78f-4a1b-af08-e989c79f6259", "indicator--eb51a316-7fc5-48c4-a200-5c6057cb4f4e", "indicator--2132964a-ebcb-4674-856e-457b467cdf72", "indicator--5e23e3d8-dfcd-4383-9d80-2bae9193f425", "indicator--23d8b853-aa70-4835-b682-08517a680e2a", "indicator--57230b3a-3ea2-4400-9353-63f6b16d1981", "indicator--87889366-2b91-4f04-bc9f-4088bb7a621a", "indicator--dff73a37-b36d-4efe-83d0-6c5efc6a3ac4", "indicator--88eaa116-066f-451a-9647-748885137220", "indicator--519ebaf2-ae29-41bd-9387-fd5842574ff9", "indicator--cbfbfd54-5ed8-4a27-a39f-7d8012189b2c", "indicator--fe95c744-b947-431d-9962-0341da8a167c", "indicator--8fcd957f-d7cc-4528-8772-33236c5f64fe", "indicator--f1f78d1b-657c-4413-afa8-eeb179ce0ebf", "indicator--860fb3a7-5853-4ad9-b893-b4a997386534", "indicator--145069c2-a83a-4fbf-b5f2-14afdb0b078b", "indicator--8712462d-53a4-432a-b75c-b8cd3e8cda9d", "indicator--0f5d5a15-af84-4cd6-89c7-20de07c86588", "indicator--99002551-f66b-4c67-bb1b-2d58cf6b2d96", "indicator--3c21b2f0-f9d3-4b63-b130-662790372d2f", "indicator--6afb78e9-ea12-47ec-8473-73fb4e2d9f79", "indicator--f49cbe20-e148-4509-bfda-1a54205594b6", "indicator--2dfea0bd-8ce9-4506-92e9-57411c0c6ce3", "indicator--e15b52bd-d8ea-46a9-b367-70c0ef0b5c72", "indicator--f3fb884e-13cc-4290-a172-02890bba5d37", "indicator--3f68132f-8823-452f-930e-03f05e2ed1ff", "indicator--c38f258b-c41a-4f1c-8c47-7188281b13ba", "indicator--7900ab0d-516d-4954-a473-6851b1f25086", "indicator--ff542112-b53e-464a-9a6d-b66a84765092", "indicator--5efe9681-e24f-43fe-a9f5-eafe0cedebab", "indicator--a2d363d9-ad4e-434f-b4dc-2a4f718c2294", "indicator--f8b02502-8ea3-4a40-8516-ec1c06bfb279", "indicator--d6c2936d-43ba-4032-bbaf-e6b861d364e2", "indicator--8623c16b-28fa-47c0-9133-3eedbac692ac", "indicator--a9e63f87-da44-4d14-a844-35509f80ea76", "indicator--799c1fe6-d605-4106-b83b-2a2561baece4", "indicator--5ad2a704-1d25-4081-bb88-c24793346cec", "indicator--96552725-1034-4f28-ab87-91a27b4569a4", "indicator--0a3f25b9-ed87-49d4-a6d0-ff2bff7a7603", "indicator--17c69a3d-5e2b-484b-8fc3-df4e41a2a221", "indicator--249431c6-5822-4c98-9e79-991573b2a9d2", "indicator--648007c8-b0ff-4917-ba46-1a69d62bb9d4", "indicator--ef419868-0965-4f26-8ed2-3412583ae01f", "indicator--8134d1b3-2911-4ea3-92ad-8bb1a0c82362", "indicator--a03bb7f7-b142-44ea-a022-6c279b35d8b4", "indicator--611940bb-13dc-4c82-8426-22b87a7d3efa", "indicator--8d82b19e-118c-48df-a781-721ef82db81a", "indicator--dc078b18-f580-4c78-946f-efa6cb319828", "indicator--6d3b1e92-bfa6-44f0-82a1-f28f85962e1a", "indicator--881de263-cb60-4d29-af0b-f7a678a7b1f7", "indicator--19eeb1f8-7aba-4d75-acdc-2605b4b7f26f", "indicator--302d0876-6c43-4055-8f6c-0273ba5f6a54", "indicator--05779171-2570-43b3-a70f-d6aa18bdaee1", "indicator--f9c92ced-c7ff-457c-82ca-a23f416ead31", "indicator--210f7e90-9832-4730-85cc-dbd7b4f2a8e6", "indicator--6c28c71d-aaba-4136-87b5-360027ca219b", "indicator--63675b25-1db7-4096-932f-1ba96cc0cc4e", "indicator--6367f0bf-00ba-4582-8928-b0f85b8642b4", "indicator--ab70812c-aa3f-4cbe-a8af-25064ecfb1d0", "indicator--4ce6c26d-0e91-40ce-959e-b83a32e0b97c", "indicator--dd946ac6-863e-4f8c-bfb9-84cf0b4d9455", "indicator--4c5bacdf-a7d8-4c0d-8a6a-57aa8b6208bd", "indicator--4158fd27-1437-4994-9078-f8dc9913ec70", "indicator--4f8bed67-6556-42ee-8349-fffc320e89a7", "indicator--e4ce41f2-d4ea-40bb-89c7-eb5282ad47b8", "indicator--2856eec2-3994-4fdd-8b31-e4fb323848b2", "indicator--06153f2d-ea27-4f88-92b2-33839dd7f604", "indicator--628638a3-4e63-4d51-8d60-0502c9e5355b", "indicator--e21e2205-879c-44d5-b76e-2716699d1721", "indicator--66ec8abb-e975-498a-aa8d-5f9e2fc26e7f", "indicator--18c6afe9-8f5d-47d5-b384-f72a16cc1f18", "indicator--ec20658a-8cfe-46f0-99b6-273859ffe7aa", "indicator--0518329c-8216-4873-93d2-6e23e45eb441", "indicator--16b0bf34-da57-411e-a244-3cf13c984f71", "indicator--54bde0e8-91ac-4914-96f1-96713f419be3", "indicator--8b23e703-20cc-4665-9a59-3b457ed24b67", "indicator--ddd733b3-cd68-4443-82f3-f857f80c4853", "indicator--e1970e6b-ee25-4d2b-b3d5-85ed3ce0f3aa", "indicator--19b60eac-b8e2-46fb-8b4d-ecb7f4601861", "indicator--5228776c-cc1f-4f1d-b466-524c6337d73b", "indicator--d6f9788a-00cc-4804-881b-4de96224f9a1", "indicator--af93706d-6ded-4cbf-8448-44065c20e28a", "indicator--bbfce593-6a01-462e-a768-19325537e3de", "indicator--7e3b5307-b9c6-42a2-bc06-8bf629370b50", "indicator--c20b98f0-4427-4671-bfe5-b3ca549bd72f", "indicator--18147a43-f887-4be1-9a08-8d2882b7adc6", "indicator--433b69b5-2642-44bd-bdd7-3d2e74808d5c", "indicator--54505420-df17-4efb-9468-887b2ec6706a", "indicator--2113028f-40a5-4925-a3ac-0c655361641b", "indicator--0508f443-a112-4db7-b558-8df9475d8a19", "indicator--32eb2d0f-a30b-4823-b834-74b797fe15f8", "indicator--fac1bea1-9e7f-456d-ba0b-a7412b2eb882", "indicator--582a8922-ec0c-41e5-9a75-bafdfab903e8", "indicator--e0190cea-c964-49a0-8f1b-c70a06b8517f", "indicator--07affaf8-9e52-44b1-bc3e-1f67f1526b6f", "indicator--2e981e36-e77c-4c73-afda-1fc7fbf64cae", "indicator--e527c38f-682e-4f2e-bfff-fd1c3c2a8698", "indicator--242f0ad6-f0f4-4eab-b4dc-283f52885769", "indicator--5834e683-c0f3-4f73-9fda-75da418d4c6d", "indicator--138aba21-a0b6-4ad5-a7bf-794bf38b8fe8", "indicator--92c20bd8-26e8-4f04-a9eb-bcef22cb3f2b", "indicator--ad01c2b9-61fb-40d3-be4a-5c13f1e5fb9e", "indicator--86510f32-986e-406b-8ea6-b43b433d0ef7", "indicator--8ee06dd2-b510-45a4-84d3-acb7301773b1", "indicator--b369d965-420b-4abe-8333-dbe24dc53e12", "indicator--ca12a7fc-3c47-494c-b862-aa417973caaa", "indicator--a30d8963-f809-41b4-9b9a-b0015cc32dad", "indicator--850f93f3-5766-449c-abba-1a29c0e9865f", "indicator--a233ceaa-d7d5-4e3a-b137-a5608264c3f3", "indicator--25c73e11-155e-4176-affa-b18c8e51af48", "indicator--0519d77d-a7a1-4265-adc8-e60250b6fcf7", "indicator--7050696c-afd5-4088-a09d-ad0c494de850", "indicator--290eb6f2-1f01-4164-9098-6f3de112427c", "indicator--ea10acbd-e4bb-433a-9d1a-85e5c985c65c", "indicator--7d396106-0830-48c6-af97-08fe52746d8b", "indicator--5cec2c6e-2e96-4b7d-8143-0ac1caa39378", "indicator--32515f35-2893-4c8b-a5ef-3ae68770404a", "indicator--7050c133-2396-4df6-b93e-d0f381855d2f", "indicator--e7d77f1a-f441-4f2b-b421-31afab5ef51d", "indicator--5e297655-545b-445a-b500-2a6093255473", "indicator--13676bf1-274d-4ccf-9797-70645158e2cd", "indicator--05c4ab7c-da8a-47de-8c6c-4b6e725aa970", "indicator--0d9eca92-a7f1-4100-8c0d-5b0d411b8f9f", "indicator--cd7f4942-02d2-4f61-8692-b678fa87d688", "indicator--4f7c682a-7d75-48ca-8d37-252036763a4d", "indicator--0fc5c5a9-79f3-45dc-b5e5-dabe4ba050cc", "indicator--c888e91a-a553-4a61-96ad-dd6f90040fd5", "indicator--e8bb9300-3cc9-4663-bb32-b4f0996c0160", "indicator--b73a1597-7b52-4a40-ab9e-a8c03e8cab66", "indicator--f0f6e0fa-1c2f-4ce2-9eb2-74edfc0a1c97", "indicator--c9e9cd50-63d9-4a5b-b1ae-eed4752cbd0d", "indicator--14dfb7f6-84a6-4ac8-ad06-24cd70cf6afb", "indicator--b30613d7-c0a1-4e26-818d-6a2becfca6c0", "indicator--04767397-2b1d-4460-9fe9-bebcd09024b6", "indicator--b0bfc3c9-0c8d-4e89-9e9c-328aefb21403", "indicator--babcbf10-f42b-483b-a695-75bf49474df1", "indicator--cc672149-d88a-4d57-88eb-75a81b9fa227", "indicator--9de6b0ef-6ab7-4bcd-9175-58ea29579ca6", "indicator--c88200b5-840b-40d3-ae5a-f910290992b4", "indicator--b6ec35ed-8834-4b0e-becf-aa5c2c27b802", "indicator--38c98ef9-27c4-45cb-8247-d354ddf180a0", "indicator--ce54ad5f-a90d-4fcd-934d-3dc7eb85dc32", "indicator--939f9bf3-9b9d-4940-bf1b-b1483c8b50e3", "indicator--ad858f41-4623-4a1f-9496-4f7bc4e264d1", "indicator--f6462556-d8ca-4701-89b2-1bce775df3c4", "indicator--0d8fdde4-9ad2-4c55-acf8-56d5d667ceac", "indicator--aed4f67f-708e-4de7-81cc-894f70f59d6d", "indicator--b5dfc482-c33d-4767-93ac-ec12d4acc06f", "indicator--f8de6662-bc86-4a21-98fb-967f617315ed", "indicator--c0db3671-250c-438d-9ee2-ed8cef5d1ea8", "indicator--1a4722cd-b77b-41c6-a06f-9dba73485d3f", "indicator--824ea30a-20f0-4f78-94e9-067013d06d73", "indicator--3b87e62b-deef-4bb6-93ba-245f36ef16da", "indicator--a764eb07-f4fc-41f5-9362-2d81688ed49d", "indicator--a53bc211-e8f4-4552-b147-ba7d33953f3c", "indicator--d9cd631f-f9a2-4d07-8245-210b13f12c52", "indicator--50586c18-5eba-4254-a66d-afa929d7f07f", "indicator--522ada28-37c7-4612-882c-3790a87356e0", "indicator--a3121f02-ecc2-4a45-b78b-75d6ad978d3a", "indicator--d74084e6-5890-4c06-9be8-03be19c8bc80", "indicator--af1fbfd6-ac0a-477e-8307-09b57ba20e16", "indicator--8d82e44e-9079-4eb2-b646-5e4f4ae4ddff", "indicator--1be61eaf-b182-45cc-984e-2caeaa5f2f2c", "indicator--f6df325f-7c10-47dc-8fae-b6a6e29412a1", "indicator--b93165d4-0c55-4f67-b401-6157486c3a5b", "indicator--a2095a35-0193-433b-8d69-157df2018b1f", "indicator--57d46715-1c30-4ef9-9c70-65eef27c6db3", "indicator--0d8aeecd-5425-4136-96de-8c5542dcf364", "indicator--4df302be-37c4-4210-b6bb-74c475ce4d05", "indicator--2fec9d3a-c860-499e-aaf5-cdc4682c59ed", "indicator--3baad22d-572f-4eec-b8bd-9b0b89e41eaf", "indicator--146c1a77-3f89-438f-a3ec-a9633c406452", "indicator--32a00c03-7bce-42c8-b0d8-f4863590746b", "indicator--b87ca772-561c-4aab-ba17-571619af0cd3", "indicator--75dfc02a-673a-400f-aabf-131a7f6c8e17", "indicator--ef54e3a9-e72a-4957-8696-1029518c90ab", "indicator--7f3ad5d4-b9a1-49ca-a99c-3f5b8aabbaf9", "indicator--852d5a5a-55b7-4006-a99a-def73d74ec05", "indicator--600c5382-2580-4692-9f5a-4bc2a15f4371", "indicator--07bdce58-a5bc-4e88-b061-a68680a9fe32", "indicator--f3419cec-2776-40e6-93b2-67346ea451c2", "indicator--da18aa2d-fb62-4b8c-9bee-426ddb7020ba", "indicator--1f9bcab5-9ff4-48e7-a2ac-9fa6fcacc7db", "indicator--0930a7f5-1ec8-406d-8beb-57d3604884b6", "indicator--e7fd2a07-a83e-40c3-9ff0-a9eb43935745", "indicator--912e336d-3305-4cd1-b233-b12b3cbd6c99", "indicator--65134026-82a3-46e5-946a-8e099daaae3b", "indicator--94b57d33-2e8c-4b25-a56a-a2a16f5d22b5", "indicator--7bbdc83e-5614-473b-bc89-5e9fa40a3119", "indicator--80c606a9-21a1-4f17-a56e-8e099b86601b", "indicator--18861d6c-5790-42b4-a211-39d95fd1942a", "indicator--d4c99e72-ae29-4394-ba15-d46b4191b3ec", "indicator--eaed2580-f77e-48d5-bd10-a6cbbd58bb98", "indicator--c9805cae-f165-4584-8d9e-2da2dbc04503", "indicator--825d6137-d156-41c9-9ae8-930167578179", "indicator--945c0d3e-93b1-4a57-808a-6f38dfd80a69", "indicator--ac83f647-e9fd-4119-8956-9a838832740c", "indicator--512d8ede-eecc-4d02-8905-9ada73ea930c", "indicator--686f1a3a-7de5-4b74-8313-4e59695d5c07", "indicator--17489a88-d2aa-494c-b9b4-56ed3c284f4c", "indicator--5b39a558-f290-4979-89b9-947b1f475f4e", "indicator--b672c80f-cd41-4e48-9759-bb730facf647", "indicator--0c84c5f1-754a-45a5-9830-605cbd6b536b", "indicator--7db0ff10-2160-4c04-88f0-f6c2629f373d", "indicator--cdb49831-4a68-4a16-83ed-8bfb92c4e26b", "indicator--16cb2442-36a0-4d2f-90e6-de1033ccee8e", "indicator--aa4ec894-456d-4612-b019-3deb6441b1ea", "indicator--2f925d4e-87c6-4d6e-8092-c00f1111287b", "indicator--48555fcb-14f8-4c9d-bfb3-136848ede4cf", "indicator--759a7b97-282c-4077-8bea-ca5317e182eb", "indicator--9b23700d-901a-4a6c-b345-ed08a242da65", "indicator--692214a2-2743-41dd-82da-fa4b5b304def", "indicator--ac3c7d9a-0491-417d-8145-4fd859bd3acd", "indicator--a6009030-0c48-4d67-b7fa-bd195097e184", "indicator--90cc1e6e-efab-4ad3-a8ba-f000c8c91e0c", "indicator--f210e3de-6a7d-440a-80b6-fda0bdbd0611", "indicator--5c355a85-77f9-43ee-8d71-1c9b2d52465e", "indicator--336c24cd-4619-4afd-b079-516ed2fd6c7c", "indicator--58d8a2b7-f57f-4541-a39e-fd7dd0d39a2b", "indicator--3662fe64-5744-4843-a5a9-8c652828b1a6", "relationship--4de70f80-2cf9-47aa-8968-f6b08d1d4ccd", "indicator--f38955c1-7695-40d1-904a-09035fe6866c", "indicator--8309b1eb-e070-419f-bce9-ccd64463caa1", "indicator--169c2440-93c3-4f28-ba7f-20a0b6faf0c6", "indicator--a7bf0c0e-6a17-464a-b241-f26c6933ce24", "indicator--b42adb19-ef56-4222-adb4-6ebba9abcc6a", "indicator--39f1b687-9c4d-4ca9-9bbf-42f92352ab27", "indicator--75ef34f0-dcb7-4a5c-aa47-c4381bba4411", "indicator--4645644f-6289-4648-bf5e-dee18c09a9ae", "indicator--b19bf3dd-43dd-4b3c-8f0d-7709e431fcc3", "indicator--a074efe4-a4f3-4898-adf5-7a2d5456150e", "indicator--017bced0-735a-4986-87c4-85a90a011640", "indicator--34a19faf-475d-4176-9b21-73bd3a878fa9", "indicator--b74cfa63-5d8c-4978-be7b-84c4cc96ec96", "indicator--2c1113d9-2d78-4588-907a-0b1790057d04", "indicator--a931d3c4-8843-467d-97cd-5ce5ae2949c8", "indicator--0ba26ae5-eb65-40a9-bd94-c6b4f55c8821", "indicator--7969405b-60f3-4c88-961d-5c6ab87c5fac", "indicator--accecf47-3b25-40c0-b61d-a11d9921c931", "indicator--476a8a82-612c-4586-888f-2a960c967803", "indicator--569d0f91-6412-4969-94b1-57351edb513f", "indicator--456af398-c5d0-4308-928e-99fc1c46c4ac", "indicator--f77b1fb5-6775-46b8-86b8-0f64f3d9ba7f", "indicator--98e7b95f-5eca-443c-8920-c88cb5a4722f", "indicator--411846a1-627b-4c35-9eda-24fada9ccebe", "indicator--f105c36e-08ea-4f7a-a372-c09c2068a83b", "indicator--37f47edd-01a1-4d0f-91cf-26910a3e4efd", "indicator--0a203633-8ce6-4a12-a312-c9656e9d13db", "indicator--43676b68-c33c-4606-a697-41627db7a51c", "indicator--b636a65d-f5a1-44f6-9cf7-e2ba4a466c49", "indicator--d4cf6058-6e46-4a81-9069-116f4a2dc51f", "indicator--fc273c7e-72a3-4a8b-9d04-0ea89bb604b9", "indicator--196994f8-60cb-4c41-ac0c-5acbc58b5c6c", "indicator--f3bc6612-9135-4250-b7e3-478c37913d2a", "indicator--c6ac68c4-5494-4021-8935-886a4ffe6ead", "indicator--95015fb4-4b6f-4a20-9978-6fc3d1d74a77", "indicator--624ad3f0-2c0b-4b24-adbf-5956223cca3f", "indicator--0fad74be-0fb2-4eb0-a614-ecbd2da9b898", "indicator--b1842115-2639-4c19-9ae3-2daf855c139b", "indicator--c2675f78-c031-497b-a705-ef73092526a7", "indicator--951e2e9f-7f76-456d-aa1c-6b811c2519e3", "indicator--935b8dcc-15bf-4c5c-a9c9-b466596f898a", "indicator--e9ca460e-85cc-4873-aa0a-d89742692e32", "indicator--67f97fb3-8775-42ac-8a4b-cc82934059ea", "indicator--a84cdb3a-274d-41a0-8d98-e728cc160782", "indicator--74ff5132-2532-49d6-947b-7ebe958932cf", "indicator--0575c514-5f57-4f89-a918-080a4683ba71", "indicator--a003d193-2863-4c15-b41a-8406940e1993", "indicator--ea385494-660d-4ba3-b2e6-723fe89e3a4c", "indicator--12a45367-83ef-4815-805c-5e47900863fe", "indicator--fc2bf1f8-e169-4047-87b0-9e8d59146116", "indicator--6d5c7625-2249-49c0-b816-0aa51a66875d", "indicator--90a3a892-7bda-4db6-95cf-6fe91f4e0404", "indicator--a313cc65-cab5-4985-bedc-4492b66993c7", "indicator--8d3f3432-cf15-4922-8ada-8a4fb252403c", "indicator--3a5f5abe-0645-4f79-b3b1-d70842c0646d", "indicator--eb1b5db4-8c53-4901-a45c-33aad8eb557d", "indicator--5eb84ce8-22d2-45bb-abaa-62f8f40f0028", "indicator--11814db7-40c6-4e6c-b216-e6ebe6043809", "indicator--4e0f9d42-3c4f-40b5-9969-fd5bd7bc1bb6", "indicator--fbc83397-a7ef-4d3a-ac57-64eb33b1e592", "indicator--00e27ed5-6a9c-49ae-b47d-dfa1625fc203", "indicator--31e7005d-3784-4455-8106-90671ef6eec4", "indicator--ff2911c6-ec4d-4c89-8c50-4bcfbed8e683", "indicator--761c75a3-5bb1-4bca-bf66-b90576c606de", "indicator--15772ea2-f960-4f9f-85da-8a4a94a8982e", "indicator--dde98d19-285b-4ddf-9609-18839ceaf718", "indicator--85d4c930-bf71-4031-a6ae-cfafc7f2e7bb", "indicator--9a3b8da1-232b-432e-91ca-752beff6c8aa", "indicator--d020b64c-94a6-4cee-a7ba-a225ac6acc64", "indicator--e988c353-322d-4ec1-b030-929ff3dc0c18", "indicator--9c29e951-6bb1-41b3-9c09-37ccb380b22b", "indicator--589a6fa9-fe66-4c4b-b368-9940c47ac1c5", "indicator--5f59b122-73ae-4dfc-bdcc-dd25787b1359", "indicator--a720b0da-b72f-4154-9dcf-a51a1e9619b1", "indicator--b50b4e81-6e91-40db-9020-a8e94f5d547f", "indicator--40abe9f7-7653-44e0-b0d0-74257efa4f8d", "indicator--86076189-2d7d-4b47-bdbb-c66c202d9b67", "indicator--87692e2e-d6b1-4246-82c3-a47c58cd2b62", "indicator--ff0cf83a-dd72-4843-b35b-73348ce3e458", "indicator--59f21e16-df77-444c-9d66-3cb2e9fd9d59", "indicator--b6622f47-8d11-444e-9364-1a2cbb6275f1", "indicator--5e9408d5-2e10-4962-9656-dbe699fedee4", "indicator--5aced7e9-a669-497f-bdd5-9bcd8b4447ec", "indicator--21ac689d-b76b-4126-bb05-7c0a7c116a51", "indicator--608952db-ab53-441d-8cb3-2abcf4eedecc", "indicator--120e4271-8636-4b00-a6da-517c2b02d2b6", "indicator--d6145bf0-330f-45c1-9d57-4bb0b6fc7969", "indicator--45b3f50a-31a1-4466-b59f-7e8000e0b95a", "indicator--9d22bd1d-1490-4467-8206-1d543a0e7a8e", "indicator--8cd27151-c4a9-4d9f-846b-2ae26f3d8520", "indicator--19d79b40-7c12-4eca-a83e-e2df5157e97d", "indicator--95834799-0ebd-47fb-aacb-0892c4978fda", "indicator--abe394d0-d0ff-4109-82c6-048a1cef7475", "indicator--58266c6e-f073-4f8c-92e6-14bebd9dd38f", "indicator--efbe5360-52bd-4726-b194-de278bcaaa31", "indicator--be220537-f498-4d3f-ab45-58dd33e62f10", "indicator--5a5b052f-d016-4127-829d-989c4e96380a", "indicator--1dffa12b-b176-4b03-ae0f-59fc1b95b793", "indicator--50805b74-059a-4180-bcc0-f5034d17eff1", "indicator--b574c4dc-840d-47a3-8400-064f878385ce", "indicator--3bd41bab-3ac7-4e41-9aa2-d06aa1ad0d7c", "indicator--45a97ecf-8330-42d3-8b25-48b801370538", "indicator--74c83798-c200-4773-8c80-feccf8789ed7", "indicator--74800272-a2bd-403b-9299-b1b02bbb9024", "indicator--9f6bbea5-7b50-4b21-ba65-e02ea4f4ccc0", "indicator--e5698f50-d1f9-4de4-848e-49fee96c6724", "indicator--0ecbd6ba-f91f-43fe-900e-8a9ce3e1d25d", "indicator--5ef461cd-76dc-4384-9480-6daf41567f33", "indicator--206b34ff-7eef-4bf8-862b-13c1e095f2b0", "indicator--0f561603-9f98-4e98-9426-2496dd74b4cc", "indicator--d7eb41f3-1d5b-4b6f-b54f-0763ba8a124a", "indicator--99fa0b80-16e7-49c1-8933-011c570cbd15", "indicator--0d727592-da17-473e-ba2b-0e20db38de98", "indicator--ac39b08e-d485-4c4c-9e4d-ebd93154a83e", "indicator--72ed6253-eb0a-41a1-a242-774d1dcfa27d", "indicator--8bec2b07-76a7-4a0a-b878-b5d95b466934", "indicator--39ab4f7b-5f23-4e3c-9ccc-46472a8266a3", "indicator--74cf421f-6180-4a6d-bf01-7a722e7e34dd", "indicator--2cefa417-774b-47e3-957e-3022b21408a9", "indicator--569e3db3-a851-4631-8200-d9c11ac43e03", "indicator--0dcdc60d-d74e-41b1-9a97-b458c673f26f", "indicator--635e7ab6-3e05-4411-aefc-efabbf012217", "indicator--0dd3b0a3-054d-40bb-9d77-bc9ccbd8fbdc", "indicator--7ecc86a2-f062-44b2-9b3f-b2988b44d2f1", "indicator--d727985c-c209-4afe-84ad-1fa428e9f138", "indicator--dc4d2827-6d8f-4627-9850-eaafb4ce3522", "indicator--cc51669b-070b-4ed6-a9f7-1749734dca9f", "indicator--3ea26c5c-12d2-4f91-9a0c-0d87ff3bea15", "indicator--4dd40469-dc2c-44ba-93a0-ea29526ba124", "indicator--059e2b53-3e37-4aea-bf29-71434027c336", "indicator--e91c076a-0ba3-42ae-96f6-84e4b4949160", "indicator--41822d6c-7fa3-4234-ac6c-f5acb1121fb9", "indicator--34841f07-2b18-457e-a131-6e9060187fa5", "indicator--64bbc253-2526-4806-a323-62599f3aa9e1", "indicator--7902efb1-1241-4043-a86c-74dc8c366cd7", "indicator--365e7f15-a388-4b58-bbd1-93136f7f57ce", "indicator--62c15f54-9e4f-49ca-8132-b8f9fa0b93c4", "indicator--265a0d73-7f18-4e75-81cd-d859c5b63008", "indicator--aca0dc27-ec41-451d-8d6f-f921e0336a49", "indicator--e5d1da51-3e04-4073-bb52-8fdf6ced85ac", "indicator--e7ee6b78-844c-4ef4-98fb-cc2cec6e9381", "indicator--33a4f88b-cc84-4661-98d1-9277b6489d2a", "indicator--7d238759-5fee-47a8-bf84-19189f143663", "indicator--ccc57def-2fae-4be6-8c9c-844e2a34d721", "indicator--c6d80018-8ffc-4bda-9de7-c94f8d606627", "indicator--4cb12d34-3c53-4e67-9be4-db93242617f2", "indicator--b1ea394f-93fc-4dd3-9bc6-c156e258d290", "indicator--9d2fd2ed-6d4d-4189-861a-d2ab4d529045", "indicator--7c67716a-fb2a-466d-9326-a40ea306fefc", "indicator--d9d619cb-8ac4-4974-8a12-69d9cea9ebf1", "indicator--91dcb179-911e-4e76-a6b5-32025a5324ee", "indicator--d8c56d5f-4640-4a1b-9e16-948fcf8fc3d5", "indicator--5d014602-4016-44fe-a388-88c5142783e9", "indicator--2b83a399-2062-4f2c-896f-02e067a58782", "indicator--7eec9e06-3acf-4a89-aae6-b1888f3e4684", "indicator--ddfdb9d8-009b-4877-b75d-0fc9261a76d0", "indicator--e2a6d81f-1b98-4194-b831-7d971f32145c", "indicator--52a47a29-5f46-4e6c-a831-f761b15ccc27", "indicator--a7852b44-cf7e-490f-bf1c-8623cbc8e7c2", "indicator--3fd819ee-e4bb-4317-96f3-d27859695a6f", "indicator--c713c1d3-1a5f-48c1-9b9c-ddf9057e0083", "indicator--23973299-fe7e-486f-9c20-7526a56a2a81", "indicator--a2aadeb8-f6f7-4e53-8694-97013b2ad822", "indicator--652f5952-f2fd-45d4-8423-ad082ae7a68f", "indicator--aae66467-6091-46cd-9bae-8e5ef17e68bc", "indicator--bb813ecd-6370-4364-a2b3-c724c932a409", "indicator--7bb1028f-631a-411d-95ef-73cb64a2e0b0", "indicator--ec79592e-8750-4777-a662-b87aa05fd9b5", "indicator--3f64c92e-e6b0-4eca-b5b1-c6a437f6c13a", "indicator--f83a00b8-8e48-4d64-abf7-e28a32df6d30", "indicator--f4cf1785-610b-46b3-bcb1-d37c4387e5ae", "indicator--6a5315d4-6604-4ca7-ac73-4b2e88517c0d", "indicator--72af292c-00c7-4e88-9e96-3816fb79fcf4", "indicator--625b6560-2512-4cde-ba83-fda6f20bb2f7", "indicator--2c31e170-fa2e-4299-88e4-874bf5f1dd17", "indicator--66bcfd73-1c7f-45e8-bafa-4ff7aeb45760", "indicator--31ae3a02-0728-4ed8-a91c-202679df6f53", "indicator--eef0fb7a-63fa-43ce-84a0-582cb826f2a2", "indicator--f23c113c-6350-4ea5-bfc7-7e788e133a0b", "indicator--cd3024a4-91a3-407b-b453-96818fe3bf04", "indicator--47a40d64-29b4-4a6b-a645-112f1f9c75a4", "indicator--a3715f38-71b3-49a2-92f2-15afa10c4111", "indicator--a3440ed8-7964-40f4-b92a-49192cbc9cf8", "indicator--9840dcdd-4bf8-46e9-a480-b6ebc62c2fa4", "indicator--72ef5dfe-dc19-45e2-a442-b9009f618bdd", "indicator--07b1deb9-194f-447e-99ec-119fe44fe464", "indicator--a8ff817f-3c1e-4ba2-ae2b-fcfba57f734e", "indicator--89303efb-34af-48b2-b8b7-d545abcf1922", "indicator--6d0d12e9-3bbb-41f8-bf0b-76c6e77717c0", "indicator--321128b7-965b-4854-b9ac-863f6e9cb9ad", "indicator--67a08e24-deba-400c-bb2b-fec5c648854f", "indicator--ce2bc827-c6bd-463c-8c8e-58474af3fd97", "indicator--fe1f5c82-599c-45f0-8109-9a50b9d8338d", "indicator--495d92f7-d553-4659-9a68-c175d74e06d8", "indicator--060c662c-4870-450b-b869-5426a0861875", "indicator--62fc953d-9bd5-4758-95f7-a270724dee25", "indicator--e5978756-862e-47b4-86cc-a3b2a19d5809", "indicator--342d4bc7-28c1-412c-b3e0-21fe5e545c34", "indicator--2c86adce-a68a-493f-acce-20be74ded979", "indicator--9f41ab81-2b34-4d08-9af9-143419e986e7", "indicator--2662270a-38d5-4579-b1b0-2c6525158ccf", "indicator--796f21b4-5f35-4d97-8a89-14bdec136815", "indicator--a181ef83-8622-4123-9935-6080d6af0c2e", "indicator--ccc1ad90-3c2f-41c1-a97d-f3a65c6f2912", "indicator--2e28b85f-4bb7-44e3-8847-405a9c9b278b", "indicator--018aff11-bbe1-4a11-a61e-7334be2cdb04", "indicator--7fe0ec4e-7a71-4e6a-9ed3-654584a0f5f9", "indicator--91ce8956-7661-4042-b2a7-8bf122523225", "indicator--001460fd-4175-4453-8671-39cbbfc98d89", "indicator--2732c6bf-0de5-4a40-a539-9ded9a205929", "indicator--84aa8d99-8b42-417f-b645-3e4ed7098dc8", "indicator--1321cd5a-3c1c-40f7-89fa-665802a25279", "indicator--31f8ca9a-440c-4f46-a166-c7cdd07db722", "indicator--90b46909-377c-4758-86f5-3c1449973457", "indicator--dbf58348-4cb5-4b7b-a156-418e14beac9c", "indicator--d2799a80-107e-48b6-b61b-8cf180d04a86", "indicator--094a41b0-62a0-4b1b-a8bc-bc81b4c262d6", "indicator--072b1a61-7854-4aef-a906-ec86e0749240", "indicator--0035e5a1-4a13-4130-a49a-b682ff578402", "indicator--6be5f500-2928-451a-a03a-0460d713ef76", "indicator--9dd9a6ec-564d-493c-a729-8c4ba302bdf3", "indicator--1e5627b2-a7d2-4230-a8af-060a03d35fda", "indicator--b1559468-2656-4169-b098-d5b04e647580", "indicator--e6ba5c59-0c80-47d0-9652-ab67dec560b1", "indicator--b2ade95e-98ae-4e0f-a48f-1a927a11f35c", "indicator--16fe7757-9aa5-4c42-8bac-401fa6f9b487", "indicator--5af78274-0ca5-4ca6-a034-e405e2e73297", "indicator--0729a21c-1b53-44f0-8662-216da662a039", "indicator--5cbeed74-c88b-4a52-a95d-2b75db8396d6", "indicator--bd8d2073-b81a-4e07-bd35-d35a6aa0c65d", "indicator--df28eb0b-9ba1-4280-b3a7-ddc14416c5ce", "indicator--14999506-fa58-4941-b686-ab43d5842e45", "indicator--996ca740-21b2-43a6-82ad-0970abdcc2aa", "indicator--e04236f6-2115-448a-bd22-a80c539e5d15", "indicator--64b85c02-3322-4234-8661-80d2947e2a4a", "indicator--8f24c689-cabc-478a-8032-24f52350ae8d", "indicator--dd963344-72d7-42e0-8417-746ff25c6ba0", "indicator--6527ef57-aa2c-4e43-b0d5-448b393a8528", "indicator--2db678b7-93e8-4507-bdd1-81d125a05ad7", "indicator--8b223a40-8c9f-4228-978f-872ddb0a5fdd", "indicator--03eb6c7d-8bff-4611-b1dc-9badc6d56ed3", "indicator--ed3637ea-22b7-4a3b-9297-94345b741e0f", "indicator--be931a99-583f-461a-b926-152bcd2132d9", "indicator--91396955-f454-4c6c-914b-3b088cb8712a", "indicator--aecc4373-5891-4262-ad26-2b7683fb90cb", "indicator--00e8ea60-fb3a-4aa9-9648-4029ee63c4a0", "indicator--47ebd7cd-f222-4a17-9741-57081404a77b", "indicator--bc529ee6-f568-4219-8c8d-e188da48b2b5", "indicator--ae17535b-9ade-4396-825b-47559057c9ca", "indicator--c8ef31e9-8051-4fb3-a6c5-45c72c57c657", "indicator--900b9d69-aaf9-4e73-b19d-863ab8d8aff6", "indicator--a196cc03-b556-46cc-8919-b67ccf6ab66f", "indicator--43b09e05-80de-4c79-941d-7a56ab00203b", "indicator--9d1dda72-c1f7-4cd3-a227-07faeb7ab42c", "indicator--d24a06fa-5a16-463a-ae49-31177e602fe2", "indicator--6d3f5da2-26bb-4b10-b16d-02f85e4d19f7", "indicator--8732e0b0-0d41-47b4-8ee9-38076f62ea42", "indicator--eadce634-3107-4e33-9057-30304c4a5de9", "indicator--19acc078-7da9-4ae1-8910-7d223167e2b9", "indicator--c6c25c12-bcf6-4f40-b643-699e539bd91b", "indicator--e0e765ed-ee0d-418c-b69b-61097a972900", "indicator--bd9ec6ee-89cf-4ce6-9d30-1fa3a41a84d8", "indicator--669205ad-0276-4598-9a54-ac62440dd939", "indicator--d5b18675-9e7f-4e97-9241-ec6804b11ba1", "indicator--779aa51b-81f6-404c-b513-0b0b728f4339", "indicator--22fe0302-babd-4eb0-a296-526744014f9c", "indicator--e85603dd-8e9f-4ece-a072-045fbf20ee48", "indicator--ea3978b2-a2bb-41d7-92a3-29e6336a7f7c", "indicator--7afa57f5-c142-4d03-a57f-d60db57b7653", "indicator--c9b17b0e-d237-4154-954e-adee93ee4506", "indicator--489c82df-48ad-4fd9-bbd8-aa3cc028d9cb", "indicator--bab1ed6a-bf17-4910-8882-cd86dbe9acc0", "indicator--cc1c6d63-fd0d-405c-b1c0-cd4117555623", "indicator--848e2c1c-9ded-4f9f-9de3-98a962a4d0c1", "indicator--acda024e-d4df-4f77-8117-334db9367cf7", "indicator--dd99c1eb-824d-463c-a88f-64612f8dca9d", "indicator--ccd5f264-0492-4c33-8ef1-aee294b0df9d", "indicator--88ecd74d-7288-414e-a2c2-e3038d098458", "indicator--27b5c144-257c-47f7-81b5-271397abaf82", "indicator--b1fb7a46-6a4e-4697-9ade-dc310f5350c8", "indicator--8558e9b2-cfc2-4250-a64c-6957f0b49461", "indicator--de1a341f-ff64-4c3a-8695-f27ae4584bb6", "indicator--d0578425-4ac5-4842-ba7f-a8f1193db36c", "indicator--e650abf7-dc4d-4190-a3d4-61d6f10d9a7a", "indicator--ff939cc2-f70c-4406-8eb2-5991ce19f197", "indicator--92589479-8872-43b8-ae1b-0cac3bbd1535", "indicator--2b5ee8fc-b66e-40e5-a149-e4871a3d4257", "indicator--d5f2576f-2fbc-4203-bbb7-d1cd8dbe962d", "indicator--b8988c45-53b0-479a-bf07-585920d4ac59", "indicator--35302ea7-b84b-4b1f-9153-f73805708ace", "indicator--912ab37e-fe09-49cc-a3a7-85b286705545", "indicator--dbda96ff-a3cb-4889-8e55-c6903a607466", "indicator--63086c55-ba8f-406b-86a6-4c6268d38d45", "indicator--a2efc24f-b67c-48f1-97e6-9cf4d3806ce6", "indicator--81fdfbd2-5d29-4470-b150-2cfa69cd2a84", "indicator--e9194381-e79d-4be0-9964-96334570d9f6", "indicator--12258ba8-1b24-4505-bab3-8da558dc5e5b", "indicator--c157875b-23db-41cf-a8d9-ed612878cd56", "indicator--5162a52f-3f40-4ce2-8b9a-ae4ac756f8ce", "indicator--c0d938cf-c23d-448d-aac2-0f9bf4e3f57c", "indicator--84ec0593-cb3c-4089-874f-a2b08dc6b7ea", "indicator--ff7a31c4-43d6-4cdc-a223-5e8721cbc349", "indicator--1b49068f-d830-49bd-8a04-3e6f9ed2fbf0", "indicator--43a0505a-8de7-4d3e-926c-565d08b752f6", "indicator--31e14b47-e075-43f0-8403-6feeb372686a", "indicator--2548af7a-e13e-4d7a-a78e-4f02f67fdf91", "indicator--9cfd1ce9-102f-438a-b363-a18b93b6cfdd", "indicator--686c98fb-72f0-4c97-93f7-31240e30aa4e", "indicator--f5d50776-c214-48e9-9f65-4edec3fb404c", "indicator--b53421ce-24ba-4b02-87c2-558a5558feae", "indicator--adf85152-8daf-407e-8453-409f30322fb3", "indicator--e6d34c43-2d75-4f96-9e57-f2bf57313bb4", "indicator--df2923c8-3c4f-41b4-94ab-52495cccd9d3", "indicator--7dd0b5a3-991d-49dc-9568-b48c2e749dc2", "indicator--1c8e9bcf-92c7-4ff2-959f-a5a02410ae82", "indicator--8cddcb28-2e0f-4940-89a2-2237655f3ee0", "indicator--20ab4bae-a281-4719-bfd9-84abb41c3146", "indicator--36cce09f-760c-4487-843b-9839a8475275", "indicator--262ba158-e753-4d24-8430-162ede05c96e", "indicator--a58d93f0-9079-40ae-9489-9489971c87f6", "indicator--702f8923-7496-4c3e-831d-28a19f3c67ae", "indicator--48cb9b81-1078-4533-a17a-f645a1fdd4f5", "indicator--0350609d-dca5-48c1-9dc3-9de3be715dc6", "indicator--cec01108-640c-4f8f-95dc-1b2ece2fc1da", "indicator--dadfde82-c998-4782-97aa-68e47e534d66", "indicator--c1f988c6-517b-4d7b-acc9-dc3f92033feb", "indicator--d91afefa-a261-4c16-ae80-d7cfa105b65b", "indicator--2561227a-590d-4cfa-95cb-d0fa4c5b87bb", "indicator--e4ece524-aee6-4a71-8b6b-d8adad305d00", "indicator--8e6d5138-6ff6-4444-960d-175bdfd39549", "indicator--95002fa0-a5d0-4935-9e24-fea65b387068", "indicator--2a012447-e14d-4c06-9a95-a390f5c2c505", "indicator--7bc2e011-85fb-4fae-82bb-1f8a453f293d", "indicator--189f1793-2525-4593-a846-5720448364f3", "indicator--ed517bb9-992e-43ac-badb-dcdfdfdd6086", "indicator--5ddd78d3-11d8-4d34-9ec1-dfcc1fd035c5", "indicator--0d36e1ed-c39e-4708-be9b-f35ee4232fa2", "indicator--caaafc9e-aa5a-4441-a7cd-76d5ad589f3d", "indicator--8f11b250-db7e-472d-860d-4031f21278cb", "indicator--e2f17f34-6766-4961-9767-fc6c10b30d2b", "indicator--36e3275b-dc92-4bb1-a680-a9e1dbffd807", "indicator--33569d01-7272-451b-8be7-387136cc7a3e", "indicator--1b9de306-c077-4d87-99e9-f5331259d1eb", "indicator--0a75a6fe-f0f3-40ab-b610-695f3449f385", "indicator--8825aa2a-7428-4cf8-b30a-635141e4f7a5", "indicator--90559558-c153-41f3-bb0d-a74727ac5aae", "indicator--43edeede-c4b6-44dc-a6fe-dbc111d2f148", "indicator--7da9826e-ccbf-4265-b4c3-953a50bf8cd7", "indicator--d1d9023b-983a-45b2-9dba-d22ffe6fe8ed", "indicator--8d535755-8118-46f4-b2fa-d694d72c96e3", "indicator--b50d666d-8728-43a5-9979-a8b17be2b3bb", "indicator--400ee570-7953-4577-adfe-312f4f96dfd0", "indicator--36e8779c-bca0-444c-8f8d-7f8d735106e7", "indicator--13c654ff-5900-43e2-8102-c7ad68234ddf", "indicator--1c47728b-477f-46d1-bcdf-d75dd00c69bd", "indicator--205a852d-a032-403a-a740-d6a6d8732994", "indicator--193a85ec-70fc-4930-9e6b-79543b728a41", "indicator--a575faba-6df5-41cb-bcfb-256ad6ba3b8e", "indicator--32c87afd-8689-44a1-a0f7-47040c5ed676", "indicator--fed3420a-f02d-492e-b5fa-8aaa2bd50c6e", "indicator--446ef716-e51d-49e7-a42f-cb8db02c1177", "indicator--f074b8dc-0f4a-46c7-93fd-e201f54bcb62", "indicator--d7dc0c9f-d40f-4faf-b74e-63ae5a16df7d", "indicator--a2a15a38-778b-49d6-a4cf-474c2729db99", "indicator--4ed96e8a-7c05-4455-8a18-3de29b66390a", "indicator--c4730b2a-6370-4ad5-bbcd-6105c0d499cb", "indicator--a6e3f13c-36cf-4b49-9c48-cd6dda20dbc4", "indicator--d6549536-b478-466f-a641-bfa43228ac0e", "indicator--cb219ff5-8240-407d-a34f-f46516a10010", "indicator--ef6073f0-b5d7-4be1-b7d8-15be95d7a60b", "indicator--8f96ad29-7c0d-44ab-9232-018e8c0634dc", "indicator--b0608486-e4eb-4730-8b4f-bf136186766f", "indicator--2dde8dcb-5d3a-460c-9371-53a1e197439a", "indicator--f8641421-32a7-4e02-82d0-1ddcc3ff6051", "indicator--c23beb61-b65c-4cf5-9153-b8b9b9df94aa", "indicator--31a7cd86-f60d-4b71-98df-374128d5aae5", "indicator--b51d0cf8-6369-47c9-85b6-ecb438311446", "indicator--dbc75a68-84af-41ac-a1ea-156b9191e663", "indicator--d1a2764c-f5a2-4dec-a67e-ad32b1f25eaa", "indicator--2fc9cb8f-ceea-45db-9f73-2c5c09afabc2", "indicator--ae342acf-983f-4be3-9f8e-eed8e206929d", "indicator--d218ff25-f1e6-482e-87ac-2a8724cd56a1", "indicator--20454424-2170-4c28-be9f-1aee8e5a9020", "indicator--3fc61972-215d-4fec-86b0-3a1b150315b7", "indicator--810a0535-fe27-4749-8838-11eaaa7327ac", "indicator--24d61df0-dabb-450c-a2c1-6ef41ec31336", "indicator--2945898f-dbd0-4979-b3bc-357edd116068", "indicator--f8b2af88-330c-4a1b-9789-c68047396708", "indicator--27bf510d-5178-4f71-8e0a-3b4621d0bf35", "indicator--766cad04-7e86-4739-a794-efd8bdd4662d", "indicator--d02ac0a6-4edf-4756-9473-27106713ba0d", "indicator--63a36276-2b66-4c6f-9cab-b6f4aede65e7", "indicator--a1d5eda8-7bb5-4405-9149-55e17b3f82c5", "indicator--276df8f4-e8fd-4bde-904b-5498d90e73e1", "indicator--df8fcc54-f9f9-46af-897d-876ebf8eab1b", "indicator--b87ce143-ab2c-4134-9d61-171e04787568", "indicator--f6547e5a-b466-4edf-b8c7-9ab09e8a4d13", "indicator--c07d53b5-0b1d-434f-874a-477cbfea2851", "indicator--97ddeb68-985a-4437-970d-0de256b0b14d", "indicator--0d546246-7831-42bc-aaaf-3f4e10433a40", "indicator--153f9a74-91ac-402d-adb0-a24986f2b981", "indicator--2ace606d-2bec-4a3d-8e6a-4470140bbc16", "indicator--5d1ad89b-7e9a-40e4-b640-b8de80ca771c", "indicator--f349f553-8c94-46c1-b9c8-713df7d4fe47", "indicator--eea471bd-b6bc-4fdd-b8fe-2d312fa82e80", "indicator--d0bbde1f-1818-420b-b637-1ffcc2976459", "indicator--1ff4ad0b-20e7-432f-9a28-d0ebec650c85", "indicator--fc2bd36b-90a4-4b9f-8197-e6c3a7047f1d", "indicator--0ae1a791-c9e8-489f-8f08-b8a53f251d92", "indicator--da8b9950-2c82-4831-aba5-68c6a218b429", "indicator--9b269f68-5a94-41b3-a359-40420ad7c39e", "indicator--4d0bb418-1a93-4f6a-adaf-6c24f0976fe3", "indicator--6821a096-8f63-435e-bed7-21ba92cac341", "indicator--b73b7007-375e-41ad-9ecd-acf57a851da2", "indicator--6f50481d-d499-4d13-9284-0d8bdd0693a2", "indicator--5ba77e68-ffe6-43f6-915e-a5c9dea12e6f", "indicator--1cd954c8-9510-423e-a343-a18a53c50fb6", "indicator--a4362739-fd66-46c8-8d7e-74d3aeb66719", "indicator--95c43449-be38-4cbf-9a3e-ddae39e3ed9f", "indicator--53bf92b9-24c7-447c-9af8-82195ca6a7a8", "indicator--38bfca7e-df19-41d3-8d19-f204784f7bd5", "indicator--74cf6b40-9e6c-406f-9d64-2596b6a25aba", "indicator--67c44a2a-8c5b-43d1-a886-4cdd8dd09a58", "indicator--ca5f6d04-3f0b-488d-a87d-e84aa5f730e1", "indicator--9e28ef72-317f-4e85-96ee-b1f7f77263c2", "indicator--0933755b-de50-4345-8b2a-d78d49bb74d1", "indicator--7d9c7361-95d7-4d74-b21c-25a765f1e8f6", "indicator--454ab707-51bb-4bb6-b7be-13cd2e9b7fc2", "indicator--cf9e9f5b-b2c5-49cf-811e-cd26b8303113", "indicator--4b000468-aef1-4d62-b79c-91b30f9939cc", "indicator--884daee2-6663-4a4c-bdf7-255f1e7dbf95", "indicator--db7cdfd3-996a-43f1-9792-17e2b55ca4eb", "indicator--12f8cdf1-464d-421d-b6b3-6b92cdecd6c0", "indicator--23674fad-29ca-4a1f-8bb0-83f6955ba211", "indicator--9d9f003a-d4c8-4f66-8deb-761c514283f5", "indicator--ba59e261-a16d-4551-b8fd-0060c5b2ee1d", "indicator--fe93a6c3-18c4-4930-9d3e-d9903aa84dc7", "indicator--bc8dc813-8e28-49e1-a5d4-c974dc188cd4", "indicator--407b2ebb-a50e-4b57-ab6f-869d921a9e0b", "indicator--b2797ef8-244f-48a6-b379-f0e141eb70cb", "indicator--72c3a604-094e-4b7e-8181-c0c82fd8629d", "indicator--b181bead-4cd9-47ab-8023-914821e7e419", "indicator--5a618f4d-a5d5-444a-8cf6-39ce96419c12", "indicator--68e103ce-d980-4688-9a5a-87b313a03a3e", "indicator--792e07f6-66b6-4450-b666-11654c96c39e", "indicator--8a3f86df-b300-47fe-bb51-af92f3a31a43", "indicator--9b206463-5978-41dc-8136-4d7dd2e090ba", "indicator--476c6715-ef37-4285-9fda-12bc2e2fe523", "indicator--8e90d5dd-c899-4a81-a2d1-21ea4d19ab58", "indicator--e475ce83-9b23-4844-bb48-24937fe11c0e", "indicator--457fef1a-9e54-4493-b575-a2dca7adbf35", "indicator--e767188f-c85b-4ebf-8b14-bde7fc6213e9", "indicator--f8e8396f-8f60-4526-98fb-307f8d36427b", "indicator--86c2e4df-855a-4439-8fe7-97977e9cd2ad", "indicator--9efb4129-d68e-4864-8026-4ff5615cedc3", "indicator--f788ab58-c58e-4efe-802e-a5a256c9862b", "indicator--dc850a25-6172-432d-9ecd-41cb39123aa2", "indicator--f5aa88b5-8a5b-414a-8eb1-f8f3a86d437c", "indicator--74b0da5b-16c9-4754-92ae-50615ff5fa65", "indicator--05ecf514-334e-4607-b8c4-ce0e013566fb", "indicator--8074d853-9fdd-4685-8d78-a0ff110b6f1a", "indicator--703b539d-b2de-480c-8c35-8fd2cc8d445d", "indicator--d6c67712-04b8-418d-bee9-c308effe9169", "indicator--cc78b2bc-15e1-43e1-8c59-3e881ae8c576", "indicator--d0eb4782-a5cb-4abb-bd47-adf59cb8f5b7", "indicator--8d54720c-7e8e-4ee5-a8db-fc361ca15db4", "indicator--cdd1f1aa-5c7d-4515-878a-ea38cd2ebc1f", "indicator--0a8f50b9-6fca-4565-b47d-3ca81936ce9b", "indicator--8daffa65-55d7-45db-bbb0-4ec5777a5823", "indicator--3959bc5d-b8f1-481a-8b11-fb613d2a31a7", "indicator--8f30bee7-cdd0-4e40-8d23-993f5a5d03f8", "indicator--0ff25c32-f537-41ca-b697-e292da23fa97", "indicator--edebbc59-02aa-4539-91c5-041d59b47cb9", "indicator--04b7e9b7-6953-4375-82f0-4d967775ae4f", "indicator--1aaabbf1-2e1c-4f71-b6b9-be762c8730e4", "indicator--8835a708-1d5a-4455-9163-9c937282e469", "indicator--8bdb8714-787e-496a-92aa-7aeec4530807", "indicator--998f3fa2-07bd-466e-83ce-44036156f7d8", "indicator--89e3f1e6-f13a-413b-8c30-7cedc64cfea4", "indicator--fbe52e12-0531-4802-ae06-94fd9499a9f2", "indicator--7ae8e007-9e4f-4f75-a4d5-ed6cd36d774a", "indicator--bd4ebe77-fc2c-4df3-b473-bf9524367adc", "indicator--701913d6-9d88-42b6-9fb4-8b1a84689cc0", "indicator--1f7f6a1d-a156-49f3-9152-7f9941ed42d2", "indicator--2058050e-9e55-4b86-8e83-fcab79666cc6", "indicator--7652df80-ffa7-448a-8ae8-7d99c685624c", "indicator--2274256f-0e8d-4747-80ab-0871dd36be4e", "indicator--40bb3d7e-9c0b-4596-bc76-ce796d4e2592", "indicator--17d61bcc-b560-496f-8adb-03bd2298fef2", "indicator--303ef234-f7ae-4d9b-9c85-a7efcba63562", "indicator--c21a8d91-8a8e-46ab-8be7-5c8c8bc4d4fb", "indicator--cd8fdf5a-3a88-4445-9231-8bdea419757b", "indicator--49e371ff-65bf-45cf-84fc-b0fadd371257", "indicator--85fefa9f-2544-4524-96c7-a4440089629c", "indicator--c75e1c77-c86d-41e8-be14-68d05dd0807e", "indicator--c98936b3-14ea-46da-b42e-f3eb96ec3ec0", "indicator--2702e9af-19d4-4eee-978e-a29ea1845abe", "indicator--90633898-8c75-4b40-ac1f-0cf21ac91392", "indicator--367f9e63-e3d8-4131-8036-a88af09fb998", "indicator--4538f7b1-0d17-418c-82a2-ad6145bd3356", "indicator--8f6a8e6e-71a1-4adc-8339-6a1318df5e2c", "indicator--367b405d-061d-4dc1-b974-e384bcf03b40", "indicator--e481afb9-3dbd-4436-a146-36a05d677356", "indicator--74546581-e6aa-4c3f-9322-9a7485e9ca07", "indicator--8c88295f-9e7b-4012-aede-28661f93e35b", "indicator--60c558c3-d0f7-47e4-b914-ad8a4282c28c", "indicator--3020c22a-1c38-4339-b579-21ba86ae56cd", "indicator--dea501cf-6aff-41e5-a451-48fb0ca3dd1f", "indicator--3e36bc00-6843-4dcf-928c-f9eda8f24489", "indicator--699fba34-3436-49c9-bd8e-35043f5a581f", "indicator--4cecfe01-c10a-4e6b-aa5e-a2dcddea5aff", "indicator--533ad446-524e-44ad-8e48-ec0c0ef9f6b9", "indicator--7fce4ee2-cc3b-4127-9f6c-d76802e38275", "indicator--8276d74d-40f0-4174-bdb2-9f69c2b3ce12", "indicator--8922b179-e9e7-43f3-a93d-10ff19653136", "indicator--65ef809c-e790-4a08-b004-60caf038871d", "indicator--a386a834-1f7f-45b1-a16a-f385cd6f6cbe", "indicator--0c3e221f-677e-407c-b1ec-3a9e857cee80", "indicator--cc07cbad-5a5d-49fc-966f-96ae30f6e79e", "indicator--49045145-baec-417d-9ecf-253b6185c9d4", "indicator--882bf5d3-1883-47b0-8e49-60b407e7fb0a", "indicator--1becd5f2-f073-473f-9cf0-d5ddc7440a13", "indicator--3b95289c-a5ee-4185-8839-1e1311943eed", "indicator--cc1379f7-6671-4e31-98fc-047c116b1881", "indicator--afacf239-1966-4988-881f-19173f6f1407", "indicator--c223f212-d812-466a-be49-dee170322c93", "indicator--4aa231f2-38c8-4982-8585-3f3270fe0c9b", "indicator--15312c8f-8e40-411b-a333-13ea0c1baaff", "indicator--78c2cdd1-754d-4301-ad57-4e8380315d19", "indicator--ea490fdd-9c39-4955-aeeb-83a13cfa1a49", "indicator--b320c2f1-8aa9-4f8c-9b50-4e15410ca233", "indicator--c07e8bf6-fc43-4c0a-9125-28a2d87c9158", "indicator--1c3e7327-4969-44f3-a5d0-699553c76b70", "indicator--722bd142-35e3-4a7a-8653-aa2d06add33b", "indicator--4571bd09-3664-4e8e-afbc-4bc86c61b437", "indicator--9d0515a8-d2b2-4ae8-af34-1cf8ca3d588e", "indicator--8a60d55f-f370-4146-986a-cd2785c9288e", "indicator--9dbe7496-2207-4171-a075-b181fa6931a4", "indicator--e914dc0a-7f1c-4c72-a945-a2b4484a9531", "indicator--30d0f0a6-cb53-49e6-a810-245692635c86", "indicator--4db99947-9747-4a26-8bba-825cf6946e9c", "indicator--d4cafba9-dd55-4729-bfdd-cc11aae1ea97", "indicator--8806789e-7e61-48a4-b6cc-949f6bd9832d", "indicator--fe6cb25a-fe58-444f-895d-5657d89df61d", "indicator--5e48f0a3-15ff-4efe-a007-dbfe200d25ec", "indicator--df34a288-1279-445e-b048-1eb9a7b03b60", "indicator--233aadcc-fc39-4b27-b061-4e49ecd61e4c", "indicator--f28b7b60-1ca6-4b5d-989d-c3370bd68238", "indicator--cf37e164-9627-4a7f-8f88-0ab46b23d194", "indicator--265f9d31-accf-4e46-8576-7cbcdf3e291d", "indicator--ce2d306c-c946-48f8-af73-063239b551ac", "indicator--cb28fb34-9e59-4e5a-9289-c038c388ced9", "indicator--89a41499-f268-4e39-9a04-87d51bdd12f1", "indicator--a4e19369-560f-4c7e-8467-9b66c8d24061", "indicator--f033e75e-f7ea-440b-864e-df2ad1ae0832", "indicator--ecae62f5-edd6-4663-a82f-48f72e7754bf", "indicator--ae7b0b90-0bf2-4882-a486-f32e190bf628", "indicator--db4774e5-2861-4034-bf6e-8e5e6948c506", "indicator--79aa017a-74a2-4ceb-9f6a-09553e0c00e1", "indicator--ba091cfc-1e6c-4c7e-81ab-d863a2f447fa", "indicator--1656db0e-e862-41bd-bd8c-da7056b0118e", "indicator--dd5fc64c-898b-42f2-9c29-a6414cfbb506", "indicator--7598fdfc-3024-4889-9794-dec4b70439c1", "indicator--07d4e4b4-0e80-438f-8d86-2d180a0da5ab", "indicator--7a8d87b9-2a4f-48a9-a194-af8184fb317e", "indicator--dfbbd2a3-fd3d-46bc-9908-b5521d0ccbb4", "indicator--bced9e31-e25a-45ba-9ac9-1f1006ad1fc2", "indicator--29ab8ac6-af99-438f-b11c-93d5d2884f84", "indicator--0bdcbfd5-91ec-460c-a14f-2548b13018a6", "indicator--58fda294-3054-419b-8469-4bfe9f9edf57", "indicator--60a006ab-a368-4887-8bfe-3d1d0f46b583", "indicator--a3a29f64-c31e-4928-8f10-a6d84a279df0", "indicator--3ea5694f-012a-49e7-9229-43ac08f2324f", "indicator--4583c694-bb89-41d4-ba8e-bfd4bb93670e", "indicator--27e2132b-45f9-4e50-bb76-def0f6fb2bbe", "indicator--c71996d9-ca9a-4fd2-9a11-5711ea14cd74", "indicator--1b50edd7-441c-4bdd-9b9e-421a52dae0c1", "indicator--d26ea1f8-054e-4975-8bbb-4138cd3c1871", "indicator--9ac6a205-1b50-432b-a937-a6a1af421276", "indicator--cef2c1fb-da6b-4fec-a930-618cd8e7e25b", "indicator--bf36706e-c5ae-4575-b64d-a2a2caef3287", "indicator--fef57bbc-97db-40aa-9683-0cdc3a5cb3ae", "indicator--284308f7-377e-4dbb-903f-4a1be7fe4dc0", "indicator--28f8777a-0d67-4bde-978c-a153b3a865ce", "indicator--2cac54b1-c3a4-4e38-bf88-901a4d2cf121", "indicator--52fe11ed-6fcf-4c8e-b6c7-2679ba5e691a", "indicator--443a9bd2-c7ae-4f84-b208-97c029ce2e63", "indicator--68c7e083-99dd-401c-9721-96ec1b2b4f82", "indicator--c77b725f-d7fa-470b-ba28-2171e0c4b140", "indicator--00c9376a-c15c-43fd-9b86-7445da40ddef", "indicator--2b72a176-6474-498a-935e-109ef7fe7bff", "indicator--5cc00e08-2812-48f8-99b3-0094cce46141", "indicator--a05d074b-abb5-4eb0-ad10-37993b00f3ef", "indicator--223fc0a2-f0ac-4b29-abab-de86f69a43e1", "indicator--d11827c2-9427-4c50-9ccd-5d45ec4abe97", "indicator--016fee0c-8958-4a4a-ba96-7cee50363157", "indicator--4c2239ac-2479-4f46-9a50-0bca8bf828b0", "indicator--0d2bb406-be4c-485b-87ba-5303cb5ba896", "indicator--d9baa26d-49fd-4d3b-b727-2785d4015226", "indicator--075fe4d7-0c23-4001-bc21-9001bbe7c96a", "indicator--d4f46a2b-15ae-4e2a-b812-99ca766df61d", "indicator--65974d96-f188-4503-b431-b22d4e9caed5", "indicator--fb1d7cfc-cbd7-482f-9d9b-d7c06e1173e5", "indicator--12d8f27e-d833-4fe2-82d0-727b181cfb43", "indicator--ab970d37-46e7-496b-b56e-24da95ddceff", "indicator--f1280393-2cfe-42c2-a904-e51c495c7824", "indicator--3b2f5d6a-61b2-426d-88c0-3067f5dec820", "indicator--1c0c6787-bcc3-4f61-9720-7c3920933c77", "indicator--7e130dca-d3bf-4bbf-b375-cf756df22cc7", "indicator--a566d157-dc0b-4439-8fe5-c7fba34f4a1d", "indicator--13519a0e-a02f-4111-951d-51c206b19c27", "indicator--3d15fedd-d4cd-434a-ab60-1f8e402c5bd4", "indicator--2f1304c7-a29f-4595-b8bd-7f1342dae81c", "indicator--0883f62c-c13b-4daf-84f6-25ee5959f347", "indicator--ffe405b8-302d-43f6-bdba-86dc2360882e", "indicator--d95be460-8fef-4f1e-91d5-2a4895af7b27", "indicator--ac19a801-201a-4b14-a16e-e795793c416f", "indicator--8ee58868-6578-454a-b71e-6865e5ee4368", "indicator--b4f3b51f-eea5-423b-829f-f1fce6de4614", "indicator--aa344b7d-d358-418d-a2d5-493b2d885ee4", "indicator--61a97cd8-56d1-4414-a8d6-21ecc779ef5b", "indicator--338d431d-7e41-47e2-9d7f-7b35b44547cb", "indicator--e52e4576-65fd-4b11-b6f5-1e33b05aab7c", "indicator--377d5769-97f1-45a8-a377-eb34175ebc9c", "indicator--354a275d-944e-43f3-84ad-f5728a87ff3b", "indicator--252b1f85-8c44-4756-b71a-46e656ec30b3", "indicator--09ccafa1-7116-4d7d-a174-0e71548a34da", "indicator--d8d1730d-0148-4188-af1e-6b3d679d4799", "indicator--e58ebf49-8b50-4dab-b5d4-179a9d05d1c5", "indicator--2dce3412-3b57-40e0-a4fc-08c6543d8dbd", "indicator--e898b6de-c26c-429b-8a2d-7c322d5234b3", "indicator--a025ce21-08e3-492f-bff1-58da0fa0715c", "indicator--d70e166e-d25c-48d6-91d6-0fd47364b59e", "indicator--521f439e-7d40-4a0c-b298-f47493beb797", "indicator--9e994ad6-0f86-4587-8a6a-58f28c0db4c6", "indicator--63afbfe7-3701-46c7-9f1f-eb9a677fcb58", "indicator--b1db7a3b-9634-4196-947d-db370edb4da2", "indicator--72b722b0-b329-4ffc-914c-3f49bb0c66e7", "indicator--83c65616-4788-407e-8801-412106dd98bd", "indicator--e4b1297e-fbb1-43ca-91a7-3ea6e5484df6", "indicator--ae214441-5de9-4661-8f4c-a337fa4aed15", "indicator--fda3f5c9-83c0-4bee-b9c8-e82fd34ea0b8", "indicator--96353cd1-3d2c-4478-8d62-4910be0cf9b9", "indicator--d17a077e-d929-4fc9-8a36-20251728be99", "indicator--ea8bed3c-ebe4-4635-8aad-0ece92d6e35c", "indicator--485008ea-950b-4db0-9f61-e2ed4966eb0f", "indicator--9df22b0d-c47a-433b-b8e7-0df368bdf582", "indicator--70d1b31b-45b8-4b34-9db0-109e728d8ce1", "indicator--c3338e02-fb46-4789-992d-da8faec2ed7d", "indicator--ee7b16b2-8460-4ddd-8967-5e3e42a35a44", "indicator--41522016-a440-4579-b3f4-c59ed38461ff", "indicator--ba191ea3-30e4-49ce-8fd6-7402ab09cd41", "indicator--edbb2769-1c3b-46d4-8217-d4a55066acdb", "indicator--4c13b554-e94d-4fa6-b854-3764c99d8f53", "indicator--6a4c69ca-9c96-480d-8c80-a08ad7775a8e", "indicator--a706fa2d-9fc8-43b0-bbb1-d4310e1f6516", "indicator--bec6051d-b171-4393-a411-2ded3fb8ed97", "indicator--34d65e3b-b2eb-4fa1-972f-09c6bbc13eae", "indicator--1235342a-94a6-4442-9225-f5f930435c47", "indicator--2eaf1c71-e3d8-4f68-a8b1-261af73275ff", "indicator--9a33cb3c-5e81-4f8a-a03b-c6d4f72da000", "indicator--cc63d8af-dbb7-4cec-9163-6376045183d9", "indicator--ea5e095b-9921-443a-86a8-2db05f24358c", "indicator--5705f04a-4410-4045-9add-adbed55a74a5", "indicator--24d21a57-341f-45ac-a479-5e84a50b0257", "indicator--5425bc29-e571-4efe-9f25-ac11a1078402", "indicator--e845e370-b6a2-437e-868a-380dcc505c0b", "indicator--044a5efa-13c7-4940-bd3d-51ca5addc1da", "indicator--84fac8e9-f374-45f9-863c-15a356b445dd", "indicator--468a41fe-6001-4831-bf36-f333bcd086b4", "indicator--b918f63c-d319-440b-b0ee-eed4afe577b4", "indicator--b39cfe8f-1d33-4901-aa6d-d4a551d47c24", "indicator--4237bdb3-9bc0-45cd-bc26-51b3ac52350f", "indicator--c1bf9aa4-d680-4604-b6ec-c6b066ed2367", "indicator--47a0e6a6-3320-4ca3-9f70-26e9dc70a9b7", "indicator--9857817d-2952-472c-ad0f-0ea0ff77ead2", "indicator--32e92fd1-38c2-4f2d-973e-a4aadda85faf", "indicator--970bfe5c-00f4-4e95-a44d-42fdd2771570", "indicator--b05533f9-0da8-4681-8952-b946528673fb", "indicator--f8c53bac-7848-4bad-b526-84011aced080", "indicator--fa67235c-1706-4003-9628-0c468ea2c4f1", "indicator--237fbc65-ca09-4316-9de4-b02b330b2065", "indicator--c7d5e78f-c0f6-410f-b7fb-c97177ebadb3", "indicator--5eef1a5d-a5a9-4880-ace6-bb47e2e1d4ad", "indicator--f5eba141-674c-411d-bda5-52a4d46c89f0", "indicator--fde0ccf9-8a36-40f2-b070-6538a78e4c4a", "indicator--34791432-d6e7-470a-ad65-6bb41a44fb0c", "indicator--1a7dd36e-b234-4590-aac8-2ada8c4318ec", "indicator--533ffef0-c48f-493b-8e31-cfb74f8c2d3c", "indicator--368d54c4-f962-4d18-bed7-0b5288108cb4", "indicator--e59396d9-a254-4e3e-b5b9-7600d2451739", "indicator--b231cd22-fa21-416c-b936-ebc5b8a55f53", "indicator--6f93a9ed-02ea-46ad-943a-db5e749161b4", "indicator--3382a9aa-eeee-4ffb-a7f6-ea0bceff0558", "indicator--e14ef516-f6a3-462e-935f-946972749c80", "indicator--6941bfc7-b6a3-4d79-a450-6c0bf9cddc45", "indicator--3448c4e6-7e9e-43c6-bfaf-83d034ba9ea1", "indicator--28d56305-b81f-4125-a0fb-69a18c5b5558", "indicator--9e56ad94-f36d-4822-906f-555aefa15362", "indicator--20650e22-e931-4b6d-9469-14c993718c05", "indicator--ae9864cf-63c3-4c6e-802f-41fc28c62010", "indicator--875abcf3-ff62-4584-a716-3e9f40e717e7", "indicator--286d4f5b-cc9a-4c37-ab19-d5ea2701112d", "indicator--398c2513-7c03-4e5a-8272-06a940c3eb06", "indicator--943d6563-7266-4a3a-84b8-03d4b8aee2ec", "indicator--25317f74-ab86-462b-ae16-6c4d5222c5a7", "indicator--d5a2f639-8f74-4720-b0e3-46b015d59d80", "indicator--01a57ea7-2757-4ee7-a408-76255423ba91", "indicator--8078e8b7-eb08-4dbc-9675-41991a22a3cd", "indicator--9bdef2ce-3682-4402-bfce-c6ec973e9eb9", "indicator--8e4074ea-ae78-4201-b341-ad0fc14fb509", "indicator--b1ba492d-fed5-4c65-8264-5d2302d16452", "indicator--71db581f-e1f9-4817-b568-aa9a77aa765e", "indicator--23d197a2-7cc8-4aa9-b238-7c615f4b7949", "indicator--6d91d524-fb23-4ad7-b0a1-da68643f4840", "indicator--de34277e-301a-4c5d-b2df-ed5d2cbc9dba", "indicator--4eb843ce-23a6-4781-af2b-5d1dc63f921c", "indicator--fb70cac2-43c1-4890-b629-1355f650db22", "indicator--90f208b6-6a92-4c12-8cef-f21688931ec1", "indicator--507acd6a-7fbc-4b15-8570-d04b677c58b6", "indicator--1707f650-3f50-4ee5-94f7-5498f18f9624", "indicator--6a5e5f70-d53b-42f3-a110-23218330dfe5", "indicator--348e324b-d2e8-4b25-92b9-1e01cbd43da7", "indicator--d11fecdb-8d49-4075-8033-b197b6dd6c0e", "indicator--513b1c43-ade5-4942-8f2d-b26d8f1bcdc0", "indicator--3be79b83-673d-45d5-b0d4-59b77da9c79b", "indicator--d4647c96-87b4-474f-85e1-62f02b578b05", "indicator--b828fb6f-37d1-45d5-b4a9-7709ceba8ef4", "indicator--b2906b66-1a9c-4e53-a328-b30ffadc8110", "indicator--ff07c411-70fb-4086-ba55-f015f554b6b1", "indicator--64b039e9-f0e6-436d-95be-ec9b6f838063", "indicator--8496e19c-f77a-4be3-bf08-553ec649757d", "indicator--f5290cfe-2b0a-4cea-84b7-b251f093b884", "indicator--5de75201-f674-42a0-b58b-166ba0fe3746", "indicator--4e2d3416-bfd6-4490-9808-60572c1f4564", "indicator--41af972e-2e2f-43b4-b8fe-c5fc2eed1cf1", "indicator--e4131ae0-4fa4-45bf-8f6a-690a217188bc", "indicator--afc54c7e-dcf3-4030-ba38-5db0ba8149cf", "indicator--e79fa6bb-42b7-4d27-b2eb-ddcc038804dc", "indicator--fe3777e4-1d23-4be2-97ce-c69b9b327a03", "indicator--bed8e47a-a210-4d4c-a9a5-b1bc00755990", "indicator--c8a5d70a-c9a3-45ed-ab01-68aea1840170", "indicator--c5fbda0f-bd83-4b90-826a-b4d50fdbc9c0", "indicator--f35939eb-3f40-45fb-a0c2-0767922335e7", "indicator--5cab0883-433d-493a-9d36-be5de2a88d55", "indicator--6be30e5f-3bff-4e6c-bc20-1023fa7b1530", "indicator--7cd963b6-d19b-4078-a189-8927384106f5", "indicator--5f9331b8-344c-4e07-85cc-a275b1569c0c", "indicator--43380112-17c1-4351-86d8-70a723831585", "indicator--0e42f056-34d8-4827-8057-7587a5a9982e", "indicator--9d5e457a-f28f-4b7c-8887-49e82a1b62ac", "indicator--a1904d02-c79f-426f-b370-e5b80c0292b1", "indicator--9ffcc03d-c6d6-463f-bdfa-4dd2b0f01b0a", "indicator--a0a9777e-9d53-4af0-b145-a93bd2d8b372", "indicator--b532779d-7c75-4211-8814-afa945ae5694", "indicator--18779310-88a0-481b-8c01-b068db691661", "indicator--7e530844-6577-4c11-8b1f-ff7a8e7dde9c", "indicator--353f11d1-c56f-42aa-9f7e-3a7f12138b33", "indicator--3dcd59bb-f869-4ba2-8a6b-8231b46612ac", "indicator--af5983e6-5138-490c-a45c-56cf93bbb472", "indicator--606e8dc4-ff88-4a75-b6e5-7b6b23b568f8", "indicator--fd340744-823e-4add-9f07-917e8a15cbab", "indicator--6d6ca652-2c49-418e-b19c-22aeec9d6d26", "indicator--a1bf9ea2-b35c-4245-8fd8-5fa5d3356925", "indicator--6335718c-17bf-4075-9fda-3e9c9c28bbed", "indicator--3d3f0d7c-d314-4659-b598-c100ea937d17", "indicator--71cc76a9-7ede-4d7c-a496-8bd58f3fd850", "indicator--30677f0a-e209-459d-9e57-02de7fd62ef4", "indicator--08ef4d38-6f47-4fe4-9993-b4fe390e45a6", "indicator--185993c6-5173-48cf-a19f-568b69ada4b3", "indicator--1565b883-c6fc-42f1-9ec8-3a2d2283036d", "indicator--6555ed70-1f4b-4558-b1e8-27fc72886d56", "indicator--3a682916-a66f-4eb0-ad7c-ad2bb5f9c63c", "indicator--10b9ff7c-152f-4292-993e-de81d4e3a3f8", "indicator--8a9077cf-5f65-424b-9918-bedc6226871a", "indicator--de4eeaad-8ed0-419a-8e5c-74be9301fc60", "indicator--77f319ce-6f06-4372-95cd-640695e2b4a6", "indicator--4621b2a9-18c0-427b-90ef-4ddb2c34fcaf", "indicator--e3bb480a-8df7-4e3f-be41-008bcf5ee44a", "indicator--c22dee42-9111-4b2b-8c5e-c320719644d9", "indicator--cc7cc18f-387c-405a-9ff0-63b90d45adc9", "indicator--466f9a22-04b9-4f33-9d06-5b62e34572c2", "indicator--ecb8238e-b145-475f-9097-abc3b01008d5", "indicator--da4f13a8-4272-4e01-a869-35420d94865a", "indicator--83163cd8-a43c-4d34-b776-bb8ca1eabc85", "indicator--2b0727ca-48f1-4bea-989b-ae4699a05f8d", "indicator--9d551707-e70e-4dc1-a408-9c094fce5ec0", "indicator--a426eeeb-849b-4390-bfdb-89c40b293948", "indicator--c9fd3ad6-868f-4142-adca-b5c7b565b12b", "indicator--6e4a78b1-feec-48e4-bf07-90b3f577ee28", "indicator--07f814ac-f52f-4c2b-9d52-5473f4db0bf0", "indicator--cb870bb3-c054-4ef9-92bf-7f026f9183d8", "indicator--a4c0f586-49b6-4315-8822-d21d7e97b206", "indicator--7c934be5-8593-4533-bd9d-11c125ae5408", "indicator--ac827907-bd6b-4623-8f68-62e5201ca8ec", "indicator--4f9c8c30-00df-403f-9b1f-23e64b73a2ce", "indicator--1f6aece5-96fc-42f5-bae9-1bfb4dfd9995", "indicator--751f7b5e-78b8-4995-867a-d55ae50c9844", "indicator--0a32b78a-db0d-4b94-be9a-82ea214f682f", "indicator--fb30b8dc-10f6-4d2f-9f7d-4e552cd6c3d1", "indicator--898a4367-0436-43f9-a223-81e6eb075c5e", "indicator--4e01b8f5-a33c-4b1d-8554-02313b512666", "indicator--3407e368-26c0-4200-bc0c-736bdef285b4", "indicator--61f0005d-0e08-49d3-9121-42af44243844", "indicator--92be8578-2380-4083-b9af-ca0ba0fcd0d0", "indicator--1b0fa374-9b15-4986-b308-3a88a191cb99", "indicator--0a374bd8-7ce4-4cdb-9070-a4f012979b0f", "indicator--15e20f8e-41be-4ab1-8505-61a043cf1eef", "indicator--e636bfb8-a9bb-478c-a194-88a9caf71dbc", "indicator--6c8e335d-3768-4912-8253-ce8abceb6fc5", "indicator--13510a2a-4517-4b54-a1c3-a143027faef6", "indicator--20de7fb6-f196-4406-943d-3fd1f33628b5", "indicator--2c21faca-e138-4720-8817-dec925505591", "indicator--b023e351-b136-463f-aae8-e3a01ddae265", "indicator--1c86e357-3003-415d-bd7e-0a0a46d22d19", "indicator--c54e8fec-24d8-4a61-9c08-e42821e3ae11", "indicator--fe26415c-3cba-4aca-881d-e816ed1190bb", "indicator--d101828d-82bf-4ace-91ee-774d3877b6b8", "indicator--e7df497a-1c31-43a6-af69-f030298e577d", "relationship--26cd3638-7f41-4ab3-baa8-2f6e2c5663bb", "indicator--c37d7061-89af-4889-8858-3dc88bb1e23a", "indicator--761233a3-db30-49ae-b67a-bc94b325743b", "indicator--bc4d65f0-3ea0-4cde-88c2-5fcaa23b461f", "indicator--c9b988eb-8145-4a0c-b021-74a1459231b4", "indicator--fd3a8b43-0d01-466e-9feb-40f41dfcc9b6", "indicator--2092de39-96b3-4c9c-9ebb-d2f6284544d3", "indicator--b28eaeb8-13c2-47e1-8646-bb75a1e35622", "indicator--c7b71e82-ab7c-408b-a513-2d91c51cb92b", "indicator--b30bf974-6310-48c6-83ba-3e82bb71b4c8", "indicator--e9eb1b6c-991e-44dd-aec0-ed0b83981acf", "indicator--051f847c-7aa4-475e-a00f-9500ed8db997", "indicator--0bedfb3d-c6df-4bf8-915e-5855dfe8824e", "indicator--757feefc-e414-40ae-a89d-3621d921f9ba", "indicator--f54ceb11-c597-4836-97aa-9f8df05933e5", "indicator--72095bdb-0939-4890-86a4-12ca42278b83", "indicator--ff717afd-e6ad-4579-b8e8-c2e0cbf7dc04", "indicator--8a5df5e8-f87f-4281-a54f-e817c581b024", "indicator--a05fe2c5-c4a7-42c8-a9d8-2f5cd9e4244a", "indicator--693b18b1-f55c-45f5-917b-c96dafa8b68a", "indicator--27925bab-4453-4cf2-abdf-5776e474becf", "indicator--0fbd210d-d2e0-4a9e-9ae0-fe9bff02bc2b", "indicator--5234521c-d93c-4499-9c85-cfb640720b2e", "indicator--7205bab5-96c9-4681-a03b-b7d93d63d658", "indicator--7fda2553-87fe-42ce-94ae-1eba7b1b5950", "indicator--899959b9-9882-477f-8d59-afd99d4fc760", "indicator--9cc18b46-7ddb-4aa7-8dc5-e3971b1bfeba", "indicator--11a18b74-6d18-4f2c-be1f-770ccbc1de28", "indicator--1859b310-e3c2-4161-94f5-97222669f9b6", "indicator--7280af9c-6fcd-4f83-821e-b1969bc9488d", "indicator--0bc8d39a-b168-4c2a-8457-b32acf61f996", "indicator--7e9a0e1d-ad21-429d-b925-d600679c8604", "indicator--0936f79b-2640-40f6-a7eb-384a35651970", "indicator--30a39ae0-7a64-49b7-bdd1-73a83ab0d589", "indicator--b5ef40b6-a2f5-4bed-9b22-c13c07d81b0e", "indicator--5f0f341c-8afa-4982-ab1c-379ac16e83e7", "indicator--5a96756a-fb74-44a6-be45-730995e413fe", "indicator--6bfb2f91-d944-49b2-9dbb-311bea33f8b3", "indicator--19b4c83b-a400-4262-b24b-d9b406ba6f0c", "indicator--3f7fa2bb-8b76-406e-ba67-1ce8c179daca", "indicator--77956576-3dc1-44e8-9bfa-a1b1f5feeeab", "indicator--a64def3d-fafd-4385-ac24-05d269dca642", "indicator--15888acb-854f-42bc-9111-94ab00d286c3", "indicator--136bdc35-a9ba-4f4c-b19b-dce8845142bc", "indicator--ef235141-0882-4f07-af88-cf4aad192a38", "indicator--f6034255-a797-4d19-9b13-9bcd1f1d1a2f", "indicator--b22dc229-0b8c-4dc2-aa37-c6f44ec33ead", "indicator--4e28b169-1941-4d9d-9f3c-9b9c35bb31ce", "indicator--77c87022-64d4-46d0-a88f-2599210fe993", "indicator--76c8682d-eb06-489f-9c48-3da3443fb1a3", "indicator--205f7ad8-0fa3-401a-bfd1-3f7f97824711", "indicator--26b5cf9e-0999-4b57-8477-528c2d91d4a5", "indicator--de055a6e-781e-46e2-be46-94da3ddc406b", "indicator--d833c44e-9d2b-4fab-bc47-4c7ebd97412f", "indicator--5e56f304-45a6-4c03-b342-5e017ae8ba82", "indicator--f6441f93-b96a-4bde-9872-b165bc7d1528", "indicator--cd5d28a0-0e68-48d8-9187-4c89f2fc63e5", "indicator--afd4ed5b-fbff-42c7-81b2-2dc1f643fd05", "indicator--3b93c95c-774b-4ade-834f-1a31a2643965", "indicator--3eab13ef-be98-419e-9079-e9f7dc145145", "indicator--4a5f4309-f7c7-4832-95f9-e50a38ac3af8", "indicator--610a5544-1edc-4fd4-bc78-97211c36c7c7", "indicator--d1c5a2fa-ba43-4bb3-bb33-7e24855359c0", "indicator--621a789d-fdc4-4ac8-a732-989820e78bf9", "indicator--f4ef6274-73b2-436f-bff6-f9eb8caa8680", "indicator--841e92df-7464-413f-92b2-31462bece2e0", "indicator--5f7091bf-5753-4019-8be8-d558e0bbdc8e", "indicator--1ac9261a-042a-4f54-9923-5a31082215ef", "indicator--6375344e-eb21-4a82-b8fd-72d1ac0f1be5", "indicator--128c5dbd-74c0-4e7f-9b1c-393bbd908f35", "indicator--ccccd2f4-e056-448b-aba5-3ec96c942878", "indicator--c5e38149-cc03-448b-9f81-75cb8fa4582a", "indicator--4952a93f-bf9c-43a9-a6eb-c9f3336b438b", "indicator--be93b073-ebe8-4524-b4fe-233aba136bab", "indicator--c16ab0c5-a7e0-4a50-b74d-46e9c9434e2d", "indicator--7fda945c-7fcd-4bfd-8547-3b7b756df01a", "indicator--687aee26-156c-45de-a7c5-78a52fe77f92", "indicator--0455fe80-a975-4de3-a650-867287f29c59", "indicator--881f08d1-fe44-47e6-a499-900e88a1c64b", "indicator--5d115586-27b4-4a03-9479-7bdc66b5294a", "indicator--9732ad86-cb49-4ce3-b3c7-bdee6e31db3c", "indicator--b5cbf01b-4845-490f-adec-8a66b7b05cb3", "indicator--86ec5162-230f-466c-bab9-cae200b46b8b", "indicator--2a9f9ecc-3c99-4614-a2f5-b040a1825f7d", "indicator--44eea611-88a1-4b7c-ae99-bffe7a984af4", "indicator--e8dc00a7-a533-4c9e-837b-4989cbbf3d71", "indicator--812b9ff3-2dcc-4d32-a647-9848b25bf10a", "indicator--552262bf-e30f-425f-a52c-c5e67fdb3255", "indicator--842f3f0e-a337-4d84-bbeb-2e740f51f397", "indicator--4866e506-f7df-44b6-b6ed-6c4cb1159304", "indicator--c665ce33-6de7-4f3a-a61d-7b651046e600", "indicator--8d882a41-b308-4a8e-9a2f-d526bc399207", "indicator--ecf81182-6fb7-465f-ab2f-8caa9552d175", "indicator--8be05856-36f2-4849-8ee4-8753197d0584", "indicator--2f7baec0-9eca-4b34-ae97-d4d59bc9c77e", "indicator--39cbb1fc-a62d-4bec-b471-964b50bb1880", "indicator--4126a76b-1b45-4343-8224-462272bb5b5b", "indicator--83c0b2f9-0353-46ef-8379-2fa67af0e162", "indicator--a5872d07-050f-4025-9998-1622df34ef3f", "indicator--e7a86871-2dec-48c8-b809-7d00c2083808", "indicator--9748ac0a-34be-41af-a13e-ef4a0e019b2f", "indicator--877d0a2d-0b36-40e2-baf7-f2c4c0ee8919", "indicator--4593f5fd-c566-400b-9e2d-909261c56f4f", "indicator--3e8f518f-335d-435e-97a6-ba90cbf7d682", "indicator--f09d0a00-65e4-410f-831f-91d14bcf8590", "indicator--1ad82a20-d101-4cf8-bac0-876f2c48e5c6", "indicator--1e9cfaac-8655-4885-9f14-b80c084f3497", "indicator--2b85444a-a6ac-4e1e-a706-d947cb2b1102", "indicator--7b086658-95c2-4371-b3f5-504860578452", "indicator--13ac4d61-24ce-4bde-9d87-4f0cc96a593b", "indicator--679252ab-3d4c-46ac-bbc1-5a87a68a76c1", "indicator--c837e305-38c2-48ec-93d7-9e065ef186dc", "indicator--28612105-3519-4043-ae10-37880cb52029", "indicator--017720cd-6337-4bd0-a42b-3acde46f14bd", "indicator--e30f0b6b-202f-4ca3-9bdc-52a4f7639895", "indicator--21d71e34-3763-49b1-8872-d1f2e47bc26e", "indicator--ad1aba45-936e-45a1-8f33-6c379b210fe4", "indicator--30ec6769-7a23-401e-8a2e-de96cd6f7be1", "indicator--8a549b5c-e633-4c35-9ef3-e02a96df7078", "indicator--9118491c-3545-495f-89d8-e74ae74e4cd7", "indicator--8c896c45-e9ef-4a1b-9f10-345ede57c862", "indicator--fa9ac5a8-66a2-4cb9-90ea-2072590deb7c", "indicator--cbfcb5df-c19b-4a38-8973-6e11842ba1c1", "indicator--e8b4c6bb-5937-4f0c-9bd0-7fbfc9470427", "indicator--af372c6c-987b-4f87-a8ea-f19330e9d878", "indicator--e3c55dab-9a8c-4d80-a812-497f502c04e1", "indicator--358cbd3f-9684-4f82-b35e-ce26affa50ff", "indicator--36a74141-c2b6-4a7b-80fc-879251237939", "indicator--6d90ea7d-76b7-4538-9c80-731ab832cff6", "indicator--a1bdf1fa-faae-4400-ace9-badc8e88d15c", "indicator--efd7c2ee-80fd-42bd-ba39-6de1299e6712", "indicator--e7e1eaa3-2774-41c0-b090-9b71ec0ff13c", "indicator--8d630f2b-1ab8-466b-ac08-c38d7d963cbd", "indicator--d670bf9a-95d1-454c-96e3-e17398fa95ca", "indicator--4cdfc9e9-468a-4f7a-9ec7-19812d73a090", "indicator--c8e35cbf-4432-4b84-9cff-88e9ea36d3db", "indicator--c87c47a7-9a65-47a1-a4bc-c3a35f025ea6", "indicator--759e51db-d1c8-4b91-bb7b-3c1ac45dcd6f", "indicator--247f5453-69be-46b0-b0bf-8c173aa28768", "indicator--a901b6c2-03d4-4040-8761-e2a463f7fbd3", "indicator--f0b952a2-3fdf-4509-9d40-7fd300b996fa", "indicator--4e1750d4-03d5-4af0-bd1c-7db6e302e506", "indicator--edc2cf0b-1026-47f7-aec1-d9608a00b8c0", "indicator--b84842a9-a3c9-4756-9c8a-14b39cb3fc24", "indicator--787e5470-76c5-4dec-b34e-2abe294cca77", "indicator--a00edeb0-af2e-49f8-953f-2f6bf920bd0c", "indicator--27834796-57e7-4e8f-aacc-e21a17a90ef3", "indicator--6c8d7ceb-ff1d-4130-9e9d-cbfa7bacffed", "indicator--a0ee727a-8596-440c-ae29-2ecaa0ea7633", "indicator--f661a781-9c0e-4974-b574-69e4fdd996a5", "indicator--30da26b1-1ef1-4354-a6ca-b0eb9f104815", "indicator--1d039686-9c78-43f9-b38d-ee4ba65e91e4", "indicator--c15f4379-a383-4500-a713-336497f51685", "indicator--31c2d0e4-526d-45a9-b437-bb3e9806c3c2", "indicator--a0d198cf-2dde-46c3-ba51-9b885f90d4e5", "indicator--a4a52507-b0c9-43ee-a468-f269709d325f", "indicator--de586cbd-11c4-48bf-b743-c715df7384fb", "indicator--eb905c68-cd99-4fbf-bedd-1f35fee6e0cb", "indicator--3ae4d162-de9a-41ec-91a6-d1d0d0707160", "indicator--0a42b3ca-7e0e-4059-8ef6-087bd57b7e91", "indicator--06b69e5d-7d55-4020-83b3-31e2285325c4", "indicator--26a13a40-2bc5-4471-ae07-963f5d3a0f1f", "indicator--c7b0ed45-c18a-4f9f-b7d5-2c712db442be", "indicator--054e9269-3a25-4c02-870b-f91b2cd034c3", "indicator--c9bb2fd3-2f68-49a8-9199-75c90adee955", "indicator--8eefc1a7-ebc9-49f5-af98-539cd1a5a953", "indicator--a61db3b2-1b86-4854-8e8d-e9b39833bf86", "indicator--f753ad74-144b-4e5f-9cfb-8ec418e4d26f", "indicator--f6fc6822-63ed-45d0-8021-6b4c67dcd40f", "indicator--8d874103-da06-471f-97a7-bde083957bc8", "indicator--134a22b6-482d-400a-85d2-3c7dafd49f11", "indicator--9879504f-b564-45e5-ae61-eef8e5d9ebbc", "indicator--0e79bef3-93ed-4b40-bc1d-08c4cb89e5c1", "indicator--6520e377-8e8f-4206-a0bc-c7089e477fa1", "indicator--15e31c0c-2cec-4ca9-bcc2-254ce0bd3144", "indicator--e6a24f48-ef2a-4fa3-bcde-d4bc168f6fa3", "indicator--7af0edbc-a941-463b-bce1-fbba9902b025", "indicator--ae04c7fe-fdcb-4760-9d93-c908de8b5de5", "indicator--7c5bc298-95d1-4624-99fe-138477cc6031", "indicator--7365ec0e-01ec-44a7-a6d5-6728aa892cd6", "indicator--dacd001b-7803-499b-982d-eacd61818fa9", "indicator--92614552-d959-4ad7-bf04-76b6cd557fe2", "indicator--32189ba1-7f8d-4d63-9d82-4915d151d0d7", "indicator--47faa61b-83b3-44fc-b5d0-a27c1b728469", "indicator--29b51828-9f8f-4f99-b7b7-25ad58b6e920", "indicator--9b4dd6e0-f27c-4d15-99d5-e247215f9f6e", "indicator--53fe4077-eeb0-47c4-8226-1f492a20815d", "indicator--641abc2b-f76e-4ad8-94f9-880cf27a32fe", "indicator--564aa57c-1813-4b2a-955c-9e0055e3b28c", "indicator--55debbef-1270-4565-a983-d2b0f0078ffc", "indicator--53591e88-1d9c-4894-95df-bc7acc5230ad", "indicator--fa0de050-49af-4112-8a55-ff28759b5ca0", "indicator--87d19749-fdc3-4aa3-b2d4-5648da80fc37", "indicator--94b11708-9915-49d6-b466-ada67aacd008", "indicator--85db5294-00ec-4677-adcb-ed5d89571234", "indicator--f6d6fa97-e7b1-47cd-82f4-aebbc5f4da77", "indicator--0c38b7d2-570d-4c1d-b440-75e9c6a06a34", "indicator--9738d205-0a6d-4e51-8aeb-330f66fb7777", "indicator--9ce52dac-9e36-4cfb-b9d9-34937d18972e", "indicator--de23a4f3-002d-4fdf-9128-edecd4b9377a", "indicator--37d1e6a9-2449-40c6-87d4-43b8f23296c3", "indicator--e1cee7cd-afd1-4d75-bd4a-1d5bbbb10137", "indicator--3e38bcfd-2c73-49b8-a5db-62aaae872e6a", "indicator--d2cbad84-e817-4553-8ef9-74f1245ead76", "indicator--cf9cfa80-995a-4594-beb0-e260a556f961", "indicator--11540a4a-1c83-4f9f-83f5-29b9eeb3fd2c", "indicator--bed32624-6393-4ff3-a52d-bc8cbe29681c", "indicator--4a5376db-1598-4110-95d0-7dc4f5f8ce44", "indicator--bd9b993e-d70b-489a-931f-1d8fed61ca63", "indicator--578c283d-2c50-4880-9790-07354ba6059d", "indicator--b3eb51e3-9541-4fab-a5d9-ae36e4821619", "indicator--5e1816b5-4f66-4f96-8110-fe3e489ac2a0", "indicator--73234575-3ed2-4a1b-96af-73e19f5028b8", "indicator--a58685eb-45fb-400c-8ad8-4946964e0ed7", "indicator--a6c73366-c2f3-4a92-9169-aeb83313d3ba", "indicator--16eabc71-66dc-40f2-9855-08a4aee088a9", "indicator--92e2d36b-89f1-42fb-955e-d59862cf97eb", "indicator--676a2cc3-670b-49fe-830e-633ff8058c34", "indicator--97e4a6f4-c030-4a04-8b5a-c64449a6c348", "indicator--05973f5d-f536-4ad7-8876-d79c2e827063", "indicator--1301d1be-044a-498b-b8e8-27128cc39597", "indicator--1c44a614-863f-4e96-a996-16030b581a40", "indicator--332c14e4-9b34-4a40-b5a4-b9b8aa6e41ee", "indicator--d189775c-1663-4165-81be-0159d84beb43", "indicator--a11bc446-8da7-4c2e-9da4-06d004647ded", "indicator--dd9140da-a24e-409c-89d3-f3c7681f190d", "indicator--c6e993fa-8f2b-4f5a-bc10-bf20c40795e7", "indicator--33572c60-5415-4d39-a32f-ef6bf530bedf", "indicator--505dd22f-bd6a-4e62-b684-9fe9b0a5d36b", "indicator--c8f7b070-5869-45e4-bc87-50a573f57544", "indicator--1c6e1b3b-26c1-4ab7-b94e-74cef096ed3a", "indicator--5ffd1355-7375-422a-af5f-ef321b29f780", "indicator--b3ca8264-62ed-423f-a304-47ead4ec9e3a", "indicator--0abd5ed9-8d36-41fe-8509-fc8a23acdbde", "indicator--a8db20e1-e8c6-40e7-959c-79eb86ad4649", "indicator--451b52c9-49c4-40b8-a865-e151127ca6a1", "indicator--6c55bcc6-8470-4982-ba3c-0a4e6598bf95", "indicator--fd030a86-ceb6-4f4f-8537-157a3cd303a0", "indicator--7f0aa286-d1ba-47fd-b643-12340a4eab07", "indicator--18e45c34-2fa5-45ce-8fd1-9e83edbb3cfa", "indicator--35086ce3-01a2-4232-8ca8-975b2f914d14", "indicator--1c6a733c-900e-4607-a187-e2aa7821bb4e", "indicator--58e6fc30-8a00-4feb-b203-20bde0878fe8", "indicator--f838b57e-0dd0-4dea-80b3-5a1725870272", "indicator--899a6328-89b1-48ad-868f-65cecc390686", "indicator--bd249c89-8ee1-4ca1-ae0d-b104d93de28f", "indicator--b3fe8110-3e2c-451e-ad4f-1abfe3f151d1", "indicator--eadb481c-4279-4f3d-ba94-7985ee8f810b", "indicator--808a5adf-af01-43bf-81f4-d35933141897", "indicator--5ec55806-95d3-4023-a195-bf19ae9c3b0f", "indicator--62ca6617-6fc9-4f68-9c46-69da3ba96b73", "indicator--cdadfa6f-cda7-47e0-b8a4-158feaec888a", "indicator--d6af5bff-61ba-4681-aedc-401973d1d117", "indicator--41b46a3a-20d9-4521-9957-94f5f9b766ef", "indicator--577a7979-15ca-466f-a141-a8f4b7ea4446", "indicator--efeaf84c-75dc-4cf4-aeba-dc6cbeafdb46", "indicator--97d0c359-7d45-459c-8bb6-9e929ea0347f", "indicator--428a4578-3c68-4451-81bd-b99004e5e165", "indicator--5b62f9a5-533f-47b7-92c7-fef4c81f244e", "indicator--3b7cba2f-18a0-4863-9ef7-ce7f376a00fb", "indicator--2cdac179-bcd6-48fb-b83d-9b868491ac6f", "indicator--8b9be3d1-fff5-4598-840d-a315274a9180", "indicator--2c909c29-f054-4c37-94bf-9872a4773ae3", "indicator--67d3a64e-5d1c-480a-9675-3efbeafac269", "indicator--d00f06dd-872e-4d2d-bed4-266b9899d934", "indicator--41e1c2ad-9350-4e27-99c6-2931f89757b9", "indicator--c3aa98b8-ebb9-456d-a447-6bed384be92e", "indicator--76d78cc7-8137-4383-83aa-0c50e8b53dc8", "indicator--373ab179-a9d8-4f11-891a-e0a950a00406", "indicator--affc6048-e35b-49ea-b538-eee2129783d3", "indicator--e8a83ae2-7d9d-458c-b257-5c9d9b65a716", "indicator--82b62d93-01a2-4d5b-927f-c99a9396302a", "indicator--944acb58-f15b-46e2-8392-d29a40659351", "indicator--97fadebd-0491-4dcb-848b-b24a5774bb61", "indicator--ec72a8ac-4916-4f1f-beb9-9d3d3f3de780", "indicator--695c339c-6b71-449b-9fe2-513d937908bd", "indicator--7d8ee32b-2ab7-4fee-9f17-976ded76a750", "indicator--bc7efb7e-b467-498e-8975-06ffdf7a127e", "indicator--34577bee-537a-41a4-bf18-b6e504d2d101", "indicator--4bc71f99-fd53-4279-a9c2-dd3f635b0d38", "indicator--5cfc349c-715f-4195-869e-fc608a23de9e", "indicator--145cd8ac-473c-4dad-8998-d3a0f501113e", "indicator--a7c2a1a2-1560-4c9e-b69c-a58d104ec045", "indicator--5a05efbb-26fe-4d03-93ac-62a709d9b50c", "indicator--44ac4578-513a-4056-9063-6af2a481100d", "indicator--0910fcd0-a1ae-4137-b8d4-9601351b54c9", "indicator--8ee7fb34-d734-44d6-be52-514e4b6ef109", "indicator--718d3540-17ba-440f-b976-1cbe59757c0b", "indicator--493ebaa6-db30-47a9-8c90-a126281e6d98", "indicator--e35220b4-5ba3-4bd8-addd-507ff48ec8f4", "indicator--a62fe4b8-ba61-4dda-8904-be459e20802f", "indicator--283f5367-f7dd-4248-849a-a13050c8f07e", "indicator--4513a855-e49b-4ea9-8104-f8e818254832", "indicator--8b71d552-6096-4c43-ad74-0abb22152cee", "indicator--a422eb66-6ea5-4f4c-a03c-e8caaaa8591f", "indicator--2b1caf7a-e721-40be-9368-311676103b88", "indicator--076107c6-4fcb-46a6-b85e-737ab12d2f48", "indicator--36cfeb16-74a8-4941-9986-55aab2b8976b", "indicator--abe8d3fe-6d04-452d-8de6-11c5350677ed", "indicator--a50c0627-86e1-4c1d-8c65-402dd218c620", "indicator--910a5c2f-3213-4055-a022-3981f3a7af8d", "indicator--5bd94096-f6df-4257-96c1-79f49d2aa55d", "indicator--ad5ac303-882b-4adf-9908-2e91ac74c212", "indicator--e05ea35d-06e5-44b7-834d-677d0df39a0e", "indicator--4eec8021-cc05-4d1b-a76f-77cb65da8a32", "indicator--195422dc-3ec6-41cc-9df0-69d93ddb4ee3", "indicator--1d607e83-b6e8-4ba5-b48f-216caec18c46", "indicator--c5a5bef3-f44c-43b7-9ddf-2c747614312a", "indicator--2b5aa3e3-6d1c-43d2-af95-5740f8400183", "indicator--f49216ea-c1fd-4ddb-a483-658786b2b903", "indicator--7aef1bff-32ef-443e-aa38-e8c8f2794c5b", "indicator--7acdcaa5-3393-4c32-ab0f-e991f63bf8e3", "indicator--42a6d602-ad96-4717-ad36-c934032586bc", "indicator--12a8d845-2d1f-4bef-89ac-ef1d5a0b5b3d", "indicator--5a1209eb-5122-4767-8a94-295cfbe41ee9", "indicator--71c5d082-a45d-4da2-9616-e980ac12e4b6", "indicator--e6198b76-d7c1-4a2b-a9b7-40c65bcb6e69", "indicator--184e5967-b533-4b43-81a4-600dc85b052a", "indicator--62984575-2582-4375-a78f-686a0c0f474e", "indicator--c908141e-4c26-450c-bc52-d55adb173ad1", "indicator--119a8007-517a-4763-b9e3-9ec11679faec", "indicator--a0e8df2e-4044-4581-878a-70032a0c6e1b", "indicator--db2ac6e6-0239-46a3-9d64-879e1f798faa", "indicator--ac4f004c-e84f-40c9-8fcd-e6e05724dcc7", "indicator--e9f60518-d725-4fe8-a605-fdde6bc2d988", "indicator--da468712-f135-44ab-9c09-6b1e0caa0bc3", "indicator--33424fc2-9728-43d6-aea7-79ced37e872d", "indicator--19a9b3df-b500-4974-8d84-f078996c5340", "indicator--81bf63c1-b619-4feb-b91a-0079fff1b850", "indicator--24f76182-4c78-4337-a6ad-e4d59a8ed0d9", "indicator--36377e7c-c396-4226-a907-c16ff6a8a2bf", "indicator--8c275956-aef7-423e-ac7b-7e63373f6021", "indicator--b32f9907-04c8-46a7-962d-80a4d57d9258", "indicator--5e77ea06-8370-4eb5-a47c-c997569ea7c4", "indicator--b10f6924-efd7-4c8f-ba10-f99df4f3d2d9", "indicator--f7f85f69-9e71-48fb-92ba-fe5b43bc5189", "indicator--e0f8748a-056f-4147-9117-e3c2aa645e82", "indicator--dedd187f-ee5e-4e57-8161-a5c3efb398bf", "indicator--acd0306e-500b-43eb-90cc-57f362934703", "indicator--5fe110f3-c497-4d6f-b8c6-4e3c1a955055", "indicator--82522880-1a11-468f-9df4-693535ced80e", "indicator--2238d693-11d6-4430-9aec-eb56d36af03d", "indicator--c65247e8-bd48-4265-996b-ab8bc61d1246", "indicator--bdcf5f33-cbfd-4eeb-b499-4dfde0de1f1d", "indicator--914e819e-b25d-4289-b6c3-298b5287e8ee", "indicator--85851fdf-2a11-4c3f-b849-c7e89f5c8672", "indicator--46b52a46-2cec-4667-bf99-b1338806aaab", "indicator--28121f27-8a46-4130-949b-a277c81234ac", "indicator--94809466-fbd9-4940-87e2-b0d36a0a7462", "indicator--b7a63bd3-b382-4946-99d7-03d6559a73c1", "indicator--813fba2b-4922-450c-9230-8459fa38ad33", "indicator--07fa59dc-c669-4f60-b5c2-66d98dce2cf7", "indicator--81ebf62e-5e24-48a0-a7de-31f3fd194f28", "indicator--532eb5ca-b645-4954-b632-02e0bd08b362", "indicator--2bec5381-bdda-4c83-af4a-1531cee99002", "indicator--5654c60c-a831-4d48-89fa-8d716ea648d4", "indicator--4e036ed0-b447-430b-97bc-061f35d479b7", "indicator--71467201-899d-4e4d-be7b-84a3db585bda", "indicator--9a229830-d1f7-493a-8b54-269086a24dab", "indicator--5913b310-e246-4ae0-886b-fe1ab9d1cfce", "indicator--4b211b57-a758-4ef7-a09b-bb1902d58c03", "indicator--c5dc2c8e-b153-4fc9-be1c-209a3d91d670", "indicator--e853bff3-b624-4b32-bf3b-bebcd4b7538b", "indicator--95a924fb-7089-442d-8b48-c99ef4afc302", "indicator--bd9502ca-c581-4caf-9d8b-93b8d6dc3b90", "indicator--ec5129a9-72f0-4eeb-b2aa-2a6021ded3bd", "indicator--cf7a3454-3403-4aff-9940-d5fd61364106", "indicator--618cbc80-22fe-4ff0-9b68-28521f545b8b", "indicator--2b2557aa-4691-4e72-b70f-c79938a7fbb8", "indicator--ff3012ec-22b1-4fa9-a115-2b890e69a994", "indicator--7519455c-96e2-4e02-bef4-9cdfb3894e77", "indicator--9bae04f7-2023-4b62-b622-3c9c8ca3fd3f", "indicator--7a001b99-1ff4-4eb9-b475-f2bcfdf79348", "indicator--ea0e44f6-cf23-4fff-8025-d92ac2da803d", "indicator--899089fb-d1e0-4896-9b94-3aef20782094", "indicator--5b7e5fc8-79af-4092-b7b6-76bbd8cbfa8e", "indicator--1971861d-b4a5-4f79-ad43-dca3f9497a25", "indicator--e6568e3e-f5d8-4637-95e8-0a5248cb1bb7", "indicator--7b4e8725-6cd5-4a91-a9ca-7771c30e62fc", "indicator--7e909fa2-2556-4386-aae5-3fa4f5ca38aa", "indicator--28f12937-d175-4dd9-947b-1e6728b1dc50", "indicator--61a49b18-25d8-415c-8442-5937ef6e3b67", "indicator--5a91d30c-2b7e-485a-8ac8-b883a701c9e3", "indicator--cff96eff-4c54-4c4b-a6a6-8e9fff57bff4", "indicator--f0e2b0bc-2ac8-4f56-a2e4-b33af5909aa2", "indicator--3c948240-c551-40c9-b0a1-61705aa4a12e", "indicator--273cceef-29a9-49d8-b280-bb5422f1d6cf", "indicator--48d5d86a-2021-4726-b042-32deb8744839", "indicator--aef0384d-56e6-470d-9e12-3564081e7297", "indicator--7f47dc74-7334-49a7-bced-88d43fdf8993", "indicator--b6fc5236-d856-45ce-8fd8-400913b546cb", "indicator--a13660d4-f4c5-49ef-ab11-a9345b18a478", "indicator--7389e4bb-1eb3-4c24-8472-02e91f1fdfc0", "indicator--4ecf7f81-054a-4815-89d0-6518c50db040", "indicator--98dc94f9-8fbc-47ae-a83f-163bec82a1cc", "indicator--da78536b-f94d-48e7-afce-4168aed54e8c", "indicator--55ced0bd-f357-411c-98d9-4dd8f7a19032", "indicator--2b9fa672-42e3-468d-b23e-8d3ea24b03f5", "indicator--d25bbd94-2f48-4f9b-9a02-c8d413dd26a1", "indicator--c4478ebe-0f81-43e3-8b8b-a2a3c5543df9", "indicator--fd31c2dc-1f6b-4505-814a-3e341a2bb840", "indicator--bc1d82f3-7138-448a-aa87-12c6de27e5d0", "indicator--75217e58-0827-4d46-84cb-38c60b517739", "indicator--eaf6ca2b-0aa3-44c3-a30a-8e56172ff1bf", "indicator--d5e616a3-70f1-4322-9964-8e876b51db91", "indicator--13916576-5033-40ae-bc83-2a9e11ac09f7", "indicator--67588208-d947-4f1d-a2aa-f64774d5715c", "indicator--1eb48640-3310-4f9e-ab37-132421b66b4b", "indicator--31d00249-a963-44ea-b2fc-eb7ba4a6328d", "indicator--1697dfd9-b8b1-499a-a7d8-e2260093340c", "indicator--068d5c94-99ac-4833-9a1c-852d134853db", "indicator--9edbbf61-7f48-4a8d-947d-cd383f4d8385", "indicator--18673712-eb66-4725-8067-021d76972e47", "indicator--c2e2b597-e1e0-40b1-9ea1-e60b138bf159", "indicator--984c042c-ed27-4262-90bf-053ef08d4cb4", "indicator--c99fd023-2c54-486e-b348-1f7810a4af68", "indicator--a67d062f-9d0b-405c-bce2-61ce65bf4108", "indicator--206c5884-d182-4b89-81d1-5cacbd6bb971", "indicator--dd42e9e3-a6c7-4a80-b8cd-a7795d2d8dbb", "indicator--2a56a4c1-20fe-4d2b-8817-39075112243e", "indicator--128ef0eb-0221-4881-8326-7115115e5bcd", "indicator--2b3081c0-3652-4b62-a74e-d42227ccd3d7", "indicator--3b5c551d-6d45-4d92-a504-1e32a3ecfa2e", "indicator--ca706730-11a4-4076-b4b4-952e94167cf3", "indicator--eec2122f-c063-4763-8022-09334c05f328", "indicator--f440fbd2-d863-49d1-8485-d187ff41f38d", "indicator--abf4df01-8805-4dcd-b237-372e65138f78", "indicator--cb440cd1-9e7a-4237-b5fb-b4bd66ddd460", "indicator--ff0f5c6e-e20f-4616-b5eb-86190d99dc2e", "indicator--88916748-964f-44af-bb91-6d56a7c9a4fd", "indicator--d8889173-14e0-4b4a-8e8d-baace9e059e7", "indicator--9b7a47a0-7638-4e0f-a758-de98e5a57f1f", "indicator--30e2a21c-6629-4167-9168-934074ca4a24", "indicator--1fe5f049-2efc-49f6-b474-4d75ea3b3b1c", "indicator--bf98c5a0-59cf-480f-8122-7ec132c7e3f8", "indicator--49a4186e-87bd-42cf-8f04-ac080ce832be", "indicator--4d19de14-0dca-4af7-a54e-a198190ed974", "indicator--4b834f49-79fa-4da6-a803-d754a0d9772a", "indicator--df0d9117-9038-40b0-baaf-a33eb4fdbf4f", "indicator--654e98b7-a491-4280-aef6-fec05f2693ee", "indicator--e24be342-ddf1-4471-8ba9-7eab5fdd1e5a", "indicator--bdc437f3-7a34-441e-883d-b797f5ca480b", "indicator--5bb0601a-88c7-4ec3-b253-19594fc64b82", "indicator--9b166cf5-0b79-4aeb-9118-7fc44dbf2b69", "indicator--2950e4fd-35ec-4bda-b6e5-fc63e715ff71", "indicator--3b3db813-113a-43c6-94e7-2b06242b1bb5", "indicator--a29da333-7708-4326-b83a-d9af62d2336e", "indicator--7282e50f-ca97-46ad-b500-7c224fe7cc67", "indicator--3354a102-09f8-4a70-94d4-5534669044e2", "indicator--a7ff44f3-55ad-4d31-8686-7b4bab8564eb", "indicator--4db53a66-56de-47a9-839f-33bab002704b", "indicator--aa20be42-ced5-4c4f-bc6e-390883086dbe", "indicator--61add5e1-a1a7-4481-8125-9a51b1181c8e", "indicator--ea37deec-5e22-444d-8b0e-3640f3758195", "indicator--65356f19-57b4-4b92-aed6-2dcded6fec9a", "indicator--ace0feee-1e2b-4af5-9894-44ee0b479fa3", "indicator--0f2be384-ff2e-4f53-99bb-93a8db8b1a08", "indicator--3bf2e06f-9458-4b54-993d-018d0a900702", "indicator--447d3c3f-58e3-456b-a399-f838a17419cf", "indicator--f6573b3c-7602-4cc4-8dbe-6b30bde72ca3", "indicator--baeb50ce-3e95-45eb-8ff1-567882a30f9e", "indicator--c97df6c4-993f-468b-89dd-db27debfab95", "indicator--ef75b245-7cdb-4c5c-924f-1bad2dbbcd1c", "indicator--07fa0516-d047-4b38-a590-cc6c96bd02d2", "indicator--cc871691-523f-4236-8854-35b65d920881", "indicator--c855ffad-2219-4b75-8b21-7769596e14a1", "indicator--abe6bc15-eaf1-461c-b4e3-838506c87528", "indicator--10bb5b25-2dc9-4470-aa34-e0425e558a68", "indicator--f8a20b9f-a2bd-4577-b546-1d98c56905ab", "indicator--7d9705aa-0f38-4780-a821-d574b9abc49d", "indicator--01b5eba4-3dd7-441c-bbe5-c395436e6c09", "indicator--1a1a9444-f79b-45d4-9db8-48ec8aed29db", "indicator--2ca99571-54e4-497a-8d9d-5db7278c3103", "indicator--57e6fb41-379c-46e5-87ea-5e8a484c34e1", "indicator--cb3868e5-142c-46b3-9979-5979768ad99e", "indicator--c0fc486b-26d0-4f1c-91d1-2605ef2c6113", "indicator--bfe8710e-881a-4d94-9dbb-9f04cda955cb", "indicator--dbe387ae-be31-4550-865e-0258e6fefee0", "indicator--5f52831c-0848-4dec-8d9d-a16cf4f9b56f", "indicator--4eef4727-a509-4870-8434-b874a9f2272b", "indicator--fadaa391-7f3f-4593-984e-720962503c40", "indicator--df5f0431-da93-4d0e-a593-9fbf12d9a4a0", "indicator--e890106c-148d-439f-834e-96a6029ac0c2", "indicator--27a5ad67-5c0b-48ab-a21f-e63285807c31", "indicator--d0342153-9874-4d6d-9df2-ce1e4c6272bf", "indicator--d2a86654-49e2-4cb8-a439-f3f96e304131", "indicator--ce47fec9-f2ae-41c0-ad7b-5253383395ba", "indicator--b8e6b208-6a98-47fd-8aed-65818c2c930b", "indicator--bb95993b-d339-46d8-b5bc-ece7847b1d75", "indicator--e966f139-46b0-460c-b7df-647724aa6472", "indicator--65268c8b-c44d-4a61-91da-d475fa004707", "indicator--07b2391d-a74f-4b77-82bb-591636c1bb72", "indicator--bb44eade-96c8-4885-a00b-107bae9a7ddb", "indicator--9d4b5cbe-3515-4174-9a18-439f7265db43", "indicator--758ae638-f7da-4d43-96da-2b872ba3cb53", "indicator--2863751f-8f2f-45b7-9b7b-642807fb0e98", "indicator--f03f455b-b2b0-4099-8acb-5d90c4cc77b0", "indicator--ce47bcd8-d031-45a5-bb0c-695fc31481db", "indicator--44fe4509-e7ea-479a-b09c-4440e8b04aba", "indicator--617e1114-9636-42cb-99d8-c0c15c3fda5d", "indicator--71e433a4-c844-44ae-9aa7-86105556a7b6", "indicator--c34f200a-d57d-46ff-859d-898a5975870c", "indicator--247586ad-b17e-41e0-8631-484ff671bb04", "indicator--2df9bdc5-7986-4bd9-b20d-da15cb74838e", "indicator--253c48fb-9511-4016-9784-5b198d314639", "indicator--18958c05-b1de-48c9-8f51-886f1add0dc8", "indicator--3be75c45-35c6-4026-9555-c735c014752e", "indicator--74c2f239-ac3a-49df-8743-c944bc9df990", "indicator--bc6cfd24-9120-434b-88a2-d39d1b34bb17", "indicator--2dd184fb-3996-4415-ad9f-ff278290167a", "indicator--fea46a7c-76cb-4b5d-91d7-bfaa29fe2739", "indicator--c99c7146-4227-4a97-9f89-42522d9485df", "indicator--d08e300d-6f55-49fb-a6af-0d6efeb0217c", "indicator--f2db3365-d49e-4839-afc2-c7c7d858c20a", "indicator--438a0995-79bb-40a7-9bdd-10e454b073d2", "indicator--4499dd79-1d0b-475a-a6f6-d88f8c9d0db9", "indicator--4b786112-fb14-4312-a997-8cd83f6eec46", "indicator--5875dd3c-2b12-4ec8-8849-07496d766051", "indicator--2f89274d-97c8-4246-97b3-8c8a19ee2901", "indicator--be5c412c-b85b-4be2-8b9f-b4ae34ce2ff0", "indicator--06c1caf5-8070-4976-b1b3-fcb7786c7807", "indicator--441813c0-2eee-4086-a364-f6154c9c1235", "indicator--5a4bcd4d-d72a-444b-982c-ba346a2fa226", "indicator--b7ff34d2-7a94-4988-a115-d15990ccfbdd", "indicator--e97da60b-50d1-4bd6-82b9-06ecb1c7e102", "indicator--d7053df0-7571-40b0-8e45-a80ef21524d6", "indicator--4cbf5e90-52ff-4b64-a8e0-c07fa2b1dd54", "indicator--c66ac3d5-0967-4d36-80ab-84c7c1040683", "indicator--1b059f89-35db-4ae3-a818-fe13abf391d8", "indicator--ae1da7bc-980b-441d-ab25-e79806aac49f", "indicator--2ee9da86-406b-49ce-86c9-7190e4fc5e1a", "indicator--724b9455-f564-4f72-88a8-b4ddeeb66758", "indicator--84229662-8741-4dc7-ac4a-6fa8df2761b3", "indicator--12dea424-00fa-406a-b834-3450cb9f7350", "indicator--403d8ffe-7ed1-42fd-ac5a-3dde2cdf1cc0", "indicator--8f457f20-a6e5-4e0a-9e43-18b15a6f7577", "indicator--1d690d4c-1540-4bb0-9af1-270304ca6b43", "indicator--e7e3ac7a-aa99-4631-a11c-f3fddeec9d86", "indicator--26da69f1-fbe3-43a6-888b-5a56f880eafa", "indicator--fa7fef24-63d9-41ee-8e4b-7c40c9926c7c", "indicator--8946e5c1-e71d-4747-bf85-3cfe54e3d687", "indicator--edcd0e2f-114c-4762-bed2-7e77ef76471b", "indicator--44b5b3b3-bd4c-4600-b8a6-99b90a48e524", "indicator--c8b1dbe1-3d18-4a47-a434-063eb005e018", "indicator--be31c058-6fc7-4eff-9c0b-1d9bd7dbe66c", "indicator--843c4341-8886-4ee8-baf7-f2e171557c44", "indicator--df7818c4-3596-444b-a265-f8c67d02fa43", "indicator--b5866c73-ac45-4957-9d24-a1051c08fa17", "indicator--2e0e46d5-2457-4b12-83ac-29ec0ba62590", "indicator--fd0334ba-698b-40a8-b7cb-def9d2418cbc", "indicator--fe11a9db-34b8-42fd-ae5a-e5fc825e2805", "indicator--4bb792e4-e89d-4d35-8640-5885544bcf8f", "indicator--8d913575-0177-4cfe-92af-6b104b451cae", "indicator--eaaae791-423b-4ce8-b77b-133b7264119b", "sighting--2109cc18-d01b-4dce-8b0e-ed07bf887c30", "sighting--7587b498-43bd-4227-a2a6-1540d55d43db", "sighting--ffcd1d62-d9d4-4a2f-a907-beb8284d6711", "sighting--f367d1f7-6428-4666-ab4a-b58c994c7c00", "sighting--780ea05c-7975-4268-8463-0411c76d9cb4", "sighting--6bf5e543-9a16-40ad-ad8a-d24e4e32b068", "sighting--31e6a813-5ce6-41fa-ba6d-4bfa50cd3021", "sighting--f0b021c1-0e7b-4914-916e-f97b68b4c88e", "sighting--faed34bb-230b-458b-84a1-308e3ebaa469", "sighting--ee256b66-41e8-4c47-aa1c-2dad49447da3", "sighting--5dd676ba-ba11-477f-a15c-a6f3d481f414", "sighting--85ff6943-e302-4569-bd03-3964d28cea55", "sighting--2bb26c3f-8fc8-426b-b05b-51346370dcca", "sighting--1ae2cb69-d807-4bc2-b585-ed627788f175", "sighting--9a67cce1-6d55-433c-a43a-2e4bb08a3166", "sighting--31b6f609-848d-4447-9282-d8ed4cd295ec", "sighting--7c9bfcca-8809-42e2-a116-d1bf0f0486ca", "sighting--056926b7-d8d5-4df0-b60f-779c0b7e75fc", "sighting--cd1b0a99-44c9-4772-9641-071b1be717d1", "sighting--ea9e63c6-1d4d-4504-a18b-7e2ea3b09232", "sighting--6b6178de-bd5d-4a48-8a60-0e7149676331", "sighting--a8e39421-c3fd-40ff-992f-3500a1c37529", "sighting--86b2dabc-89c7-4d65-8906-514651bdce16", "sighting--6d18871a-9387-4a69-986c-ad5371bf8e0c", "sighting--59e680e7-b80e-4d7e-874a-65f93bf6c404", "sighting--fd51656a-e8bc-40fd-9c1a-0f4c11a4580e", "sighting--7afdc25d-f03a-4b71-921b-a27678886581", "sighting--ef134d25-d0d0-44d6-9d2c-a84da40bb001", "sighting--ea8af6e9-c2a7-46ee-bccd-f230b040979d", "sighting--9782d4b8-03d1-4caa-b153-47f8df6dc229", "sighting--aab5d284-b8af-4602-ad5c-5dd2070f2bb3", "sighting--ac614d13-9a83-44e9-ad10-604f61b6b055", "sighting--d9b4397c-c4fc-4479-af28-99e0fb25da4e", "sighting--c8217412-ca3a-432a-b48b-3f933deb47ae", "sighting--b2ab616a-8414-426a-a15c-931a0175e82a", "sighting--ff74e563-106c-4389-99a8-12de4aab782a", "sighting--3c0da8c3-01f8-40f9-9ab0-adaf999aca3f", "sighting--15329694-383b-4053-9ae3-755b34788612", "sighting--be3f08d0-edd5-4be1-85ad-b699266d45fa", "sighting--faa7f0a9-bba0-44d2-87ad-91ccbfe6f04d", "sighting--9b7d9ea6-b4f1-4243-a5c1-53df843d8628", "sighting--ba97d899-9a00-4f0c-b96b-44e1b12fbdad", "sighting--ab82034b-a854-4627-99c8-a5b2f01d1ae6", "sighting--b8f17cb6-d355-4d23-8b2b-2aed8a501d37", "sighting--73ee75e2-edaa-451a-9c2f-5c6a9d0bf46d", "sighting--e6a5b5f6-e112-41db-8421-203dde98873f", "sighting--0a127d2d-5ebe-4d9c-af34-24052b2147c0", "sighting--2a1b89ee-a44a-47e0-b9e5-c8c64f92b65e", "sighting--541891b6-aa50-46c0-8b0f-347e76e246f8", "sighting--a827d2f7-8b96-4653-9070-cb2348326e38", "sighting--ffa952cf-2a2c-43d6-a40b-5d6ad566a706", "sighting--2abd26f7-2c85-4420-a98c-8ab923df1860", "sighting--ec85d0ae-3d58-47e6-a783-cdb24424f83d", "sighting--915f4656-b40b-48c5-a7d3-7c788d1d5246", "sighting--73c1eec6-b630-44fc-9e95-cfbdae3bc26e", "sighting--245e4056-4718-4176-91ad-83bc06839476", "sighting--b8e5cddd-1ae4-40c1-9ddf-40f51f8790ed", "sighting--647b2a08-7f6e-4747-a882-9f45b70ca3f2", "sighting--ed1c1d16-c12f-4451-ba9a-c5a79a876e8a", "sighting--18f014c4-211d-4bad-95cb-26db25277dc6", "sighting--e214f3ff-af29-4219-8c5d-5e2a46db599e", "sighting--0ede4892-b722-4a21-949b-4998c0aac71e", "sighting--493b6aa0-c648-43fb-98e4-902de0cb2dd2", "sighting--e2d987e9-7e83-4011-9f9f-0f55d28b4219", "sighting--41498b0f-5353-4c8d-bd5d-615dede60f4b", "sighting--101bf47a-ab04-4858-80a3-16f82d3d25bb", "sighting--45d5d046-05f6-44e9-a8cd-de97b0f2ed01", "sighting--371a6ffb-06d9-4fd3-92a0-8b5f09383124", "sighting--a53ec530-ea74-4585-a131-00b44303af0d", "sighting--5ff3fba7-bbf5-4130-a4e5-3b35b51e95fa", "sighting--bb658d68-6696-43dd-847d-36b3549ac9cf", "sighting--7b77d2f7-d1e3-4913-8ea4-e649d1488146", "sighting--61f55656-1875-46b8-b3f6-d40365254716", "sighting--2abf0599-90b5-446c-8fea-ef52148177bc", "sighting--2b690575-4087-4622-97ec-948327f68974", "sighting--5d799509-6df6-49cf-9f57-2a6e2c1f4ad0", "sighting--a62e1098-4997-4e6c-afbb-fa4eb9a39fa2", "sighting--bad0031a-0bb3-43d6-8f65-b9ccac6cd7f4", "sighting--1dffe31b-121b-4315-a635-6542d2f7567d", "sighting--64ff8c56-caf1-439c-b7d7-9ba4b2a67130", "sighting--0a4a6306-6a9f-4e75-9683-c2269775be26", "sighting--f24a98bb-281a-43e0-baed-4f0509367ae9", "sighting--93f4a399-016c-4ef0-a1b2-50cc1d5da5d7", "sighting--edf61462-1c00-4098-b2b1-e8e66cbe47ac", "sighting--28982b08-56c7-4af4-86cc-2046a62811ee", "sighting--8891a73c-545a-4a40-ba7f-8f546746d768", "sighting--b502cced-2357-4a62-b89a-096caed134f4", "sighting--5f633b69-0eeb-45e7-b8e3-4a85a3c649be", "sighting--a82322d6-51d3-4789-8db7-8599aa75deea", "sighting--5f1934f2-f26c-4104-8ca9-f490d211c565", "sighting--6d3ae6a0-faed-40cc-94da-d1d5617d0b6d", "sighting--48e1b8cb-9b45-4403-ae94-f90f12cfef8d", "sighting--e01af1c5-d096-41b4-9284-f962cee00844", "sighting--8e6ec86e-58ce-4c72-8f2c-503413dbd633", "sighting--32c5b953-4919-4709-b494-a3e5e743ff78", "sighting--1f735b5c-af17-4385-937d-23ecdca7c46c", "sighting--71c9271d-1439-4b2c-8af5-ffca92ca4cac", "sighting--6119c30a-9d51-40dc-b52e-505327879e72", "sighting--364889c5-a0b5-41bf-856d-72cff3d0deb1", "sighting--5e2066df-cfa8-476d-a44d-c341e798256e", "sighting--ee5e0a22-8d7d-4052-9f2a-e1f9eabe3471", "sighting--e45fdf6a-4c78-46dc-86ce-5bbb38ef629f", "sighting--e7587c03-d7d6-4791-938b-62b24462a6b6", "sighting--6d04e52b-3ed4-46c0-95b6-9f22c54c2c1f", "sighting--e05bc1d4-bdbb-4367-8dad-64223969e66b", "sighting--67666308-fb58-4dae-8659-1c600a2b0e25", "sighting--a0f508e0-0d68-4797-be70-ca3cd0cb952b", "sighting--ef8c0f4e-b445-40f9-ae89-de2d3c2c3263", "sighting--4b4721af-5211-4802-a97e-e64a6f7fb109", "sighting--25d28805-adfb-4d58-b032-5e425c82232b", "sighting--2bf77d0e-bd0d-4120-a894-1d41b106f40a", "sighting--760c4e6c-8bd6-477a-b9f7-e779936efdbb", "sighting--4f48b83a-a169-4b0b-b081-7ad64d2d1b35", "sighting--2b106674-1b8b-4669-8bc8-f9f412024582", "sighting--1d237f5a-781f-4c1f-89c4-b844cf72c2cb", "sighting--4feb05d9-9b99-4a8b-a172-997642da89f3", "sighting--5d489f2b-8803-43c9-8528-0bbfd6a07ba0", "sighting--57938d16-94f0-4e6e-8d5d-3d888ec1ceed", "sighting--b119b218-4ec6-4425-9044-45dc0b7283e7", "sighting--d5bb0fd6-31d4-4789-a827-d6072a1698a6", "sighting--36cb702d-9fe6-48b7-a0b2-9cb04ff74be8", "sighting--61317fb7-194b-4f67-86b2-6f79955740c8", "sighting--3f1ce36e-0f14-497f-ae43-73a7dc26c06e", "sighting--d48942ff-fbd0-441e-824d-3fb9c1bbb28f", "sighting--b4d0354d-4afb-42e2-abb0-508760204415", "sighting--d0c686ba-2b70-4e34-99ab-c701f3005582", "sighting--2e920792-2052-4cbb-9639-387c5eae60f5", "sighting--1cfad255-4b41-48cf-9393-7db084f016c8", "sighting--4fbb993a-b87e-416b-9b1f-87880444158b", "sighting--11c0745b-4462-4a2e-96a5-8049d729916d", "sighting--f831631c-0d85-4480-bd67-9510cb7ba19c", "sighting--a03632a8-f6b8-409a-b6f8-28c3224149a3", "sighting--e3fc1c5e-4d39-4756-818a-2071560c0f10", "sighting--7df56f6f-9d1a-402e-a357-09bc614327ca", "sighting--4a5b53e7-ea8a-460e-9cf9-841b85c6d19d", "sighting--f17a94c1-a097-4dae-8fe0-f2c095ef3ee5", "sighting--4442a143-08e3-40f3-b8e3-65a712f2f70a", "sighting--8008121e-1592-43b8-8414-41a7f99b867f", "sighting--cbd1ddf1-6819-4d90-b719-e0ae91a50ef4", "sighting--a19b04e4-82ca-43ea-b299-f61358b746b5", "sighting--47e6cde6-bfde-4d40-a955-c56301d4d5e3", "sighting--3150d784-dd07-4343-bbcb-17effc732d6d", "sighting--d86b5821-e118-4497-a8ec-10b9935a25e4", "sighting--63321603-ff15-4995-85c0-6d55b6bc0af0", "sighting--e1098525-f2a5-484e-955d-9824d5c02dab", "sighting--c4ccb026-bfd3-4ec5-b421-480a968a8e73", "sighting--63ac443d-657e-4e8e-be11-67be2375f4c1", "sighting--0b1411e0-5ffe-48b5-b489-c29919b86089", "sighting--9b1775fe-c015-4519-a7cf-c6b32a27691e", "sighting--4b52e418-5659-4490-919b-8e3cfac667c1", "sighting--6572818b-b40b-4800-a6e1-1bd0ef50be9b", "sighting--5cfdb15f-9761-4a5e-90a4-4bc1680096b7", "sighting--0e5dce90-1a68-4033-8cdb-6b161fc8e38a", "sighting--6b6245cd-c4aa-48cc-b3af-84e784efd9b5", "sighting--46d51437-ec1c-4561-8232-83269f088fad", "sighting--ea81e6b2-a48c-4dd0-9b97-e1fbf2b808be", "sighting--4c8def14-81c4-4226-babe-0c583f2a39b2", "sighting--6fa393b1-ca49-465a-8a67-1748a62ec783", "sighting--33192e86-1a66-4cef-b9b1-c78b801a5faf", "sighting--db171eff-95d5-463b-a362-ef95b0ffc6b3", "sighting--190077da-3570-45d6-8b6c-1bb873450197", "sighting--2ff478f6-8238-4f00-a9ff-808560bd094a", "sighting--cd3a85c5-c391-44dd-9cbd-7eab3ba0ff03", "sighting--71a3a2b7-ea17-4f91-b8a4-376d94d7913f", "sighting--66bf2042-fea0-4a85-9378-6c22ba672334", "sighting--12ab8103-4dec-4895-91fe-20d9e84c862a", "sighting--ec453895-40d4-4a2f-b8fa-a55dbadffd7b", "sighting--307bdc96-41dc-4d91-9391-fac6b684c0e3", "sighting--7fbcc695-f272-4bce-84a4-28054ed05267", "sighting--7969bc31-8644-4f7f-89e1-f8363a4a2659", "sighting--7d2c6cb3-3597-42bb-bac5-fa820dc2764b", "sighting--a3deef8c-30a9-4b1f-9a5c-6ef07d7bdaac", "sighting--e1fc44a1-6163-4157-99d9-1ed139a69a9d", "sighting--102c93fd-1639-4ff4-9a71-00cd490ae6ea", "sighting--f0ec61de-180b-4117-960d-f7ac79f6241b", "sighting--b58494a5-a04b-46d3-9bc3-17b9a3c0a60a", "sighting--3ed480a9-98ca-4977-8170-17861f57f868", "sighting--52aa9c5f-a203-4eac-9b71-b82ea6304ce6", "sighting--3b496fc9-2407-45ed-ba84-63b3dc6548f3", "sighting--88d13156-6055-426c-8122-78d891836a3f", "sighting--01a547f1-dca3-434e-9f38-d48ef0ad4ad8", "sighting--c22d6802-5f5d-4ac8-8bc6-e6fe9cf534fa", "sighting--0727cc55-1e97-4f4d-bcb9-93cfa17cd6bd", "sighting--cf8bbae3-ff24-4616-b902-88c8f4090f1e", "sighting--0c4835a3-3f87-45fe-b0f3-79df57e1c034", "sighting--e4d9c2da-7191-4c7f-a5a8-a417143cc0e8", "sighting--1a815b87-af81-43ef-a83e-7b8736946ea8", "sighting--fbafeade-072c-46f1-9397-fc11a6de33c2", "sighting--7a3d52e1-1008-446b-92be-9f97331c25d8", "sighting--81916aba-26b7-4c34-a0de-92348e53237e", "sighting--2c799156-9f0d-4153-8c0c-4c8291d96db1", "sighting--938f4d77-c2e0-4f19-b549-e7928ec24485", "sighting--bde1b3bf-d3f2-4f08-878e-143c103a7044", "sighting--63ad647c-6b48-432e-a09c-21cda86f71e2", "sighting--f3c4425e-7c35-4b63-91a4-44252e401f80", "sighting--3a5c8740-39fd-4df1-89ee-cbe3d73abc52", "sighting--3f046203-fd7f-4071-9e41-341ba7d235e8", "sighting--335d43ba-2caf-4806-8636-9e75832961f5", "sighting--2df3d86f-1318-4883-9585-5b3dc5d1302d", "sighting--d2f46787-3fa5-4528-9121-98ebd6b673f6", "sighting--ee547697-f823-4dda-a16a-5479712723b0", "sighting--c080e127-6daa-4454-a4e2-9e3dcff14717", "sighting--2dc36794-711d-4a5a-a9c2-86f97bc6784d", "sighting--946ce524-4e3d-404f-abe1-100f97d7f5b2", "sighting--d895ddee-352e-4997-bf5f-b2d9197b00bc", "sighting--c2372ff9-5dc0-449c-958c-d9530cb2ee6d", "sighting--c05bb58f-4479-4428-8c1e-9bba1e0ec0bd", "sighting--43d17108-a769-44a9-8f7e-7485171d1cd7", "sighting--a7b1cc96-a141-4b7c-a6bd-47a1783e6ee2", "sighting--b6c83c6d-1836-4af4-80f8-f5b09e4cf558", "sighting--15a5eff0-f0b1-4176-be99-8040f8dbc65f", "sighting--94742c83-8b54-46ce-927e-053743da30f7", "sighting--090df2ad-0512-4c87-83bf-cbb7589dc332", "sighting--76d92a28-aef1-4285-b44f-ba6a453677cc", "sighting--2907dc67-3e04-49df-a4b4-42de6997019d", "sighting--182fa38b-2e86-499b-9ff7-d157bb23ff26", "sighting--2c312035-693b-48f4-b8f4-2ad682866df3", "sighting--93d5f811-01c5-48ea-a470-d70753e63852", "sighting--0f650fe1-0232-4536-8583-dc8a786f48bc", "sighting--c131966d-9930-4c06-a08c-08f5e6148677", "sighting--522a581a-fb54-4ed6-8206-8deff2a88e3f", "sighting--25753267-90c5-4841-9c78-32d26501b141", "sighting--8964f92f-6b75-4b91-8083-5a5c101b2243", "sighting--8298872e-9fbb-4aac-be4d-5e3da87a10a5", "sighting--96f52154-2960-4934-8345-07a74178cda9", "sighting--ea7cf8e5-1eb9-411c-8552-bca3be3926ec", "sighting--c185e3ec-b69d-4a8d-924c-7baeec8df095", "sighting--a57e6d98-5a23-4380-8921-c56d1c7c431d", "sighting--a104bdd7-6264-44b5-bd11-81b898390a61", "sighting--0743bd58-0f19-4678-a87f-a12c9c3d8cc9", "sighting--25288a65-b9a4-4c75-a92d-e43cca59fdb1", "sighting--3d266950-2e25-49f1-a103-8c6957bb82bb", "sighting--2ac6db7f-cd46-4b61-a4ac-340f99384233", "sighting--ec2a567d-fb9c-4496-8a87-bca6cb6d1231", "sighting--973b3fe1-550e-499c-b3d9-b508de669c24", "sighting--813baead-f4c4-4b7a-ad48-de37c7b6dc11", "sighting--aac1738b-dbec-4fd5-90f2-2a0402d2b71e", "sighting--8c6011f4-63c8-49d2-a378-8f5a9a05103f", "sighting--f0c5e5c9-d23b-4a44-84c3-3771fb8c0750", "sighting--4fd23bf6-0aa2-442d-bd78-fb785a4709d6", "sighting--6307e3d4-e2fa-46d3-a57c-78abab5b8cbe", "sighting--9d5ee273-feac-421e-b75d-6e70777d8b74", "sighting--23a3a027-b997-4074-9811-3071e55bbbc3", "sighting--1e957d02-7684-41aa-83af-bc6f957e2ce4", "sighting--fc0d9123-5af5-4705-b544-f7d2f9af8584", "sighting--9e3c7ad8-ff69-4984-924a-41356d934966", "sighting--513c6bb4-f5e7-44a9-8c63-679a6f05fa82", "sighting--5de4aae0-b16a-45bc-a635-470268750ad2", "sighting--75fe7a04-68d8-47d1-84d4-6267148ab8f2", "sighting--387881d3-880a-4f08-8eb0-377744de7f98", "sighting--d9f6ef11-258d-4c2b-9d26-4ab1a909d3a3", "sighting--234bde8f-3e31-4fcb-9b72-8064a7664be8", "sighting--1f7013a5-957b-43a3-91e9-121bd88e089e", "sighting--f86b8c96-3963-47fb-8287-087a7fd1b350", "sighting--777134fd-b9a8-42c1-b918-57e3acf8da35", "sighting--ff5b0d8f-50b5-42ab-8a1d-c7f32e60eb07", "sighting--61004c8a-3910-4e4b-906a-0c9166140dcf", "sighting--dbbdc739-a7b7-425c-af13-732ed6087915", "sighting--a6032b53-a125-4cc6-ad29-50553d3f20ab", "sighting--8dd763e1-9a5c-47b2-9e35-6e42aeebec30", "sighting--5cf00617-7207-4e08-ab4c-afcb501fdf14", "sighting--22cce8e3-21b0-40e2-9105-7c37283203a6", "sighting--b2fc4950-ff77-456e-bb7d-77d19868152a", "sighting--04bbafb6-8e29-4d02-b810-67bf99ede582", "sighting--53c424e6-c1ad-4c92-bdba-371ff70b3278", "sighting--aed8efea-29e1-4bb0-a35c-e238e36a7745", "sighting--9656da08-0698-44df-920e-79ddbcd30d78", "sighting--159ded4e-5d1d-4b61-b7a7-a01a1c9fba8c", "sighting--b3e1d6c3-7ce0-40a4-aaee-1ce20852c054", "sighting--3ad0b926-e03c-41e9-87f3-2fdc9593aa2d", "sighting--b9156c37-1bf0-4084-9b50-00ada512c6bb", "sighting--23a58968-d9a5-4d72-9b31-58ec9115db8f", "sighting--72bbe94b-cf29-4b5b-b7f6-7dbebd0055bb", "sighting--09731f61-7cc6-4084-9e19-9c5a39bf4c26", "sighting--0b150f8a-da42-4e5e-9bf6-b4dfb4717faa", "sighting--499b73e4-351d-4626-8225-ee707536cd7a", "sighting--30f3256c-f45f-4f2d-96ce-579f070aa375", "sighting--e6fb905a-46c6-4c52-b436-886b241fd2c8", "sighting--ea5a353e-daf5-4bb3-9e8e-5e6b67fc60d1", "sighting--aa9d9771-d4ec-44cb-83fb-748c8df43037", "sighting--5efa78ea-9549-4ccf-af17-48032326f4bb", "sighting--d3b98f14-0b6b-4a6c-b3fd-d50f88789b3f", "sighting--f8939cc6-4017-42c4-91ce-4959041d97f9", "sighting--f9ea89a0-ec76-4ce6-bcd7-56125028d351", "sighting--33c477dd-7747-4f2a-b7e4-9e9a3abbc21d", "sighting--1ef2f7a7-a18a-4241-b956-f81bdba41516", "sighting--57082c73-b5a5-48ae-807c-7b74ebeb678d", "sighting--f8c8b2c8-1ee9-4756-bef8-98ad45bd29ef", "sighting--d8f7cd98-758a-4fcf-aa38-cae231ad8f4f", "sighting--89116ef2-1df3-44e2-824a-5ccc05f22477", "sighting--a235c90e-b8e2-4d33-894e-eb5724a01727", "sighting--52821ab0-cb44-4182-b645-a790198d0e9a", "sighting--1c65ab64-47f9-4cc6-9cc7-4773f99d5063", "sighting--cd670259-a2bf-4ca3-aaf9-8cb5b8570c08", "sighting--80265f72-3553-4b13-9c83-d596b4eea0aa", "sighting--2d7207ab-dc2d-41d9-9411-a9ddf5943964", "sighting--18975af4-a8de-42bc-8e12-f80a0e5afb64", "sighting--5da7732f-749f-486c-b95f-5bffbf93b999", "sighting--d484a343-fd91-4a9c-a242-eaf50cea040b", "sighting--89087872-f8f9-43b4-9261-a99fac887aff", "sighting--c75d9ec0-8bbf-4031-af70-fc58da2ad82d", "sighting--171a6985-524c-4532-9c8a-72d889ed17ac", "sighting--12ee2693-1945-4603-b817-c5c7b6f62e71", "sighting--93045ecf-777a-4b40-b0de-ce38d24366e2", "sighting--ee7b8fcf-be21-44fb-92b7-19a76f484a78", "sighting--61c413c4-e16d-439f-859b-3c19c2073364", "sighting--a9c00b03-f014-4670-b918-2de8bc55f6fe", "sighting--3c1d3005-267a-456f-bcc5-153e3c5e48d9", "sighting--6d30d400-0a92-425e-b864-76ef302e5fa4", "sighting--5e196b63-4a07-477e-9eb3-d174d9c9b445", "sighting--2847edb6-886b-452d-8b2e-f1ea033c5514", "sighting--9808e17b-3ba5-441d-95bb-96afcfcd3735", "sighting--09062df6-b8ac-4b37-b605-c79b2fc8339f", "sighting--a49a50ac-f546-4536-bddc-3a5aa3ae5615", "sighting--a71ee79f-e93a-479e-8d62-17ff9a49e4af", "sighting--15c579cd-7484-43db-ba5b-96cc63681d41", "sighting--427f69ac-2a3a-4b76-9e69-41b26be97e89", "sighting--e10b909a-bbbe-4761-aae0-5112e228b1af", "sighting--741c9276-6717-40e8-952e-0ad3af9296ac", "sighting--4091e822-610b-4580-bc49-7b0424c2ee16", "sighting--3e2716ce-4627-4c60-8f3a-d0b18cccde78", "sighting--6e65eb40-bc67-4f84-aeb0-f2a6065871a2", "sighting--ca793b46-bde4-49a3-b273-dc12014bad0d", "sighting--baf6d9bf-2874-46b7-b9f4-952fc1028b86", "sighting--a355086d-7c70-4286-9aaa-9dee038f00d1", "sighting--085a6c33-0657-4096-888f-b91f6d5b9bce", "sighting--85badbd8-7f4a-4844-8f5a-b0b57badcb07", "sighting--b5555afa-e7c8-4682-9471-b02fffaa2463", "sighting--60114051-ec5b-4740-a482-78fea009418a", "sighting--c3e4e518-4ca8-4d64-9819-9937fbd3bea1", "sighting--a2bab0b2-6d17-42fa-aaea-5cd9a965411c", "sighting--94e1419c-e03f-44a4-bc2c-4803f0c3b741", "sighting--327ae3b9-8e16-4db2-a00e-97a423751d74", "sighting--7f12563b-c825-4360-90fd-2be1b8d4b18f", "sighting--9f3378ce-8830-4c98-b8b0-b7a957404df4", "sighting--e7989d72-2848-4b85-bfbb-aee528ae89f5", "sighting--d7165184-068c-424c-a0a3-355d5208b346", "sighting--c5b1907a-7c09-4ca4-9940-456f8e6f8145", "sighting--43404465-181b-4f7b-9e10-bf15a73ca6ba", "sighting--0a6bc497-bf0f-406e-8ec4-8f1aed403956", "sighting--1f147bd6-f131-40b3-bfba-09ce296008db", "sighting--916489b2-765c-4303-94ac-89ffa6ee71fc", "sighting--d3ffbd3f-d3c7-4388-9583-fed36cf0da80", "sighting--3a16ca19-bf7e-40ad-ad50-48d010c221a7", "sighting--f260f03d-562b-45ca-a883-55bb5ae419a2", "sighting--30fac2cc-1332-40b0-9031-d3d84bd595b0", "sighting--f4e0dd6b-dfe2-4bca-a76b-609602f7a431", "sighting--476cea77-3f14-4084-9d8a-84059a0c6534", "sighting--c480e60c-e1ac-47ef-89c4-d27d03861cad", "sighting--84873585-9fc5-4357-b73f-e96c1c034c02", "sighting--fa2473e7-571c-4d08-956b-5540a5a4f7c5", "sighting--b786a32a-afde-488a-a4bb-e4e9a0fbd839", "sighting--852fcea4-c5ca-4f2e-b568-b7f7f39df0b9", "sighting--a04423c9-af5a-4a99-ac8b-97aed3ad6e18", "sighting--d25a4723-0522-4a9b-b227-5b46dea4f501", "sighting--ba577e60-e259-48bf-92e9-e225690b21c1", "sighting--66667e4b-26d1-4d41-afb5-f8d6475addf0", "sighting--3512466c-c84c-47b9-b5e4-6fe86769c3d8", "sighting--cfdefea3-244c-4f41-a931-cb2bda136ce2", "sighting--b037e097-b014-48cf-a591-fcd0a0eee177", "sighting--4d1995ec-ebeb-48ac-9399-177455bad7d8", "sighting--778a70b2-d5ac-4d2c-81df-7f40b89e0a9c", "sighting--2a120bd3-a3a0-497d-b58e-b800639d5a40", "sighting--1fa153a7-589e-4dee-88f9-afeb0a7cbe94", "sighting--05125e0d-c9fd-4693-a4b8-2d294354a094", "sighting--6dc74356-7dfd-40cc-8ef8-2b59220ae74c", "sighting--de858c8a-ac78-4c01-b0e4-544c95a4c8c5", "sighting--9a17c994-3f33-4b25-adb1-1e2c21ee7f67", "sighting--e5b5ce49-748c-44cd-8681-d80c5084c9d2", "sighting--adc23fa2-c1db-46a5-86ad-9c8e3aee3414", "sighting--9e8c6612-f834-4b6e-b02a-2485b96f985a", "sighting--16cb5b17-c45a-4083-8a44-417aae5296f1", "sighting--b582b801-0d6d-425b-bdf3-5312d1468ae4", "sighting--92371f51-6a3b-4f8e-9e06-56c1ecfbfab8", "sighting--11232eff-3796-4a55-b76c-2f35c8702d8a", "sighting--7d3ccb3a-b11a-4906-a8b6-b4550711078d", "sighting--3e96fb82-c8a3-4f30-b7f3-81e137a0d534", "sighting--399e67f7-9f5f-4b2c-b445-5d37efbb616b", "sighting--46fe6b6b-1e60-41fc-90c5-a89b7fcf4281", "sighting--aa5d7da7-9bf3-4bae-9d37-212c43c58ae2", "sighting--3e84531f-e4e8-4ba5-9af4-ab1f05a42906", "sighting--a08e7a18-938f-4c72-a9e8-fae5ef965ea4", "sighting--fcd02ce6-b875-4314-975f-35f8bfd20162", "sighting--d5ccc2a0-da67-41da-8e1b-09f79e98637a", "sighting--b47aac94-9c61-4e06-9b1e-63bdbec93428", "sighting--e517619d-93df-411e-b794-a10a2bd84292", "sighting--9318ce96-9179-476c-9993-f617d39e1a3d", "sighting--e2e94241-6e75-4c8f-9d65-ced207b9a0c4", "sighting--7c894c06-07f5-4cc7-9495-4c7cc90e368d", "sighting--03dd766a-8313-4e70-882a-c7bd96ddf9ee", "sighting--29412c0e-15a7-4ffa-a449-20981744798f", "sighting--0b6412cb-1ea5-48ae-a166-23cc373696b4", "sighting--4686a95d-09db-422a-b1c8-8a3374f3394e", "sighting--91a4c5ab-a1cb-4db5-a34d-80999b96a581", "sighting--aaaa052f-a16c-4926-831e-7ce21cbc2c3c", "sighting--7eebfdfe-39d2-4eb4-a76b-d84ebeffd0d6", "sighting--7cc77e20-9b6d-4909-b963-18dc0085c196", "sighting--2644aece-6c25-48d2-929b-1b7e49de896f", "sighting--666b7312-e2b1-4287-818e-3fda3860e3d3", "sighting--8a21591a-5763-45d8-9f4b-a2ded6336776", "sighting--b34f372c-5b1c-40dd-8735-63bd0b661a94", "sighting--45adf3db-c800-4c9c-8199-4c781a5aae9f", "sighting--8e9fd0d5-56ee-40e6-939f-bb92326b48f1", "sighting--5dc7b6be-c127-43a1-91a5-e7e99f9b3ac6", "sighting--a6fa2585-9c23-4536-b54f-412efda742b6", "sighting--2e1960ae-88fe-4460-9369-662881afbca9", "sighting--281e9ddb-ea87-452c-82ca-785c38ea8262", "sighting--e072f7a0-e0cf-4201-8331-4fe5bb29061f", "sighting--83731252-15ab-41ae-a669-b18408dfe6ae", "sighting--8c83f76b-14c6-47d8-8257-0b0feb7a8848", "sighting--274e505b-5b15-446a-be02-4ad7dd6cce38", "sighting--fa8534d7-fe99-4f17-9adc-571026d496b1", "sighting--473217d2-0bb8-48ea-97e0-a5e53287c514", "sighting--2dfc2dc0-2624-467a-8663-140f5a9dd895", "sighting--46abb3c6-b393-4bfd-b72a-ff5c7ad428d5", "sighting--25987e94-4fd2-48cf-8e30-fe2ab0398d53", "sighting--58a4c921-a56b-4c60-9068-e3010aee7860", "sighting--e40fefb8-4b11-4f55-be79-38c666945668", "sighting--769f75da-abd8-4564-ab6b-a30135bfe29b", "sighting--c2ec36bf-32cc-421e-8ef1-8293c3748687", "sighting--f58114d8-3ea2-4c61-9c9b-a823ac41c8f2", "sighting--c148a35a-f04c-4807-9af1-868ed5d9f19a", "sighting--6389ae47-e0cc-4239-9704-6093a3142baa", "sighting--20164b7c-3ec0-4c85-905e-0153a4801c76", "sighting--4fccdf83-238b-45c7-ad44-f14895b05a34", "sighting--bae24399-2e73-4209-bdae-013f16ed932d", "sighting--7b48c8db-f9bb-4b39-b46f-3cf3d0a92b2d", "sighting--33606751-511e-40d8-a7fa-e85801aea2f2", "sighting--45029910-e3be-4568-b13a-e98f9d4f8203", "sighting--5ee618ed-8cf7-4339-8b6d-1aafc4f19fbd", "sighting--e4aee478-b8da-4012-a916-c3bd58dc62d4", "sighting--ae1715d0-6c7f-4d49-a4fa-c94c575e4882", "sighting--c25646cd-bb04-43c5-96f5-d006ced67b31", "sighting--01bfd212-c22e-4001-b3c6-79a35541a76d", "sighting--298b5f68-b3c4-4b51-8024-294d1ada493f", "sighting--63118373-9ef7-4ab0-9104-a3755c53bac5", "sighting--f07238a3-35ff-48cb-bcb7-10a65c35707b", "sighting--25f0e4ef-cb12-4c15-bae4-15828448f3f7", "sighting--faef14ea-0d4f-4340-a3ce-21d9101a55e0", "sighting--b1c5e8dc-f52b-4676-9b99-ec694dcf53bc", "sighting--0e92f75b-ad2a-44de-b41e-84ca8e915b76", "sighting--907b20e5-070f-48e9-942e-035b67dcf858", "sighting--783fdf3e-ef7c-4703-9baf-a104bc2e4ab4", "sighting--83831122-e1f5-44d7-ab78-dd821abeb80f", "sighting--c526a269-1ef1-4630-966f-576a6942febc", "sighting--1437e746-cb64-415d-85a1-9e0ecfc84da2", "sighting--3343fce5-8a83-4d04-9653-44fd3a04a266", "sighting--8059b019-181f-4df8-ac9a-5d8a9dccd0f5", "sighting--ff648dc8-3100-4207-bc35-b0ee23bc2185", "sighting--47694c9c-c8f7-43aa-8602-446c9d21d218", "sighting--a6b5ee5a-0b5a-4701-8eff-aa795260cddd", "sighting--7649e45d-7610-4db7-8729-4f047dce0777", "sighting--0ba04b34-83a7-434f-b862-c1dbc140d172", "sighting--bbb1bdb7-58a5-4916-b0f9-ba915a8554b0", "sighting--6f677381-e442-47af-ae3f-b73ecabf2fe7", "sighting--e02ad9b6-cb6e-42b4-9ac3-a4839c53391f", "sighting--5e160a72-5bd8-4680-9d2a-800100ce3aad", "sighting--4a6e0552-9642-4157-b251-4c5d9431810d", "sighting--dcd04cae-9935-404b-a38e-9130f84c81b5", "sighting--65ebfd17-5007-48ae-8f9e-0264b1e6ad11", "sighting--649d6e01-9cbf-4f16-a9d4-554543aee3f2", "sighting--ef7cc468-4f82-40b5-a6c0-e659f928992c", "sighting--e81d4730-5875-4d7e-a3ad-856c97a0f0ab", "sighting--1abdf95c-05c5-4ecf-b510-f17694fa7a65", "sighting--74063cbf-90fe-477e-8d5f-4f6f3fff28df", "sighting--9c175f1f-68c2-4d17-a616-2fe9a219c729", "sighting--cf484bcb-138c-4313-b64c-4bc034a8581e", "sighting--1c15a01f-ccd3-4a5e-b5ca-849db7604265", "sighting--9080c8a2-7ab1-4609-a8e4-bf72397b034e", "sighting--383dd528-4248-43a4-8a12-ad89b09cbd9e", "sighting--ca086557-c26f-4c6c-b19e-7a8866844669", "sighting--d7d9585c-b6ff-4060-a772-f2d553e4d8d6", "sighting--e3879940-3fb4-41ae-aea0-1eb8ab038391", "sighting--500e233c-5401-4fcf-a3a2-4fac57b5ea63", "sighting--09db68b8-13ad-4da2-a998-f4d3159adbce", "sighting--79dcfe34-4be8-4a7c-b4fb-ab195bee432b", "sighting--8c88e740-2e0c-4c9c-9e9c-34e1e405fbc5", "sighting--d70177c9-b69b-410c-b13a-0b92854c7a6e", "sighting--954ec028-d133-4377-9b89-a73dfb8f79d7", "sighting--60e10482-502b-4701-bca3-5c6b5b1343d5", "sighting--dc5a38a7-2706-4364-b923-671ae6cc3d00", "sighting--d79ca6d1-4735-4249-b5b3-a700b1b40edf", "sighting--4d7508f2-ae72-490e-9a5a-8bf9bfbf422f", "sighting--d66badfc-9119-4300-905d-3d06b039a812", "sighting--ec1f9315-ca7a-4c6c-9a20-0cd74e89d71b", "sighting--1548d4f1-6965-4f23-9517-113ae4e082c7", "sighting--a7c92df8-1d36-4ec4-a79d-4dec06ed6278", "sighting--078b2b31-eff5-4feb-a600-d9addff4c3f6", "sighting--80637206-fe4d-4474-b2a8-512cfad48d33", "sighting--ce716281-7816-483f-baca-607eea447cc0", "sighting--e4ac2aaa-5554-4bac-a3e5-5bbf3dea1673", "sighting--2dfdd755-fc50-49d1-9a49-a36fe54d30b3", "sighting--42b8dd01-0a27-4641-8b5a-1433ef3c6b74", "sighting--23fa1b20-a7b1-4ab5-9cc4-cf4ee95a85bb", "sighting--506b708d-8602-4ca5-910b-574757304ff2", "sighting--68d797e1-8d3b-4f21-b67b-1e440e0b3f15", "sighting--8ddb13f9-10f5-4baa-aceb-e119cca4020d", "sighting--a09eb344-78b2-48f0-af58-f8ef02f406b4", "sighting--67d7a834-379f-4b0a-8715-72087cb4abed", "sighting--eb6e362f-4c9c-4b8e-a624-7e141d560af3", "sighting--ab9d53e6-ec99-4194-8459-0633552c0fa6", "sighting--619c89f4-5a5f-418c-8102-d7b2c8525d9d", "sighting--805910c6-3f44-4fc9-96ca-4cea0e1a43f1", "sighting--67b2772d-424f-4e06-9ea8-2d3ea3a1ea3e", "sighting--8fcd4f42-8658-4c79-add8-9c46d1f09ef9", "sighting--21e95dca-8154-41ac-b13c-249b7380cd0b", "sighting--cb5783fd-90ec-42a1-9bff-afc0afcd8fc0", "sighting--760eb8da-e55f-4993-8cad-82a5e2d5e17d", "sighting--c203635f-25da-46a3-aa37-2c6d1b81a728", "sighting--1cbcd76d-1176-446d-b916-6706d0edd1fe", "sighting--3644d151-8b5e-4e96-8479-a38c29f5be6e", "sighting--08340dd0-84d2-477a-99b1-850b9ff23897", "sighting--06c3f39b-e991-4da0-b6f4-af3fbfb531dc", "sighting--f3cecf5e-ddce-4788-9950-111b58dd12ab", "sighting--b934a05b-3801-4895-be5d-023ac395355c", "sighting--74fa7c9d-d6cd-441a-92ab-4e522e7f7d5d", "sighting--04d9cf4f-7010-417f-ad55-fff67d36a7be", "sighting--ce8dc44b-80b5-43c8-a1b7-12cebc113175", "sighting--3f7c1bb2-ff90-4d3c-9618-238e26ca7e28", "sighting--b7dd0287-c3d6-4719-9102-42bdccb4ec9c", "sighting--8f3884cd-cfd5-4bb9-acfb-89b799620015", "sighting--3a70e613-d80c-4b66-a954-a645dd9cb868", "sighting--4e944efc-54df-442c-a4b8-93675515a05d", "sighting--393c5ed2-96e5-49c2-800f-7073a1ebe834", "sighting--e74ad49f-22d4-4886-940c-f05e5b194140", "sighting--567a1664-dc7d-4f2a-84a9-8d4cf8e99d82", "sighting--7cbaa970-6304-45bf-8984-6f427980f395", "sighting--7ac3609b-0652-40da-a340-7a1857e7626d", "sighting--09215e01-8b94-4a45-b093-68ba09b69314", "sighting--8f996db8-279c-47a6-8997-7e80c97edd4a", "sighting--5b79abd0-24d4-4434-b37f-411c4648d74a", "sighting--49380996-dfcd-43b8-947d-7fb565ff3826", "sighting--75cc77f7-6ab1-4625-8113-4ae5d5dc1770", "sighting--9b8fd184-6f89-475e-91be-15f2957f97e5", "sighting--442ba243-e014-4456-8592-4ea785201dc1", "sighting--d8778372-5d5c-464b-803b-ed1864f202d3", "sighting--35e11eff-c09e-43b1-bf43-f810f8fa4801", "sighting--cda51a72-42fa-46c5-8089-5fb8797b537d", "sighting--4b2fc45a-ee37-4044-a7fb-4af9ba11ccf4", "sighting--6391c702-5255-4fda-a437-3d94b1c201cc", "sighting--75bd8630-a388-4962-8797-1c17af6dc401", "sighting--ea1191cf-77cd-487f-a5ba-25f88bb11d74", "sighting--29c0b7de-d445-4050-be4b-2dd1a9a2b0dd", "sighting--d1d83bb5-6e66-419a-a9d2-5e772ef48232", "sighting--4e3edab8-d112-4f43-9566-b1c0a9136767", "sighting--bb5abe5b-605a-4dbb-b8e3-c763cfff47a7", "sighting--c7030fc1-0375-4661-978b-bc9fadfc73e2", "sighting--bc4f3b9e-7303-47bd-b3f3-9526b8e3b755", "sighting--b323414d-22ce-4c9a-a6f2-b2538facc62f", "sighting--090a3693-e725-4968-93c9-c5de82d21dba", "sighting--4f492581-edb5-48ab-a6d1-fe56f3321589", "sighting--373c789b-51f6-4ea9-a050-f54f480715fc", "sighting--39efad8d-6bd0-4af0-a8fc-ab8a6af07d79", "sighting--c9fd9b1b-1da6-40e1-8679-f819bed16fc2", "sighting--f1a7f7b3-5aed-410d-bd9f-03409a06207a", "sighting--f2a407ae-00fa-444f-b8af-4e13f4588e08", "sighting--e3668971-98b8-4a1d-be23-279029c086cf", "sighting--51c0cd98-56ed-4e5d-afba-ea934844e346", "sighting--85fa3aa8-6262-411c-9068-7d33fa937384", "sighting--78c878fe-4420-4c0b-8081-835efb9af2fa", "sighting--da3298dc-5e68-43a5-96dd-66f014da88da", "sighting--2697d4eb-a2bf-401d-8405-a710cf06ee05", "sighting--d795f1d6-9d99-443b-96b6-659c345e2a45", "sighting--12d06aa3-d61d-426c-9931-ede7c47b95f2", "sighting--8da7ed61-b168-4181-8bd2-08fc1c27e90a", "sighting--d9d376e8-81a1-48a1-b035-1bc3ada6236b", "sighting--9495bf09-8aff-4080-8a5b-e294a62a69b3", "sighting--700f5948-ed62-44fb-99b8-ad898cc0971b", "sighting--09cdc9ac-1805-4023-99e0-63834fdd7efe", "sighting--d224c8f5-1353-49e1-a664-464922af1bf4", "sighting--50ffa2bd-310c-41e7-938d-ae2acc393ed8", "sighting--6a7e3518-5960-40d6-b42a-0d7f9074dd11", "sighting--15735853-666d-42b3-88e6-d7f115c1b046", "sighting--c5ef3b1c-3553-400d-82c6-87f819de838c", "sighting--04374e45-d335-4458-978e-fcf2a97d3662", "sighting--ae07f03e-b475-45ac-989b-81f8530260b0", "sighting--c7734871-4577-4fa9-9af1-20535ef13cdd", "sighting--b4d377d0-17d6-4a11-9e2b-515b54940c7a", "sighting--50070ed2-bcf0-4129-a588-1c578aa1d87a", "sighting--0572d114-868c-4e35-88ab-08ddaf6bfe7e", "sighting--d1237877-d58c-4cac-b0eb-9fecd0470c04", "sighting--523bac1c-88fc-4f1c-9b2e-6ef777d7ac98", "sighting--90a6b1d0-8af3-4c30-9017-16c9855f6741", "sighting--30f3bd08-05f5-4e0f-b3ed-1e0fbc1ec2a2", "sighting--f8d58832-80f9-4257-9a1c-3399c7e3ebe5", "sighting--7662a5e7-b66c-4201-96dd-357591c434b8", "sighting--56b40225-5075-4acb-827f-c71825a1cc7f", "sighting--b522b6eb-baba-4246-b9b3-1a74fd21060a", "sighting--0b172216-4ce4-4aa8-a58d-bd7464ed34a1", "sighting--dc50f1cd-c773-44f1-896f-871719e7ec88", "sighting--9c3aa211-dd34-410b-a9cd-e9116bb9a092", "sighting--49b7230e-838a-4963-9082-2af62284e8ab", "sighting--1bf89d5e-78b5-4133-bef2-a3cd2684811b", "sighting--ae251520-1aa2-4a4e-a956-2754b6735a75", "sighting--ea395700-ce5a-4cd6-9eaf-04d2d128c013", "sighting--449b52f3-caff-4185-ac31-19d7e223d930", "sighting--031da9d6-9a25-4ea4-ae02-a5d7658792de", "sighting--781ad06c-c577-4e1a-a1e1-889b5661a5ea", "sighting--7e0e09fd-e5fc-402d-9cc3-222713483153", "sighting--b25d75a1-bed6-4969-bab3-05f2e17285f3", "sighting--b955c73b-b5e3-4391-9326-a76fd62303e3", "sighting--9bf02234-8ccb-44a5-9773-b625db4ba5aa", "sighting--69b7886e-f335-44b3-b23a-04b28206618b", "sighting--a8b54b65-12cb-4200-8e5c-17de1a9176c6", "sighting--1337f3e6-50c4-403c-b55d-0f01620fad38", "sighting--48401a61-df4b-41f4-b8ba-4970595809b6", "sighting--6cdf1476-77a3-4f1f-a5e1-fa7488498b02", "sighting--76570703-e211-4ea5-b2a9-08f1326c3e3b", "sighting--de48d684-5f5e-4e11-921e-6d1ef6003c6d", "sighting--d7d5ed07-557c-452d-b948-fb72bad5ad6a", "sighting--d92271c3-6cfb-4b35-a63b-8fd950af9178", "sighting--939ca8be-aff8-4b68-9913-1fa960ecb419", "sighting--52cdc66d-ec24-4939-916f-0b2c2142dcb2", "sighting--aee1b2ca-fe8e-4b11-a7e2-6b6b0455a37e", "sighting--76841773-1652-415e-8214-e76c99c4d719", "sighting--284df1e8-3db4-4ced-9a10-7ee929169451", "sighting--d9a4117b-51ec-4200-9bf8-f523ee7eec96", "sighting--bb8c5c93-1556-4fb9-b984-af994fede485", "sighting--5c906563-978b-4d12-8fa9-317eea6022cd", "sighting--2b5f2d79-aa4a-42c7-ad85-11a0773718c9", "sighting--dd5198dd-7606-427c-a33e-93f5e0b2778b", "sighting--75c8737a-0297-4564-ac56-c29e1a1e30cf", "sighting--0b27ffe2-7ebb-4c2e-8e4a-1bf99ea79710", "sighting--45ee9d84-1f80-4ad9-99bf-f1df2b621892", "sighting--911912a6-e600-43d2-819d-489ba1e7a98d", "sighting--6ff8e3d2-ef41-4567-9674-cb24b425dc7e", "sighting--63285548-b35a-46f5-93f8-577d8895927d", "sighting--fd8d3c08-70dd-46f8-8a64-dfb1a133e81e", "sighting--95d18576-3c6e-4f59-915c-d3ecb1774239", "sighting--8a696600-cf69-4d84-a4f8-9291f1c039b4", "sighting--80018bce-982d-4052-a651-3491f4a80ded", "sighting--3f95c550-422d-4ff6-b057-264d1e7f58e7", "sighting--23a55b9d-486d-4cd5-b19a-d90ac2a32f5c", "sighting--0dd09f6e-7044-4860-8355-dcc2fd0ba157", "sighting--89d26945-0439-4fbd-8bd5-ce73a04cf749", "sighting--2d5c3da0-c0b9-4120-887c-074eaf297e03", "sighting--3ab26ca2-c3c5-4fe2-becd-13963b08025b", "sighting--5c333555-75fa-4378-a699-878f8a486543", "sighting--236ae99b-1e86-4996-a4f6-8562d3a26072", "sighting--ef5f9a53-ed9a-4702-b45f-22d0e5530368", "sighting--2ffb0d9c-f13e-4604-8737-88e2c8074773", "sighting--e5c06483-f628-43e0-ba36-ab06f6fd3d76", "sighting--e2cc716c-b600-4e22-bafe-99f8b5beadd0", "sighting--b429e152-540f-4740-a721-123b9c8b4c2e", "sighting--e2dc6e63-877c-42c9-95d7-1e607214ee72", "sighting--ad8a9898-21e4-4ae0-9585-7930955482f5", "sighting--329b1ead-fde1-4369-a9d8-4c2881032a3a", "sighting--cf01de0d-a001-45a7-a81a-dd23522ad222", "sighting--5c5178a1-b62a-4476-9d4f-202f23d23ad2", "sighting--7260e910-f59b-40c7-a72d-bc594b643b7d", "sighting--2faf92fe-6bf5-4b8d-9b96-f6e3fdbe7a1c", "sighting--4b06c927-3f2f-4f14-95c0-7067eeb2e4a8", "sighting--6352c97c-4db0-4b04-b078-0002d3c900b3", "sighting--05fcf255-5c9a-46ed-b4d7-449ac721112e", "sighting--77788bdf-584f-442d-bbb0-3adc1aa7d1ee", "sighting--40719034-e1c9-4969-834c-a7dff147acbd", "sighting--816935fd-843d-4a9c-a826-0f7dc4a3c1e4", "sighting--13e62092-e338-4f29-9e0d-35ca2797698c", "sighting--b80f755d-f7c3-4752-a588-659066aacd0b", "sighting--07c2c5cb-7ea9-4544-a6bb-db1112c7f6bf", "sighting--67997073-81a2-4cf0-9fa5-eba85825875b", "sighting--25fe37e7-eea9-4569-902a-fda5b550773f", "sighting--2d75f0d3-2fdd-4acc-9f06-5f1c6664f2d7", "sighting--d3c0d01e-363a-4cdb-a35c-99677375b899", "sighting--168a0a39-d5b3-44fa-9b1c-ed02d8490029", "sighting--66e5bba1-b22e-48e8-b74a-e1f4d731fdb4", "sighting--108a7527-ea32-4c72-b808-baecf8d00d76", "sighting--8bab4351-a253-4c5a-b7c4-ac7df6ee393c", "sighting--acbaef42-bbbd-48e1-828c-9afff68c0c12", "sighting--d6befe02-efcf-493b-9838-544b527b42a0", "sighting--8f860c2b-67ca-47e1-8174-4e8a34c26a50", "sighting--86ec9a05-95fc-4b30-bdf2-7122fc498a7a", "sighting--52e1e6d3-733b-4a9e-ac28-89d1f6a07374", "sighting--d2f183e2-0010-403a-b54d-05947eb25659", "sighting--c0cd626f-6465-4ec7-b86c-803ce4093571", "sighting--db150833-a7cd-4798-bf09-6cfefddeba89", "sighting--c8913a8b-074f-4804-84ba-e328ba022d39", "sighting--66753cc2-c8cf-481d-b699-d7669de9fa0b", "sighting--1b0af3f2-9118-4bb2-b2d3-b7bce6232204", "sighting--f93236d1-6cdd-4be8-a4de-8f793dd634b8", "sighting--aa293733-1abd-4e2f-bf0c-fea8d5e274f4", "sighting--478766a4-1ff4-4c43-b739-4c5286dcbd38", "sighting--2b44ee90-460d-4b88-92ec-e2091b2b9dca", "sighting--4a848be5-492b-4296-8f1e-548e45b44898", "sighting--5fd9e119-b973-4632-ab3c-084592373aea", "sighting--9ff9c38c-9db6-44eb-9508-e800594b0e6d", "sighting--dbcd650e-578a-47fe-9d8d-a51e8b73da7c", "sighting--a502d308-2147-4068-a8d5-9b9cf1bed064", "sighting--1f8fa326-72bc-4ae7-8439-6228dd498ae6", "sighting--71094960-8fdb-486f-bde3-a8e2437483ed", "sighting--ae4680fb-1dd2-4cab-80a5-1e7c379c4a8f", "sighting--79b323d1-3ea4-4e45-be91-933d64abddc1", "sighting--0bac7008-e5a1-4b2b-a841-75f3e6d3023f", "sighting--3544c31a-036d-4cbf-96da-3a5b8f0d00e3", "sighting--5dc959b1-d668-4ac9-b12c-7b7dfcee1ccf", "sighting--91ecf1bc-dde6-4909-b14a-657e92a13531", "sighting--f9529fc4-1d59-418e-ba80-d7f8be904a4a", "sighting--2e5f02fd-ba2c-4a63-961b-4dd967badb9a", "sighting--28dc5a36-52d5-48ed-9ecf-9d63cebe5287", "sighting--d1806a18-90a7-4999-9abb-56d370dc8911", "sighting--48cb20cb-4f65-450f-a9b9-e82c6f69417c", "sighting--fccdb419-dd9e-4766-9bef-ebca2bfa2824", "sighting--4702c37b-5b16-4719-b9ea-6f2072e0628c", "sighting--7da14f25-15ab-4191-871f-a6f49ed17ff2", "sighting--9cdf16ab-76f6-40d2-b16a-036db6f9ddf3", "sighting--a2c4b77f-3dfc-471e-8643-f2f28cfa3de7", "sighting--2c9ee33d-d3ab-4a30-a168-d0ba1b5730e9", "sighting--3a6262d5-cf47-4839-acb6-59af22862c65", "sighting--f7a27ecc-9715-4a8e-af37-86cb39c3cf95", "sighting--60f15f25-cd19-4034-a66e-738b32934c48", "sighting--018a1b82-be41-4bb6-a0a3-0a89b9b1804a", "sighting--73185f55-3bd8-4501-a5c3-b214662349a2", "sighting--dcbfa272-9a3d-425c-a69a-a4aac833074b", "sighting--c74c7ca5-cc78-466c-a14a-e771ed70747e", "sighting--a58489b9-f1c5-430b-87e3-d8dcd184c7b5", "sighting--3d294658-ecc2-49ed-b4da-d64d71090fde", "sighting--b4e6ef11-ff8c-4ff2-a80c-237bc7bc8cae", "sighting--1b263a9e-75c9-4c74-9959-070b9fe33c55", "sighting--b59ca97d-e10e-48eb-be35-7629b9e23e1f", "sighting--6049b020-57a3-404f-ba68-d6d641f80b65", "sighting--edc0ffce-34f4-4e0b-88c7-4006bdf84f8d", "sighting--bdcd609f-7b9a-4b7e-8074-75563c0f59ea", "sighting--a36f1f77-b74a-4db1-933d-fec06b9b798c", "sighting--54191f6a-1685-4ff4-aa70-7df1f8ecd90e", "sighting--b918485e-f505-4389-9222-968c62ec5ae8", "sighting--2c088c90-a155-4623-9685-ac8a9b2d8f64", "sighting--34f52bfc-dcb3-4701-9af8-c158c28b382b", "sighting--f649181e-9dea-43cc-a618-c9da1723c66d", "sighting--67339b56-fb8e-4560-b173-b5758aff1fca", "sighting--93835f77-a223-4773-855e-d14498cf288b", "sighting--b873570c-ce2d-4dfb-bf75-b50320dabc57", "sighting--69a57a61-32f6-493f-a601-e1cae2dc029a", "sighting--34a81d2c-9741-470f-87cf-346a983e8763", "sighting--51be56e4-8ccd-4c9e-a8ff-2412533f5084", "sighting--e228672e-8ec4-402b-a59e-ef732aedf911", "sighting--e435c2a2-410d-4348-b322-81bc0bc57909", "sighting--4a4a2257-7f25-495b-b070-8f40d03e3ce3", "sighting--07d434a8-191f-4f29-9832-4821217abfb3", "sighting--6178ed1a-dbc9-4299-b013-f7ee8bcbd036", "sighting--b2aad275-6d3f-4f1a-979b-bccca46648c4", "sighting--6b582619-9473-4304-9cd3-4efacd4d7769", "sighting--cad64526-367a-4655-a7a8-42093f738f99", "sighting--5ea93b0f-fd73-481c-ab7e-b6fb41be82cd", "sighting--d0933a3e-e405-4937-a5fb-fb3f49d7ba72", "sighting--49c51a09-4d65-47f7-8283-4729c348decf", "sighting--1a134470-d8e0-42b6-ad79-27633f07cca3", "sighting--09fb185f-8c86-4c3d-88a5-8626dd5a0ef4", "sighting--03f30778-9d79-4202-9ee2-5ec53fe3d536", "sighting--98de174c-a8b3-4480-9959-27b7f036e6d5", "sighting--aac875ec-5329-45e1-ad87-583ddd3e4b76", "sighting--16b65572-f2d7-473e-b3f4-60ee78e21d0b", "sighting--171fddb9-2df2-4fe2-8931-b5dfbf4cc7ac", "sighting--53b55e90-eb38-424f-ae09-ef821d5fc600", "sighting--bef59cca-b042-4928-a4b0-e583774fcbe8", "sighting--7a409153-91ad-47df-b723-d285f974a45d", "sighting--cbc03512-f716-42fb-b155-b6901aa4f1ea", "sighting--17ce34a3-3bad-4c8b-9923-a6608bcee140", "sighting--6e7909ff-6ab1-446d-9086-4a1fd9a7d004", "sighting--740adb11-aacc-499c-a907-57f69d01a4a5", "sighting--27049940-2cf0-42d2-90cf-70cdd5715027", "sighting--40563048-4570-4da7-9ee2-6ff76d88f87b", "sighting--23eb6a91-d241-477f-a304-db5794364f24", "sighting--1a5e52f8-a0fe-4413-b572-95eedd34a4db", "sighting--dd45fce1-e233-48c2-88bb-2f042642f0e1", "sighting--bc37936b-e607-4749-9bfb-9f6f5f505281", "sighting--e6019109-f339-4d4b-84d7-003ae48938e9", "sighting--55fc57f5-a5a0-4e92-a5b5-ec9973d7e7fa", "sighting--25378c74-82ea-46f2-b565-b7694d703744", "sighting--fd37e330-a205-42fb-becb-d770e3fbbc98", "sighting--cc5f75ca-724a-4275-9339-5c967505af23", "sighting--1a7edca1-9396-4d34-96de-ca68621b715c", "sighting--49c44be0-7abd-408e-a9cc-daa959695633", "sighting--6ba5f25e-d3e0-49b6-bbac-c5dfa5c62a38", "sighting--680678b3-454d-41e4-bdc9-6b61140aaffb", "sighting--02b1950c-98b3-4246-84f6-38b18d58ddaa", "sighting--5563fd95-be3e-47b9-89b9-689c04dde5e9", "sighting--fc113a40-1d20-4351-8236-898d0fac7e3d", "sighting--4f9344ca-b353-49ca-9e59-a09044cc8960", "sighting--3d9c5208-65f8-48b9-a865-367f2819d702", "sighting--b93e2338-1955-4387-991e-5fb1cd33a12f", "sighting--1bc53aad-e7b7-49ad-8c4d-26cd482e0c07", "sighting--8a7a34ef-badf-4632-a18f-f56baeee7dfa", "sighting--a9b3c108-a337-4cea-9bc5-a1ac088e9288", "sighting--5e4add9f-d7e0-42c1-932a-aeb25c73b078", "sighting--2a895303-6aed-49b3-aa7f-f31b1d33349b", "sighting--8cffadb2-7c95-477f-a576-953124371114", "sighting--18ddfb0b-33e7-4790-a3bd-f37a8d011acf", "sighting--dd126cb5-ea8b-47d3-9574-f80e1eb756b9", "sighting--01b0f410-ac52-45ae-acf3-c875e748d36f", "sighting--03ffe92b-e9c9-4535-a82e-554460a39e1e", "sighting--d4c0e96a-1bd3-4974-8b1b-0bb079acda50", "sighting--754ee66b-72fc-435a-a5da-310a87dd2bf9", "sighting--c857c858-12ab-4a5b-9041-1f70b96b4ae5", "sighting--e7240638-6a45-4514-a9ac-1b665b0a6a69", "sighting--b6042a0c-4250-4f12-9ec9-92570db82560", "sighting--5a39ce99-68f9-45d0-b8e7-06944b5bfd88", "sighting--9907013c-c175-4023-a841-8e5f1b206a75", "sighting--80c5b4be-18f2-4206-b0cf-1de2aa73d6d7", "sighting--035cbd40-c72d-4711-b8de-656d78faf8c6", "sighting--690a86be-f431-417e-ba3c-d6e82988feff", "sighting--209028ce-b8a9-4591-bf71-c6bb9302cbf3", "sighting--04991cd3-1d10-4592-b1df-046f9fee0955", "sighting--2c8ad08d-8786-4704-8203-5dad739e3007", "sighting--9e0718a4-701a-453d-b47f-31aaec56e158", "sighting--c47cc335-f0b9-48b3-937c-607a7deb43d3", "sighting--6939c1b2-bcdc-4f4c-9b65-40c14f609554", "sighting--fc8a2a2a-52b3-42e0-bda6-347ee5b71dce", "sighting--62dc36fc-b60c-4000-94cb-9786661673b9", "sighting--14156fea-4c23-4d94-bf10-22a9bcd1a800", "sighting--6de7c7e8-3bb6-416f-b29f-170f36bb4b55", "sighting--97e61266-3482-49cf-8ab3-c899d0131c1f", "sighting--acefb607-d42a-48b3-b810-65a6a62d33d4", "sighting--189fbe1e-1473-45f7-b41d-3113eafc430d", "sighting--86839884-358b-45bc-8386-cd047db93262", "sighting--e9cb6f19-8bc6-4ea8-9f57-b7f6c2806123", "sighting--86b31229-1bf9-4590-a982-077d20b1d0cb", "sighting--cfabbc8b-955b-468c-aafa-b049c223be6b", "sighting--7022baef-a4be-495c-ac30-06be5aac2667", "sighting--f36e11c6-4d96-45d1-a0db-5d96b76ac238", "sighting--798f6c1c-864a-460a-831d-0dcffef8fca2", "sighting--faca145b-a2d4-4d6d-a47a-809fe0df762a", "sighting--26a54c77-7648-4f3b-ba3a-e443aa68c81a", "sighting--477fd501-fbe6-456b-9e32-a85b9b80fc0c", "sighting--18bee0e5-a6de-4d52-aef8-ac73637c9a91", "sighting--04ccdc38-2e01-4142-9226-6671bd623703", "sighting--1c50273c-87e2-4213-8e65-79b657030524", "sighting--419f4a96-9adb-4728-9f76-f9d013d821b7", "sighting--339b67e8-0057-419e-b45f-786de6a482fd", "sighting--32f0fca6-96e6-49c1-8646-a9eee63d4a2d", "sighting--c213c1bf-d00d-4395-a883-b2333acf09b6", "sighting--cdd70b32-affc-49a8-b090-323df6df1bea", "sighting--03a09220-1976-4a98-a353-49ec4ffe3401", "sighting--20394139-be97-4fa7-b817-92271ab08c38", "sighting--fae33ec7-3fbe-453a-a312-09d46a3db7b2", "sighting--dc1dba0e-2ddb-4336-99a6-d2c1c0507e82", "sighting--9aba3137-5ae6-42e0-b4e0-8b8f27b96c5a", "sighting--42e9b2ad-31ea-4cbc-8681-9abeb29b428b", "sighting--bd656300-75f2-4a03-bd16-0a826428add2", "sighting--2f3c3068-e0bf-4d2a-a0e9-7018561fd896", "sighting--42507fa0-e603-4121-b486-8ac4da96efe6", "sighting--fa8668e4-8c50-4ae4-bead-8080c894eb1a", "sighting--dcd99412-16bf-4525-9f2c-c0ddf7573720", "sighting--6840efe5-b89a-4844-8fc8-4d0310ee0957", "sighting--978b6af5-b5eb-4d04-9f20-7271fc80e348", "sighting--07d140b5-963e-4a06-8d42-94b1cc0ed640", "sighting--75f6dab9-c3af-498a-b17b-477d6413c8e0", "sighting--e36fec97-36f7-4f1a-849d-83b21eb17c99", "sighting--19fe5375-0b48-4fba-8b42-a5fc92a9c3da", "sighting--199a371e-c36b-497b-8fa0-e13c170b2c4e", "sighting--7e9f8c11-85a0-4381-84c6-03c1f58a153b", "sighting--ed562fec-5efb-4f21-b837-2bdf927a1426", "sighting--a3d6ff54-f543-4371-9d19-e240a94b2537", "sighting--5ebf9838-d62d-4b08-b4a3-b6d31b551459", "sighting--f914b7fb-15aa-484b-80d3-e153c6010b7c", "sighting--3093079b-4b98-4b23-aeb8-e28ef7abf152", "sighting--62bbf9a5-a5ff-4225-92cc-3fa033deb049", "sighting--3dfb049c-6590-4c83-b718-3821a2ddd7de", "sighting--f569cd96-b147-4820-bcd7-6f6385430814", "sighting--ba2e0aad-9e9d-4867-b5d5-79a9a1b51a9e", "sighting--6bb5ccf4-723b-4758-adbe-f46989a4f4c0", "sighting--15ad1ce1-7d7a-4d29-af86-d23b3ed06ee9", "sighting--78d727fa-c0f0-4fa1-bb8f-dad8574d01e2", "sighting--63a557fc-e7cb-4766-846f-c7c69b3086e4", "sighting--004faf80-be4e-4ac6-b9dc-4bfadfb305f6", "sighting--5e628e1a-ea40-4ffa-8105-2f7c390f9077", "sighting--cdff2532-3be2-45f2-aa3e-dbb5480dccb8", "sighting--e3c47b5d-ad10-49d0-b0e8-6d5a354619fd", "sighting--4164c0e9-8978-4ff8-9711-2e213e5819d2", "sighting--e0675157-5b56-4dd3-abbb-16833e282496", "sighting--e14ee6e6-c7b1-4519-9156-a6711b061882", "sighting--1e3364cd-5453-45cd-adf4-e44974d1d5f5", "sighting--a3ae6e3e-f1c9-4657-9ff8-ec765d569bd8", "sighting--09573d65-4e6e-4a18-887a-f99b0d506372", "sighting--a124f059-c2a5-41b7-9506-6ef68b126779", "sighting--a3b136d0-c8c6-44f0-96d8-2b61991e3f5e", "sighting--2ab7f5d0-8fb7-4395-b2d0-fba42d21c8d2", "sighting--aa6c058b-04aa-4b6f-9fcb-b74d4c2a1b8f", "sighting--0ecfd962-ab94-4522-8b10-ebc69d2d4c2f", "sighting--14bcae98-ff0a-461d-a4eb-53f4ffe131ea", "sighting--4fe64870-5c9c-49c5-b583-60954f025621", "sighting--41f7a0a7-9bb8-4128-af2b-07a0c209c605", "sighting--3980c751-1d47-4850-ae01-aaaf0d48d5ad", "sighting--2fae619f-8367-45fb-8513-65abca589f9b", "sighting--6fe8c37f-b03f-48bd-9700-9e456851cbaa", "sighting--a72a3836-bc38-4a1c-b4f4-0aba9c26480d", "sighting--0906a72a-4de3-430b-8a74-1f3087098a71", "sighting--89721ade-5e7b-426f-a027-a8b471154363", "sighting--689e2a6a-dd60-4437-a31e-4f55cdf2598a", "sighting--156a7825-f1ea-4d48-ab1f-4a12921dd0a6", "sighting--d3a7bc66-cea1-450a-8819-4dd2552deca4", "sighting--ce686257-f7e2-4002-b4d8-26003a84af78", "sighting--73f34f0b-992f-4c9d-bee1-401a8d1f79db", "sighting--94d88625-483b-4e2e-b267-bb9f6571ed26", "sighting--5110fa6d-dac8-4f68-ab7b-dfedb890bd16", "sighting--c303a7af-4536-4f0b-8990-210d88fda6cd", "sighting--f838a3da-9837-472a-952d-e16a1cbb134f", "sighting--973d637b-e7bd-4592-8de4-4b2ac18dcf81", "sighting--7829886b-3990-4528-a68c-f5a98d952464", "sighting--0c60c3d8-925b-4622-bff6-70c8750a13db", "sighting--10631775-596f-4522-856d-3c88c1824794", "sighting--b47d5525-10e1-480a-8f39-88559b38b583", "sighting--184ba112-3e00-49f3-a40c-a1e54c19c237", "sighting--8bb577e4-b1b1-49fc-ac97-87cb6f77dede", "sighting--fa5c3a69-ebfe-4c8b-adea-063d98d8a983", "sighting--a9f07b5a-2423-40ee-954b-8f7a9fe31467", "sighting--b94ddd60-834d-4bf6-9277-f05f420e600a", "sighting--c7a9f53d-7b4c-4dd9-8d7c-01442f45d23f", "sighting--3351228d-7cdb-4a38-aebe-a8d2907d82a0", "sighting--16b2bc10-8113-4f95-87bf-84913c0d2335", "sighting--2dd59e56-69de-430f-8aaf-7247f97c5f5c", "sighting--22758021-69e4-46ba-a9a6-bf980f683bae", "sighting--42bd2b59-f029-4d25-9f4e-17c690830934", "sighting--b0f8a312-0ddc-477b-aaa2-b95d1d5ee5f6", "sighting--742f4a4f-8859-4a9b-8f14-6a8cc8df2439", "sighting--aad6ad64-0fb0-4390-8db0-99f14dd395c7", "sighting--51068bb8-6692-4100-9fdf-754931132c25", "sighting--2e0cf5be-773c-44d7-a7a1-0f5008735aa2", "sighting--b25f3994-7a42-4060-a419-73e2d6c5753e", "sighting--df1f2721-7507-483c-9b65-a8145765721a", "sighting--d7d7e57c-74bd-478d-aa7b-f4bf136db317", "sighting--f4663ae5-fcde-4292-bece-44b4a87d49a8", "sighting--a71e32e8-5cb2-421f-aa8c-4709f7211ea3", "sighting--aae309ff-3919-471a-bbfa-6b990806af45", "sighting--703c1770-5270-415d-836c-319d9b3b73f7", "sighting--51010cca-ed1a-4c84-b166-b8947040edc0", "sighting--8b712aa5-4007-4dd2-b62e-ed8a7f367469", "sighting--8efd214c-f9f9-4c19-9db1-e41e4e6734f3", "sighting--b92de9d6-953e-4098-962d-686c8ad43030", "sighting--1d19d0eb-208b-499a-ba26-3760f856ba00", "sighting--ed040aa4-f134-45b6-b03f-dbbf006ae352", "sighting--ef0bfd51-aba4-4edd-80fb-ce9776432ac0", "sighting--c6c19479-c96a-43ff-8d46-bcd071c1669c", "sighting--c8a009f4-1758-4861-8981-f65e4744a113", "sighting--535284b3-e094-4aac-bff7-6319cf38ffea", "sighting--e1c1cc55-f10b-4365-96bf-e52f37516a48", "sighting--1629b9cd-5818-4bbb-b76e-4d7c03420a20", "sighting--3bcfd738-ad22-4c67-90ab-a29867ed3024", "sighting--03572ab7-225e-4e79-a590-9207a95696d2", "sighting--718b3103-f636-484d-97ae-8e98c7bb73ce", "sighting--0de5bbdc-b1c3-4eb7-a2fd-18b383d96a0f", "sighting--fa8098c4-afa6-41c0-8d25-1015b35e663e", "sighting--01542a5a-7a1c-4e23-a370-7bbab1fe48bd", "sighting--e2d35ae3-79f2-456d-a72b-0e6b2f7d59f2", "sighting--2024351b-62e8-483d-9abe-4d6407f40a4b", "sighting--06cda4ab-cfad-403f-82e6-fc63ca853c3b", "sighting--31d1e129-f7eb-4aa4-8818-5c89866706eb", "sighting--61592810-6c98-406b-9b16-31ef83bbbb66", "sighting--9be2e321-7a38-42eb-adb4-216856129c62", "sighting--f31a408f-2e67-4975-b4b3-7a96cf08dc74", "sighting--dd89f14a-984e-49e4-8513-2ab616a173a3", "sighting--04251f00-4a0f-417e-976e-763bcea12334", "sighting--001c5f6d-e154-4386-8c7f-e97ae6da25db", "sighting--dea3461d-584a-4416-b85d-10b31463d4a6", "sighting--6e1b823d-e4a6-4de8-b432-d546af1a1f94", "sighting--2f9e41c3-b798-4f33-aecf-0cba97c9ccee", "sighting--d277d286-4af1-4427-aea8-e132bcfdf867", "sighting--a9e8d182-57bb-44e3-be39-6b7193280baa", "sighting--76b72149-00cf-4b92-9a03-048e6e14ad8f", "sighting--d284d077-1edf-45e0-802b-f97646d50959", "sighting--b9313d3b-b217-42f8-ad08-198aaf8a10b2", "sighting--77391e88-eb30-45fc-be88-81731f96ef7b", "sighting--107a647a-5368-42bc-ab2a-ff5547c75644", "sighting--d7fca2a0-af73-4bd5-937b-3d74fc7d43b7", "sighting--c22ab8e6-84ac-4020-b35f-9aa9d8084ae9", "sighting--7052d43f-51a9-4e4e-9c9c-31b908ad9c65", "sighting--e8e7d1a9-153e-4f07-be64-67094a57c68a", "sighting--9f1e354a-1ad4-49c7-b144-7f44f12382be", "sighting--92d16022-da4a-4558-9336-fb3f250ad051", "sighting--d95054dc-d23c-45f4-a025-9f0394f30563", "sighting--24c139bc-379b-42ba-8862-8a0acc8d2e34", "sighting--b15bbc83-27d6-4549-bf24-d12d254bdd06", "sighting--83dcb093-2b0d-4274-a853-9f8229543040", "sighting--aa17ebb2-e88d-430e-a2bb-c17a857a723e", "sighting--854a713f-56de-441e-bdf5-5b76de9a2848", "sighting--e20d715d-9fb3-4b97-bd17-5f78efe56bde", "sighting--da032508-8bcb-422a-8c2e-d6e972b0f406", "sighting--353cdb85-fb00-4ca8-8292-46aaede202c4", "sighting--e5c211f0-6151-4cdb-92cc-a70f6eff9f1d", "sighting--20b3b714-db48-446f-8f02-195f2a602679", "sighting--6ba8b9c5-c78d-45b4-a5da-689ff2334893", "sighting--21fe8148-aba8-49a3-aa6f-17e451a9b0e6", "sighting--6a384111-5e2f-4ea7-bc7e-87567c45bbf0", "sighting--b71b50e9-bddf-490c-8831-73ffa4b27d2b", "sighting--c0ebfcd1-2738-4e00-b48f-cb638a997b24", "sighting--9bd4e7c4-7b33-4283-842b-3e512a3e5a24", "sighting--5c8ba35f-9255-4260-a21c-e0d98d3bc53c", "sighting--5325325a-ad2e-4d95-b403-ffa54bfbcb25", "sighting--3128331e-15b4-4a67-9a7c-4bd251e5d9ca", "sighting--bc52dca0-9bb2-4bd2-b367-8a8593b12fce", "sighting--3c39b839-c08a-4b93-83c7-01d20b431ef4", "sighting--dd2c2896-18ab-4480-afbb-136a069f18eb", "sighting--256ceb11-c6d1-48e6-ae91-e42d6de6a94e", "sighting--91bdc768-6184-4fdd-8415-27375a05969d", "sighting--47f96f64-b47e-4e8a-8725-e3c103f71100", "sighting--3d9cc6fa-ed9b-4303-a173-4c22ae1ec9d7", "sighting--5d2d1f28-faca-4066-8da3-e38478849300", "sighting--c8cdb9f4-3cf6-4a3b-9957-7ceff9a97476", "sighting--558b7416-a3e0-414b-9362-239a4e8dafca", "sighting--35762061-fd39-4fa9-8aef-345dfc9e9e85", "sighting--ff663a72-3595-459c-9644-37e9b906a15e", "sighting--4b075793-ae33-4d9a-a238-c301848c581d", "sighting--ad1cbd60-498f-4ca5-a65f-d20f12fedc7e", "sighting--30def0e0-5d10-4694-b6f9-9125823b6f84", "sighting--7fe8d73a-aab0-400b-989d-d511afce0cf1", "sighting--c89e523c-4475-4320-afa4-172270eca458", "sighting--eb3e162c-c7d6-4738-80b5-6549fa754341", "sighting--2793600f-cb32-44b4-8a55-24182cb28635", "sighting--481fac1e-bbb0-4491-8572-827b58400292", "sighting--ced4467d-b613-4dd4-9858-623e07ad6c54", "sighting--e4b244d0-5012-41aa-9f19-87be88b94ad2", "sighting--e1135284-3875-4e27-bf8f-01cf0feb6046", "sighting--ba3668c7-9c3d-420e-862b-098f53d5cca3", "sighting--bbb5e99d-6288-416a-b87f-e2825b13a9e2", "sighting--81c60439-966d-4a36-b624-6d4c0a2c11cb", "sighting--6b524093-34b1-4d84-a83c-e8b309f3d2b7", "sighting--fed5173c-cd18-4198-8428-99464e54b3d4", "sighting--0f1745dc-c415-4e48-a8f4-b476d4f3740f", "sighting--643e48b7-3743-4124-a153-496bf102e7b9", "sighting--9d866883-3f01-4ce4-8a2a-2eb5c431a4fe", "sighting--e2c02f81-14c8-400c-badd-bee1514c0b3c", "sighting--3bbf361e-dcbb-40ab-97cf-e8e90733614b", "sighting--34122410-fb6b-4f01-9c4e-1ea037a23b06", "sighting--1c99385e-6858-4288-b0d3-662231831a60", "sighting--f17acb8e-176c-442d-861c-b22aeb5f0b9a", "sighting--dc49da66-108f-4ec9-aef7-230bb0ac1804", "sighting--ddb353e9-ecef-4a59-8e8f-19a47a1558ce", "sighting--381a69de-3b05-4589-a32a-e8d0c15d0629", "sighting--b098ef9d-11e5-424d-b0ef-24993af79915", "sighting--6a607cf1-ed7f-4edf-b2b2-000069575951", "sighting--c185b7cd-e5d2-4a42-9b75-af2fbc68d21c", "sighting--45bb68b2-6be5-4899-b90f-204188288d51", "sighting--68fb521d-d3a3-49da-842c-fd2dcfcf23ea", "sighting--b3173b1e-6e53-4b31-8f1c-d2330fd0496e", "sighting--4f67ce9c-c90e-455e-b729-c9392572dfd4", "sighting--590b3872-411a-4b34-8a87-cf77e2109a61", "sighting--f9d134b0-eddc-412c-9e3a-6e9c8f260012", "sighting--67dd9cd4-b63a-418a-8743-eb0943917135", "sighting--9dc1e5a0-b916-4f24-b8e4-5099213ecc37", "sighting--55d5fa39-8a5b-4975-a4be-cc51511dacd8", "sighting--2d9cb0cb-4152-473d-8815-9e4a34130179", "sighting--44cb59d1-1e69-480f-8436-895ea9bb73f0", "sighting--37081da3-abf3-4c25-b0e0-26927b4f3c7b", "sighting--01ba83c5-3e4d-454f-9c48-92c10c6f28f0", "sighting--00ee6786-8d2e-4edf-9bf4-dbe6e5fc26d4", "sighting--a8087d08-d98a-4506-a938-4799161fb9b5", "sighting--1813f9c0-abdb-4c26-b31c-b333875cff83", "sighting--1d3e0645-7227-402a-9edc-068c6eb83a33", "sighting--859ba1aa-35e3-465a-9007-6d4680541fc8", "sighting--72400736-0040-4bc4-b502-5f7d4893e645", "sighting--869c45fa-dd49-41fe-bafe-4a23d6e20245", "sighting--5575df0a-c506-4dc4-9bec-8e4d7714309b", "sighting--8012cfb6-2c03-4919-ac93-850491762949", "sighting--58d5c769-fdfe-40c3-ab9d-a8aad58d2290", "sighting--8900e1d6-f1aa-43fc-a5c3-696738223f8c", "sighting--16e22763-88a0-4c61-8acb-10d1ca8c6525", "sighting--11809084-c0d7-4bdc-906b-3ed83d408ece", "sighting--5bf2780a-bf8b-41dc-b124-d3163985a75a", "sighting--bcb656c4-0061-42a3-b66f-6c66f868ca0a", "sighting--db96b768-c37f-42fe-8745-3b17f40edc4f", "sighting--44fb0673-0681-40cf-b2f5-d64ff4cc3c07", "sighting--499009a7-1f28-4534-8da0-3383fe4d3e94", "sighting--6e7b7181-195b-4874-a140-1cce48f2ea36", "sighting--b636a87f-8bf5-42dd-a34e-9c9e9d6ffd33", "sighting--67714a64-deed-4a33-b71c-4f5057e90b43", "sighting--9047690d-2e14-40a1-836f-9dc156c932fa", "sighting--c7ef6ff3-554e-4bc7-9773-799d9ce8b5de", "sighting--7513ca36-c8aa-46bc-aca0-ec7bffeb5859", "sighting--f76761a1-a957-4c68-8efd-5006e0990997", "sighting--28144ce1-c08b-4241-ac2c-d2afb485793d", "sighting--0b6ca546-de8d-4ef4-a7f6-8a93eaa4d397", "sighting--fdedf32c-9847-4486-b18c-d8016c0c13c0", "sighting--6b1d9df8-2744-4217-b5cf-a3b75b7cc8f2", "sighting--32cf94ff-73a5-4628-9eaa-d4c8ce14f175", "sighting--c0ca2bd3-7ae5-49f0-9d30-6ffff521b1b3", "sighting--33e7316d-c671-42eb-8402-6d44f4fafe9b", "sighting--4f1d8057-f354-4186-955d-1fc08d38b89a", "sighting--d9954866-499b-4cec-af8d-441116c3eb44", "sighting--fe3253d8-3e75-48bd-a353-ef6699435b25", "sighting--9bb6e328-300a-4a3a-8d3b-3c3946b3d9c3", "sighting--73840769-cb23-4fa3-af0e-e288c88ec31c", "sighting--d5a2e943-8fa9-4fa7-86f5-d9fc05c2b0d8", "sighting--69907da0-9306-4e0d-bda3-651ad542882f", "sighting--7611a547-8ade-42a9-922f-c06507f3fe79", "sighting--6aaa5d88-521b-4ea9-831b-3812efe504ff", "sighting--414597a8-f7cc-4033-a29d-091cec173dbe", "sighting--55f6040d-00ca-4ff5-ad0d-fc1c3486f001", "sighting--cc590174-4a64-49f0-8288-419407658ec4", "sighting--163d0886-098a-4817-8866-745450ab2a0a", "sighting--55379595-206c-4997-b7ac-cc35f77af8c6", "sighting--09119df3-f170-44fd-876e-f6e6c098184c", "sighting--5083a2bf-e08b-4c71-8b5a-bad2f72d560e", "sighting--7ad9208c-4640-4c19-bdb0-d2dc80c2a965", "sighting--8699b95e-325a-420e-a8f6-8fd8b5139bf2", "sighting--f2eec2d5-d010-485d-92a5-889de81646f4", "sighting--95bd10f5-6e72-4fd7-b580-68546e4f3bed", "sighting--4e21c2f3-355d-45c5-bff7-b63ba8865496", "sighting--208c3531-7d7a-4683-a8ed-6dd198ad608a", "sighting--f1c7afb3-220c-4a17-b65d-c6d9c945757b", "sighting--3992ae4a-d527-4670-828f-0a1e34e6b451", "sighting--a378c8e6-926c-4ad0-9a4d-8dac05b41e07", "sighting--263c1bec-7c01-4b77-9679-e05de1550a42", "sighting--25440575-0107-45b5-b51d-b5e6062166b8", "sighting--d177fc61-5827-4732-8f10-0d397bb634f9", "sighting--fca43b9d-1e24-4228-a440-2bdf966530e9", "sighting--9583640a-ffd7-41bf-a565-cf2b6867038c", "sighting--0bb679d7-3709-4526-995a-a2b6c7ed54db", "sighting--61383ebc-829f-4dc1-9943-142fa5f74944", "sighting--0eeb6327-e750-4094-a33a-c3fc460be002", "sighting--b3e27352-ba12-43bc-b97c-a124bd48ce4c", "sighting--1cc56aff-6680-469d-8892-6c1ae007bf65", "sighting--1fa6e814-a83f-4f3f-ace8-0c7bbb1ad675", "sighting--3f7013fe-188e-4af7-a692-b26b70be4913", "sighting--7d3cc8b4-59fc-4213-9970-ba68ffc967ca", "sighting--617b1f67-9365-4ad8-80c5-251670bcce2c", "sighting--da79b0aa-c98b-4a3c-bb90-cb059b70c554", "sighting--0358ca45-880f-40c6-842f-1b13d9a513f4", "sighting--b31ffd78-62ec-4cc8-afa1-184a448e7c74", "sighting--86e8e0e9-29a7-4b8c-85de-068f2002e0fc", "sighting--ab7c131e-6cb1-42be-85a8-74b34d3bd1c1", "sighting--495b2bcf-81bf-4ef6-ad02-9afcd6d250f8", "sighting--eafdc7a7-f286-4bc2-8f0e-de8ed3b4e9c5", "sighting--ff020084-77d0-42a4-bd5b-5dcf6d4154e9", "sighting--f2d49877-450c-4329-90ba-80288b067850", "sighting--83ed603e-a457-4bec-bcfa-ea6e71a34790", "sighting--883a7141-cdba-4a10-8c84-c267ce1b7e53", "sighting--56364347-eacc-48c0-bac1-f70b0c4af1de", "sighting--6435f14e-0e4d-4fd0-b633-1ba421e1dac7", "sighting--868aa06a-ab6b-42ea-8577-46e30e765c7a", "sighting--b8f086cb-2d58-40b9-8a52-0eb1e7d22f05", "sighting--d563de09-248b-4239-9a34-36fe3a0fa6f2", "sighting--6e816fc4-1cc1-45ee-b933-3fff4174c976", "sighting--f10a22a1-cf1e-4560-ad22-58ead0db0151", "sighting--83b504e9-b611-493b-a401-97eb486a5559", "sighting--14837865-d635-4dbc-bc41-375d1e69afac", "sighting--46945ad7-a049-46a8-9685-82fe6f5a2663", "sighting--9e18a8bc-9912-4f52-b705-f1e53cb6b4e5", "sighting--b0fb0d0e-0bff-46b6-9239-c9010f54469a", "sighting--732adb12-b4cb-4f7c-b01d-ff28042f46ff", "sighting--5195a184-b638-46c8-813f-9bc7c8e5adee", "sighting--e202ded9-06b9-4480-97a9-032f1991ef2d", "sighting--9979ead4-c430-4f71-a5cd-b3aa4ee26cbe", "sighting--740ce87a-3c79-4a87-a40a-cb2c39bb95ba", "sighting--3e7ae6a4-749a-4991-a14c-8f956ee2dbcb", "sighting--ce4a5868-83db-49fd-a52b-aad81a982d0e", "sighting--345b3a1e-92df-4a7a-a3bc-d9a12fbb1b9c", "sighting--5ad49c75-972a-432d-949f-8a5d60c7bc8d", "sighting--3272dd7d-a6dd-4fff-9262-7c7c5ad38c65", "sighting--da4b58f1-6bb2-4e5a-af67-4767c0fcf22a", "sighting--5f9b9c99-ee7d-46f8-848a-36af5e1054c3", "sighting--1a1d736f-3aa8-4ba1-9459-03454253a827", "sighting--5bfcc0e4-046d-42b1-9bad-358852e21a5e", "sighting--d2c27f2c-c1e4-413b-a507-452ce0955179", "sighting--2c46de82-22b8-47a1-b3a4-b9f383c93882", "sighting--493990e1-be9c-4ae9-9442-b73b107b3d49", "sighting--816a9b0c-8b75-4710-b46b-f1acff2ecc36", "sighting--d362897c-705c-4573-86c6-24c9b8e13cff", "sighting--cc5e7f76-3097-4514-886e-1d1277fc5bc3", "sighting--48e1c7fb-c654-4539-893d-06b3d8432cc4", "sighting--0290ef47-d66d-46b4-8375-8fedd9396932", "sighting--d5d0c193-e98d-4eed-8c79-5dcf0f6cad00", "sighting--b24db9a9-72f8-4e4f-9ebd-c54ea3a78067", "sighting--aedc81ed-c718-4c3c-b560-4751b3326629", "sighting--d77cf20c-0c25-4c2d-87f7-cefc75ae4d0f", "sighting--4eeedd30-6681-49c0-8c59-c16ad12b306a", "sighting--7fd6a233-7580-4a04-8c95-194faeb1e197", "sighting--3d9aaa16-3f67-4c58-9327-ec17736935fb", "sighting--4e8fae51-6068-49ef-b45e-61e377af2fb4", "sighting--df8e5e34-ba37-46de-a77d-4c869957f5c1", "sighting--fe0737e8-5df6-4c7a-98f0-3bfd96193b11", "sighting--e08b215d-d63d-435a-8921-cc641812a709", "sighting--1f77cb30-2eff-4f66-b83f-906b057a3f3b", "sighting--c15a04d6-034d-4262-aebb-41c7913554a2", "sighting--5e4d06af-e83d-4d1e-ad31-43e45429a0e7", "sighting--1c020511-604b-44f7-90d5-c5aa631157c0", "sighting--486699ed-ea95-4b15-b84e-19b649807b72", "sighting--ff999fd2-b61a-45c9-9069-7ac8ac32c1d9", "sighting--ccd624d1-6d80-487b-aa28-a635ed901c5f", "sighting--4b69d58f-4001-43f0-98f7-8cd818ddb516", "sighting--f66bb100-6725-474d-adcb-207c0593a097", "sighting--a1015cc1-dbc9-46a0-8317-083e78e493a7", "sighting--26309b2d-bfb4-4e49-8624-57682e3f0b4e", "sighting--20d1d433-66bb-475d-900b-6e43b04d6988", "sighting--fe60c20b-a8cf-4b1b-935b-266cfac755e5", "sighting--f5329dd1-98e8-424f-9f21-fc28db80cdf9", "sighting--bf98c9de-11c3-4f4b-a242-e4fe50646a4d", "sighting--0dc4c48a-1167-4fcc-968c-120d0f158201", "sighting--aa922a1b-e1b2-4517-b63f-d78e647e24b8", "sighting--855cad2e-94f6-4262-9c21-a3d2465dff22", "sighting--a4857eed-3cf7-4c8f-87b7-f0bb8e6361d5", "sighting--cd37923d-8e86-42ae-a21b-255b53ac62ef", "sighting--e92de2d2-85df-4883-9ecb-855a564252f6", "sighting--9a2cbf72-bc60-4c46-9d61-c79543c36431", "sighting--596e9829-4e6c-41f7-93a8-72815e8c2405", "sighting--09061334-9b2b-42c8-9f8f-972f6002573b", "sighting--e2668e41-8955-41c5-8fb6-908687f5c153", "sighting--4ba174cd-0768-4cf2-9d22-714a835f929a", "sighting--ff774795-b043-40ba-86c9-54904f7bece2", "sighting--72612e96-62f1-45ad-b063-bcbe932561db", "sighting--18d19d26-e476-42e7-9fda-d3d3f402329b", "sighting--68135280-fae0-4c7f-bc1b-a47cfebeb86b", "sighting--a31f1f8b-390f-4503-bfc8-931f7d2fce1a", "sighting--17388cd4-4530-4d41-ba55-aa97e55c2f10", "sighting--95d855cd-8c21-48a2-95dc-727ea1e307ec", "sighting--b7cf51e8-c8a6-46fb-b60e-61d3373638c8", "sighting--cce8be78-c88a-448d-a5c2-518ccdeb8b37", "sighting--ab71551a-0b92-4fa4-a540-031311de6d8e", "sighting--dafc3dd1-529e-4f4a-a219-0de1c3d4b5d6", "sighting--bf53b333-b179-41ef-a86a-877480000d51", "sighting--f37f7a00-4f16-43be-b50c-98de66ad0d82", "sighting--7873a66d-7b17-42cf-92be-1f0426155e91", "sighting--bbfadfb1-1ce3-4d2b-894c-783cac52eceb", "sighting--696c989b-e784-4f65-aa23-059e7b0959d9", "sighting--b51e63e9-d6b5-4811-b5f8-a811c07e114f", "sighting--d814c60d-c0a3-4bd0-aa1e-07b8da795f05", "sighting--23079ac7-dac7-45b0-a204-2769fb88e2f4", "sighting--8483dbec-5ec6-4d17-bae3-e402b04e6de1", "sighting--09d17810-6a29-4dd1-a197-0ad4165606fa", "sighting--a451fd0a-2f3a-4888-84d3-832383ab9a21", "sighting--8b2bd95d-55ee-467c-852a-55ca303bdad0", "sighting--5f97affe-3220-4628-953e-8bf69b78121d", "sighting--ec924cad-5588-4d30-92c9-3aed01da011e", "sighting--e91e9798-6867-4c9f-bac5-0bcdb9c14927", "sighting--e34a69f7-ce45-4775-a4f5-767b4fa2fcac", "sighting--f10d4300-a443-4559-8740-c8d3df2bc70b", "sighting--50d09c1a-91ec-4e45-91cd-77d65449f466", "sighting--ad18f982-e6d6-4ce7-ab40-f3aa941ebe75", "sighting--f6e727f5-d8b8-4d0c-8d5c-bd187b004b61", "sighting--f10010eb-f558-470b-b9ca-77fc6e5f4009", "sighting--572c950a-8549-4793-84e6-be2c3c833497", "sighting--11b8486c-4252-488f-8afb-19853faec817", "sighting--e3d44ec5-204f-4f8c-b9f0-099e5bc7495a", "sighting--63d642f5-d3bd-4d4d-9446-ecf0957e8eb8", "sighting--e7dc1d95-2eaf-4cc0-ba33-f18fd2757dd1", "sighting--bd666c83-222a-42d7-a575-4464dbcc512b", "sighting--276e99e4-7596-4773-897b-369e05d8032b", "sighting--badd50c3-f0f0-4ef0-9bff-e095f849dd49", "sighting--ab02b1c0-aa34-46a9-99ed-03e559ec8d72", "sighting--9da422dd-1115-4244-b4f0-e22e06a93c3c", "sighting--6ce4a1bd-df99-40ce-a711-a0e9a34112b5", "sighting--ff610fa1-dc95-49bc-9e7c-c5ce0fa26786", "sighting--6bf20207-f8c5-4983-9bef-80be66d98f34", "sighting--85031ae5-7828-4944-bc57-2962194577b5", "sighting--0fc4c9b4-db85-4f57-9cb4-57c7737df46a", "sighting--b4582370-a7c8-462c-8217-073ac039d11f", "sighting--a8072f75-d2e8-4a5e-b8a7-fc8896a9bb22", "sighting--6bfe9409-3cdc-482f-b999-a6cf8d91ad1e", "sighting--796cd14f-fbc5-4f1e-9923-d20fa86bc250", "sighting--339d54c4-b960-4b51-9654-561f82598734", "sighting--6f45cdf7-3fa3-4b0d-b047-0a7078f76dc3", "sighting--898afb3d-d155-47f7-b5b5-c915eb23c5e2", "sighting--31fc783c-bc32-4826-88c0-9cf043ba9467", "sighting--b1810237-b24a-49d9-8bed-15a161daac60", "sighting--2501762b-57c3-46b1-8766-056015f74101", "sighting--d52627c5-f43e-4389-a916-8a187e0fdd4e", "sighting--0ae25ca7-6194-4079-8d7f-187ceedc51db", "sighting--cbb5bf21-93ca-4517-84c6-87132950a2a7", "sighting--553b4b68-6f5b-4293-a376-5beb6ca745f9", "sighting--60930b83-5b24-40f8-9f27-cd1479ab291e", "sighting--6cc8d368-4ebe-4070-929a-de242682c6df", "sighting--a75a739a-1e1f-4a1c-b656-f66c3456d2b4", "sighting--4a2067bb-b363-4a69-a714-7cd959318419", "sighting--cecf724e-d181-4068-a0b8-8ec951e15c5e", "sighting--2b4a6128-7a2e-442f-820d-5c647ccb6a33", "sighting--75a18443-f1fa-4e8e-98e3-08e337a5cfe0", "sighting--86731155-f22a-4f9d-b49d-306c3f53d9ed", "sighting--52740033-ec91-4a25-80d6-efe98a5f063c", "sighting--b8ff48cc-f276-4451-8639-275d9c747a43", "sighting--24670cf0-4242-4a70-906b-01733e28c385", "sighting--c6c9c48b-5c47-4738-8917-9e5489fd3156", "sighting--ea902252-ddd6-46cd-99d0-48c379d255e1", "sighting--2e18180b-4e80-4484-8ed2-51f6738fddb9", "sighting--67b9c417-90f4-4ee1-9b00-35dacada36cc", "sighting--a5f7bde3-9ec3-4bad-82b4-165eb1e24e9a", "sighting--a8cc776a-12f1-42b7-8869-e4f03cbd78a3", "sighting--e36ab657-fd5d-4ca7-b5e4-cd82e62e8787", "sighting--960c51b1-9dbd-4f5e-97c8-46033612e0f9", "sighting--bc7595eb-4560-4fa1-9d56-c29010506d81", "sighting--4f7c8449-bf86-45fb-a002-93fc5c2cfb0d", "sighting--69e8e66a-91af-4e2e-bd30-04077d03c507", "sighting--0dd5a828-44e3-49fe-a616-06feb9007d34", "sighting--1016c2bf-e259-44e3-b9b7-22c9dd4f702c", "sighting--bb40fb07-cb6e-4fcd-972d-8e60941894ea", "sighting--d5dcad1c-75d7-4905-9ac4-793c327b7690", "sighting--84bd5bf9-142c-446c-98be-a6a2f1b27f3c", "sighting--fcf6e6f6-8127-4e9b-96c6-94edf227906b", "sighting--fb708c78-ab3c-4bb1-bed9-9e3342f9a4b9", "sighting--56c91213-5121-405c-92ae-c51bab0f0ee1", "sighting--d8202ba4-d5b2-49e5-8429-318831319a98", "sighting--89a78c49-28f5-4861-9993-56824efbceba", "sighting--db3296c3-6388-4bec-8207-aa8975323700", "sighting--a3415dd1-e861-477d-bd53-c5ddcd67027d", "sighting--d931a93b-a92f-40e0-88fa-45ee93d003f4", "sighting--20e0c1de-539f-433e-ac0d-1a9e044c5b7b", "sighting--2bdbd897-5085-4caa-a1bc-48497d713e38", "sighting--5d7b9da0-a73b-4f39-b943-08562cef2e86", "sighting--2e820b52-6568-4af8-ad87-b2b78139b550", "sighting--781db6f1-8024-4994-b6e6-343e7be841c3", "sighting--458f84c4-db6c-49c6-8dee-b87250c790da", "sighting--ef2c2295-6c35-4743-badc-8f9f518bb55f", "sighting--32531944-f449-412a-a4a7-8c3df81a3a8c", "sighting--963569a9-806c-4c64-a814-2b5acbb6e62d", "sighting--48e1cdb4-c24e-4b48-85c9-74e957348673", "sighting--ed8e80a8-82b7-4947-b8dd-8b5607f160c7", "sighting--e82baaa7-81b6-4f0b-b640-c2775bf83171", "sighting--8ac2ade2-8345-45c3-93a2-8e1f02af4b6f", "sighting--77355122-b944-4e49-a3f3-d1a31b5bff17", "sighting--f7bccaae-b0dd-411e-9613-fca07bb247a0", "sighting--c0fdc140-0b7c-43e6-888c-6ff26170fd20", "sighting--b87db70f-bdb2-40cf-a0a4-1632b6b4bbc9", "sighting--2c615079-8228-494b-b7e4-bf3e262aef15", "sighting--f630a186-4132-4111-8671-9fd262614445", "sighting--2732a6d9-3407-4b54-a0c9-18e3fc0d8b4a", "sighting--937c62bb-ced1-4b94-bb04-f19daae25ae9", "sighting--7880831c-0c30-47fe-aee2-b8b85aa988b3", "sighting--f49267ac-3ea8-4394-8452-306e9bef959b", "sighting--7e799a53-bf40-486d-9d69-d589f2a4f8a7", "sighting--5ebbe386-a9d2-46db-b276-c25d4c7255b2", "sighting--a0d0b1d7-4d99-43c2-b195-e021c12d5bdf", "sighting--5830b35c-3459-41bc-a916-f571c04e7cc6", "sighting--3d888c1a-7abf-4015-b7b5-1cd9b808471a", "sighting--e2237ce1-1821-4e19-8108-998ba60ab762", "sighting--b7e4b1c8-795b-43b6-a6c7-fe5eb7981119", "sighting--0547028d-a21b-4dd8-80d8-64eb5c80bea5", "sighting--925f3625-c7ab-46fb-9ff5-338e60eadd0e", "sighting--bf5c59b5-1074-4453-a0c5-c7d7e56f7c6b", "sighting--76c275e5-909a-4be5-9227-6f6e5202cbef", "sighting--16c94883-0205-4f09-acc7-bf55d51d06d9", "sighting--76c54476-ccd4-41fb-8eb6-6077b6dcad88", "sighting--6a3d9e34-410d-4414-af22-227c8b91a1b0", "sighting--a6bad9e0-e345-4a5f-acee-0c35821119c0", "sighting--96fbb2d1-2b8f-4314-acb4-721693bf0a90", "sighting--7301152b-d8c6-4c68-bf61-f7ade464dcb4", "sighting--b71cac2c-cbe1-4b27-afd8-8ef9fffe86e5", "sighting--03482de2-1f73-4b6c-958c-cdd66ff3278b", "sighting--e92cb535-c833-4b6d-8975-6202ae4a922b", "sighting--3f7d381b-a9ea-474c-b258-f11c3a1edc48", "sighting--bbfdad81-29ee-4f0b-9e87-1802860709b3", "sighting--63e3bcc6-b7f0-46a9-8b64-24974a05eecf", "sighting--16974f66-bf4d-4117-b28e-6d9367cd0760", "sighting--0167a6c3-05a6-488d-b302-80ac983172a8", "sighting--e9248ae0-5663-4cc9-a25e-f5fd4ff7766e", "sighting--afbfe0a0-d64b-41ab-967b-6e3501604179", "sighting--f7dacd53-f647-4480-ae7b-d8e36143b2f0", "sighting--bbac9ea3-faad-49c6-b88a-2d7a0e11df41", "sighting--a9ab673f-d6d2-44ff-b126-e5c4ea602e3b", "sighting--e1761fe0-c13b-4c8a-8253-66645522dfc0", "sighting--86707eaf-ff8f-4e1a-8424-f70f47f6d1bf", "sighting--b5a91e1d-312f-48a5-b1ee-8f9aaba0ee18", "sighting--64364c21-2bf8-434c-be0c-1b11864cd7d6", "sighting--fe83677f-a07f-4c13-b482-d6af5f20b6fa", "sighting--ae179446-ad9b-40b6-a026-8338bd50e43a", "sighting--0a89f048-a83a-49c2-90fa-74a8d03aa72c", "sighting--26953fab-fa61-4313-8951-18950745492d", "sighting--8aecc834-8fde-4262-95cc-cec00bbf2c0a", "sighting--8e8c78e4-8b56-4b68-b3bc-1f4870ca689c", "sighting--f0b315e0-755d-41af-ae11-b0dd92e53951", "sighting--f2550e99-97d8-404b-946e-ee8f1e83befc", "sighting--c518919f-b670-4206-bfb7-a79ac2f646b5", "sighting--b983ca33-e6b8-4e24-94d3-d5bff3ddbaf4", "sighting--6416722a-35b2-4af6-8851-018abfc27760", "sighting--5e2a3cec-2d30-4f8b-a733-75f3e34e3c21", "sighting--d4e41de0-5294-46a1-bdc5-955549ae8136", "sighting--7f6160c6-a800-4d8a-9421-a4f2242a645f", "sighting--faa6f49d-f06d-48c2-8095-e51b2db1416f", "sighting--cb8d948f-b222-40b7-9a29-b18a73cccfc0", "sighting--9f35da00-cf7a-4092-b9ea-4e7193d69965", "sighting--80789dca-c74f-4ef1-8582-047054d778d0", "sighting--9cb1c16d-d681-4f43-94f4-7692c2c9b3a0", "sighting--9edb3791-c605-46ea-94fe-892ad06ec3e6", "sighting--acbdf23f-a312-4b4e-9ccc-3d76106ece68", "sighting--835e3606-6056-4db3-8eb1-9d616f4d7dbb", "sighting--cbaf0dbc-fb53-4fb9-b93c-ff82505426f8", "sighting--04e53ecb-d3ef-400f-a108-017fbc617c62", "sighting--9de00012-15d8-4c17-a37a-6729c2d8b188", "sighting--3b04f915-ada2-4f97-9587-2d06efab43d3", "sighting--2932e24d-4b1f-47d5-acef-fafa58f37dbe", "sighting--36aa9980-1e4f-4b59-91e9-64784230b6d0", "sighting--a91cd161-89fa-4842-8e32-844084e2f75c", "sighting--55f3da0c-4b40-4e6f-b939-425da34cc190", "sighting--a6112202-24ad-45c2-ba8d-4138dab55e66", "sighting--871fe12d-d361-4356-9af0-df3715384a43", "sighting--59c4083c-fbb3-4e2a-91df-2c9b3bca3f47", "sighting--99415410-3f01-4d2f-8f20-a806899f446a", "sighting--da4504e8-9fe2-463a-96f5-dfc5b15a4027", "sighting--aea94b49-5783-4a6d-bbf8-357b2c0969eb", "sighting--cdfff971-3255-464c-a68a-43e09ed17df5", "sighting--d2990ffa-d228-4309-9f4f-a1f860809f7c", "sighting--04eb88dd-c3b3-4cd1-a06a-17c8b9e320b7", "sighting--65f33df8-f740-4d1b-bb80-aee28e33fbfd", "sighting--85595705-a681-41e1-89b5-20fba1a61829", "sighting--8bce652a-0d95-4385-8ac1-4ef0f244d66f", "sighting--91936163-ff8d-4027-a1a7-402dc452d504", "sighting--4c509474-438f-4dc0-b855-a21d0277ed9b", "sighting--7e3d63bd-1333-4816-8dff-b3074736481c", "sighting--26ffed99-7450-409d-80a5-fd5f4904d727", "sighting--da38b959-894e-4c18-ab6d-02782ab06e2e", "sighting--766471db-6dad-4591-a98b-80e90a133583", "sighting--ac4e6692-a59b-4105-bb60-e17ad8e782f2", "sighting--4c1c6a25-e0f6-47f7-ad99-1fb4b637c889", "sighting--43ea5c5f-fa7b-491c-886a-505698bbd7fa", "sighting--b4f35b13-1dcf-4167-8840-d36d743005c8", "sighting--0923fc49-a34b-4b2c-b8d2-a6db6a2f1362", "sighting--96b5659f-0fb8-4077-ba5b-6c7f47ceb144", "sighting--ff84fdbc-1c6c-42e3-8fed-4fc1dc8f62ca", "sighting--2b1c9cf8-58a6-4bb5-a5f8-0a56ed78d34e", "sighting--69855b28-d467-4b13-99d5-1c9bf49dff85", "sighting--755b804b-b613-4eee-89ef-f2b1a2f91804", "sighting--35717180-d509-49ea-85a6-6d456d3e0576", "sighting--24412895-1376-4ddf-ae54-496cb99081c2", "sighting--f3d69d68-a09b-4ae3-9fb3-bac8ef085a41", "sighting--50eb84de-1a50-4c58-8a2e-db9cf0c7638c", "sighting--c21aedf7-5a0a-411b-8feb-33de2a675876", "sighting--d8dbee52-16fb-4e8c-96a0-6938c5f088cf", "sighting--21bc891b-dfcf-493c-8dc1-81b2f5f373ad", "sighting--3f93210c-4131-420c-a6a6-4cef1b110d59", "sighting--94ca1879-6f58-46fb-88bf-40fafac527a0", "sighting--2ce1b716-704e-4e56-93c5-343e51b3b875", "sighting--bc55c37a-7a45-48d7-9f2e-f51fd8c97377", "sighting--fecb6bda-34b8-4be8-be88-917d926a7b94", "sighting--3a5938e6-a498-4a90-a140-2af3c1ca540b", "sighting--68a72b87-a580-43a4-be42-b89d62471a42", "sighting--3031bf4e-6140-45c7-a03f-67f9ad4bef14", "sighting--6a9f4de7-38a2-46b8-80ba-ab81f82dfb01", "sighting--efdc66db-aeb0-48e7-adea-d144171e1f03", "sighting--18b8f717-148d-476e-af39-1dc274a1011d", "sighting--48f58ca6-b51c-4e38-861c-347ef3c70ec1", "sighting--0bb190cc-c40f-4bc7-9c4b-5964e26b0c61", "sighting--c13e10ba-17ab-4cff-8804-8db318d3d530", "sighting--4cb48739-68d9-41e4-a2bd-9f13156174e0", "sighting--021a431d-6628-43e9-93da-bbbf14b1d9a7", "sighting--5e695796-f67e-4bfa-95ed-f3b58194859d", "sighting--732bb130-0117-4cde-bfaf-9db008246e20", "sighting--3a489c82-000d-48e9-bf99-beb0ff6f6124", "sighting--d5e4d5bc-b8ab-4b0b-b200-790a042988ef", "sighting--55ac2236-5c79-4669-86c8-7340bcc9308c", "sighting--c51b519f-ff01-4c9a-8bcc-3d2c0b228042", "sighting--441dc8ed-2932-416a-a1eb-035a60c529f0", "sighting--1edbb8f4-d99a-4d2a-88a8-f9d90886b29e", "sighting--1afda726-4aeb-4ca8-aaaf-11aac0ceed76", "sighting--eddbe356-82d8-46af-a30c-724f4991b7de", "sighting--1aa4b7d9-a287-4421-8949-2633997beeb3", "sighting--22fc43fd-5446-46ea-a109-9d9591db74c7", "sighting--852b0a30-4693-41a6-a99f-1d96de8cec71", "sighting--4248a080-bd38-4d24-8ebe-b3a7684d3882", "sighting--70cc82e9-94de-4ba3-b847-a9eab10b8975", "sighting--d2d4246d-401d-4c89-b1ab-277477dcb3b6", "sighting--c852c194-1818-400a-af3f-ddc5fcfcdbdd", "sighting--7799f47a-43b1-4e1a-9a86-3e5242b09d32", "sighting--131670b1-07d7-41ad-8d0f-a47eb0426fb5", "sighting--023ea8c5-5a6e-49cc-a5ed-736c9f7bb0d9", "sighting--82e5249a-28c2-4089-9481-0242e406eff6", "sighting--80d07a98-12bc-452c-ad75-b0dbd6bb22e5", "sighting--7cbfcc27-d9f0-4647-8760-4b3696726da9", "sighting--da54c09a-3f81-48b7-acb3-cc2e27142642", "sighting--b853bdb9-7ece-42cf-a32e-bf3d5e925ed5", "sighting--19f349bb-d391-4456-bc07-1666004e6af2", "sighting--93cea6be-b36f-449a-973f-00407e57a26a", "sighting--e1702a87-e1bb-4f8e-8805-68192fecc487", "sighting--4dfe614c-35c9-4723-a430-159d710d05ff", "sighting--d547f800-4641-40d9-8c98-f9ca0c911e08", "sighting--4706bf01-f0a3-4a68-81c3-518c1398c62d", "sighting--d5cd3a57-9cd7-4523-a6d1-6af4d8cedccf", "sighting--465aa431-ec44-42d0-af22-9f5d505f159a", "sighting--e72e00a5-ed2f-462d-b629-5d2ba0de32ad", "sighting--b0c2202c-7b31-4de3-8e84-def5e3e8820f", "sighting--94a04145-b499-40af-8a85-a5747123ce69", "sighting--5a2eeda2-5c77-439d-bd8a-6b94bfe0580a", "sighting--05b000c5-2428-4386-995a-3ef922e5aeda", "sighting--b52975d4-854d-4090-9b03-0deb97ddcaed", "sighting--884c4472-275a-42a9-a508-d985c6b98067", "sighting--ef691f7e-76c8-4d3e-b19e-0bf9acc6dae0", "sighting--cdca667a-ce9c-43d8-92d2-e1d7a1ce0c7f", "sighting--091833ab-6d65-4313-95fe-d0ec44c527ff", "sighting--87033f4c-5a3f-498e-ad92-cccaacfe46ee", "sighting--cfef5b40-62b4-485c-95c1-5548aca9eeb5", "sighting--eb28bdd0-8647-4294-bf43-b9082a31a049", "sighting--2272b399-7327-45f7-91d9-962b52ee7a95", "sighting--62238ed9-6cf1-40e4-80d4-1e72314fff88", "sighting--aee9bdac-e487-498c-a1dd-996b3bb7b59b", "sighting--782a3f8e-8fbd-477c-8a6b-49f5290cc156", "sighting--a5b056a4-a06e-4054-90fc-7d92ebde34d4", "sighting--f6f69aa4-b153-454a-a505-ea5e138870e2", "sighting--c29347e7-6cfb-4120-87f9-f7212cd4af62", "sighting--39938893-9df4-4aee-a828-5a6eeca2371b", "sighting--80abbaf9-d8da-4731-ad2b-9a784c8093bd", "sighting--40bc9aa0-9a3e-445b-a9a5-d38498d16d88", "sighting--6147b734-36f1-4854-943e-ddbe487c9fe7", "sighting--cba761bd-4c5f-473f-a4a5-456d38decd33", "sighting--63c0dc6f-9287-4507-901b-f73e77d56e8a", "sighting--9f16ab3e-3fd4-4faf-b29a-b11c313ae328", "sighting--4deca649-f578-49c0-8606-b0733852eea9", "sighting--e9b7021a-97a9-42a9-9f01-7ab8f366d2e2", "sighting--e1bc3c75-1379-4224-955e-5b0698c7f085", "sighting--8497fce7-3141-4f2f-b221-99eed647be1e", "sighting--2a672b59-fc0b-4eb8-a2d5-459c8d587dc4", "sighting--f2c28cd1-486e-4c02-9a6a-ce58a392c98e", "sighting--0a07eeda-9550-456a-b894-a991c1d4787e", "sighting--00c7b34c-24ca-4bd1-94be-b12d4ef05712", "sighting--995c88b5-18c5-4425-87e2-5f004bced005", "sighting--f37d430c-ab13-4fef-aa69-85261de5e09e", "sighting--6ac75d24-7de4-4403-b5c9-eca5f60b9cce", "sighting--c8b4bfdf-b4ca-41a7-a6fe-afda84668be8", "sighting--dbc59f74-e37b-47d5-a592-a6bd7e3a55e9", "sighting--10e8d73a-4508-45c2-b7ef-75c99b3dd2c8", "sighting--2771a751-855d-4359-a80e-b235cc3c9ba5", "sighting--b9f6e434-cfda-4825-b95c-8ca14e734ec7", "sighting--733c05f1-3c81-4c1b-b820-49eb87c099d0", "sighting--a230bdf1-95e9-45d2-986b-c7b3a00a8ebf", "sighting--0a9b0159-8238-4b24-a2c5-9470edf81333", "sighting--bf2070d3-3422-424c-9f14-c1babb950409", "sighting--df010d5d-0219-4919-a5df-0f21f20c1d51", "sighting--aaa50306-c35f-4f93-af76-80023212c745", "sighting--ebc58f81-3e0b-4cf3-8595-c5c11a1c4039", "sighting--c750e97d-8446-4410-b54e-c816afa546dc", "sighting--e8e69fa8-cf02-44e9-a597-60ddc2b2a33e", "sighting--778f0b04-b555-4bd5-9b88-9097700ff943", "sighting--0a024d9e-9c8c-42a6-bf27-56b5821499f8", "sighting--7f17874e-7563-48bb-aad3-bab361126400", "sighting--1f1cdc77-a4ee-4210-ab46-407a0068de70", "sighting--c08215ae-6f94-4c74-be82-8afe01d8a0aa", "sighting--49fcfffd-9527-40bf-827d-05fd15cb1633", "sighting--8ee0a952-cba7-4fa3-b378-460b462eaba3", "sighting--88dcb03f-6987-4b53-8266-e3fd584f2120", "sighting--78c0a30c-67c1-46da-9a72-e9e51189801b", "sighting--0eda42ba-044f-479f-a73f-75b46be94ade", "sighting--6b14fff1-d5fd-4cec-8205-67f1a7626650", "sighting--68114154-0635-4619-9cf4-cc27c52d990e", "sighting--0935edde-8fb7-4d12-972e-8f23a015b3f8", "sighting--57cbffa8-3056-4f4d-85e2-075f043eb127", "sighting--6f8561d9-b733-4b2a-b49a-1fb2ec14d694", "sighting--a4361892-87ec-4c10-8dad-ae302968d0f2", "sighting--01404e66-1b4c-4c02-a25c-41ad0bb3791b", "sighting--f399c31d-b0a1-4aed-97c5-89bd16bfeb93", "sighting--18b85056-18f2-4b1f-9ec7-7b30af6aa64b", "sighting--91fbfbb5-610d-4b3b-a3b4-642e8b82fc1a", "sighting--e3d517c3-0d89-471c-82cc-658ef74a8dc1", "sighting--6205567e-b6dc-4c2c-8b70-a129c888631a", "sighting--2fcbf3be-af79-43b1-be2f-d277a6bc41b3", "sighting--7edf40b3-a39e-4ac6-93d1-bcd5098b97c1", "sighting--8a84a80d-bac8-40ed-a32a-62a6865d1f76", "sighting--a3c247f6-7cbb-4003-855b-03118a8babaa", "sighting--6a923de6-9b85-4218-9c5d-ed304751b407", "sighting--57c14534-053f-40ea-adb3-63158147949e", "sighting--7b2b8a8a-3c43-4bf6-8c07-aea837279318", "sighting--8c7d6e11-bac7-434e-8a55-b3b2bf257b00", "sighting--27037978-df82-46e4-a9bc-75ed3c9b456b", "sighting--ad23d6bc-998b-40e1-bcd6-bf01b4e402a7", "sighting--c3eeb67f-f631-4a16-951a-6fea4653bd6b", "sighting--e4a96517-99cc-437a-aabe-e43a8c4865a3", "sighting--469c5212-ccaf-4daa-8d2c-21769ccb72f0", "sighting--c3d1c7ee-4c7d-4304-a13a-5d5bb2d0016f", "sighting--cd729254-a56f-46e5-95b4-832c48e86fd7", "sighting--85faf07c-3acc-4431-bd16-524650746ec2", "sighting--eb56b01b-3100-47f4-98a9-8f7db6ef8ad8", "sighting--2b8c43a9-b8f6-43aa-97f1-8dd181615261", "sighting--1a400409-c9e1-4746-866e-891f31fe3070", "sighting--c79ca7dd-599f-45b5-93c9-cb7914fbf874", "sighting--c472b716-5fa0-4e7c-870c-f1ee8af12a37", "sighting--38a0a23e-b88a-45f1-8745-0ee82bea2758", "sighting--fa180cd0-225b-4eb1-9078-51a2f0e1614e", "sighting--475e83c4-b13f-4e7f-bba6-e7006253c042", "sighting--73451523-a541-4ccc-af88-673adc8d17cd", "sighting--fb1617ee-7106-4013-a9af-da1adf3f16f4", "sighting--deb1eb3d-0a21-478c-8cdd-10702608a170", "sighting--db9cfe9a-683c-4a04-8c42-4b634db20d7b", "sighting--1add466e-4c0a-4075-8787-9fbeecc3377d", "sighting--3ebbb068-72eb-4855-b158-39f656e32e44", "sighting--ac40354b-1f3b-4ae7-bd90-eecab5cd0d9c", "sighting--b142972a-7114-4439-a665-c4b730a53591", "sighting--3a236aac-1e86-4e48-9b35-5ba13a98ec9d", "sighting--4fcc1f6e-c888-4460-b88d-9c4e18506a60", "sighting--e3b45215-b844-4ad8-bb70-f7f0b9b743c7", "sighting--5615c479-e7a9-4b75-8a5e-14f21233416e", "sighting--13c33c3b-f32b-479d-90d6-687479e6aeeb", "sighting--8a790aa9-6ba7-47ba-858b-0da538351043", "sighting--9990537b-67af-4a17-bebe-70c4feb37989", "sighting--05f50589-fe47-4cea-bf56-af6e86aae1ed", "sighting--54232187-a260-4e19-ac37-8e20502cd409", "sighting--773948d3-a01f-451f-8b92-d0ff824e4cee", "sighting--b6d3dd95-4f00-4fb3-9bc2-dcebfe7f34ce", "sighting--f6e0d1e2-91ab-4df6-8b23-49d57cebbdb5", "sighting--2aa7c962-ec9b-4cc0-b82a-6aeed4a84dfd", "sighting--7da59467-e209-470b-bc1d-17f3127b4f3b", "sighting--e13093ab-3dcc-4ba2-ad97-1d1c71858f7b", "sighting--0046b0b1-b3f4-4c06-9b04-a1b7fae53c89", "sighting--36e17880-eb2d-4367-8142-3b04ca186a6d", "sighting--c15f5a02-9d51-4bfd-9917-e3dc83fd9dc2", "sighting--6ff0ee15-2f0c-4247-a915-6c1586e743f5", "sighting--01d7308c-f186-41ab-ae3f-5fcf6980d4a9", "sighting--2969a4e1-d875-49e2-8cb6-295946c54fab", "sighting--86c39c30-47d3-4646-b890-762001a40f7a", "sighting--f3c6517d-02a8-4d92-9c29-e5f2ae39d922", "sighting--01f55f89-27cd-442f-9071-44e81641aa74", "sighting--94ec8d49-bc0d-40ed-aee6-483902f3f934", "sighting--7bdda454-9097-439d-a866-dee6ee7d75fb", "sighting--c185a1e2-2f11-429e-87d1-31ae4011a087", "sighting--55c0d206-1cbf-43ae-be99-52e027e87c73", "sighting--7e09b180-8a86-4799-83d7-37da5110e05f", "sighting--3556a457-39d4-4644-a08c-eba90825dd30", "sighting--dc8d015b-f428-4d8d-98e6-c430b43d301b", "sighting--7a2100e0-e293-4c84-b5bf-5744ac285565", "sighting--cd7c9208-96ab-440a-b95e-90cc1df7145c", "sighting--ab7c6762-468b-4c48-9010-da1e20fc872d", "sighting--fca6f21c-6adb-4429-a1c3-90efb47e4cba", "sighting--6f52cc8c-eda3-4347-aa42-f54847b0f5ec", "sighting--a6853f41-36fd-45ce-97b2-4cd74e21a904", "sighting--d0572350-8c94-46a6-aea9-7f084b25abf3", "sighting--bdf4047a-f710-4c66-8244-1ce0fda2b462", "sighting--80f85709-1f27-46a5-81af-838a55b90237", "sighting--c18bf23c-48d0-4f14-87a0-31bc54e3e9b2", "sighting--1a13e1bb-7166-41f7-98f0-04b728a05557", "sighting--1367b9ae-6906-4587-bec7-751793b41b33", "sighting--a243ceb1-170f-4ab4-aa5d-1bb99744ed4c", "sighting--22c89a7f-ced3-4de2-a34c-5ee9575be6bd", "sighting--bea70e15-3c4c-43c5-8858-5974cf6d8b84", "sighting--03ef7df5-17da-47e4-a07d-b1f41e1c3b1d", "sighting--50b8ca6d-d70c-4f51-a310-c893ada111fa", "sighting--5be5b78d-356d-45f5-b9e8-3c57aa73d6a5", "sighting--6b0da8c7-b883-493c-b775-520a8b7e5bff", "sighting--f7cec5b2-72ba-4760-bc13-ad070767f83c", "sighting--49fed312-4500-47ae-8dff-924ad081b2c6", "sighting--b4cc4ad2-758d-4ff0-b82a-be52e35261f1", "sighting--5462b318-b329-4a99-87c5-09e2d184413f", "sighting--3a91b356-cd0a-4181-bdcf-c633fd2776da", "sighting--73ba5227-dac6-4b03-a95d-2db7a8b8538e", "sighting--5bcbc0a9-3151-45d4-a872-18d7f33e9f27", "sighting--a54d9cef-4cfb-4a55-8688-9d29c326a981", "sighting--c3a78b16-8e13-4743-bd09-bbb798b62e13", "sighting--ff693e16-8812-4f57-8142-46af037a1806", "sighting--6b58ce89-95c8-434a-b305-8432f72bead2", "sighting--9a07fd71-0a42-43d5-9c29-721cadcd48f3", "sighting--900062d4-e2f1-43bb-8914-edb1cbc70dec", "sighting--83d21128-de00-4878-ab10-d0b4094be203", "sighting--d14955d8-54d6-4bbe-bb65-a49ef27dded2", "sighting--a8a704f8-69b1-430a-926c-2acb5851ff81", "sighting--3dd758d5-f42d-4395-9634-0ee8dd1e1444", "sighting--378734af-2e3d-4bae-b580-ffdf9dc07e56", "sighting--299ea747-3d03-44a0-89d1-af92f5604587", "sighting--8b5617dc-0c38-4324-8bd7-e84443905d4f", "sighting--2023acad-f40e-48ee-9b6a-d2225a38199e", "sighting--208d3a0d-4d42-4ab4-beec-340bad9bff14", "sighting--3238988c-75e8-425f-9ad6-07d17c5d0a06", "sighting--fa14fa71-c480-4947-9aae-9f6096bfc203", "sighting--d3abb7f9-6803-481a-ba39-8f43045ca5c2", "sighting--582d2338-ac79-408e-8ae7-269c5cb9d1b2", "sighting--ece90af8-5166-451d-80d7-7cb773ba8be4", "sighting--39541561-20c1-4b3c-8ae9-f0a577eb6535", "sighting--aac7eee5-16d3-4ee3-809a-f27781340f1c", "sighting--5b1930f0-4186-4e39-88af-d68899d2902d", "sighting--07b06cc8-2450-4151-8e3a-ad68611bf795", "sighting--88bb1960-8929-4c89-a6e0-64b8c7a3baba", "sighting--54bf910b-5d15-45d9-9849-4c52e9fce101", "sighting--e14768df-039a-4cdf-9f3e-a5b64fe4efc6", "sighting--2c5581d1-a867-425b-9048-caada6790bd4", "sighting--5874b776-8039-412a-b471-fcac2f03b889", "sighting--fafe8fc8-db91-490b-9113-9e3e0e86b58c", "sighting--3e5d08a8-7839-45b0-aafe-404ec3e9af31", "sighting--4b000179-73ac-420f-a84c-afb8da34d479", "sighting--1ff5c668-115d-46c8-b825-a96de97dae22", "sighting--fa3e9ea4-2906-4903-87f6-549a3e1be6cc", "sighting--4de14081-f4a4-4da6-bf6d-7af8a4ae29ae", "sighting--0d2b1bb3-5b7d-49f8-931a-9ecdb829fe13", "sighting--a072f747-87ee-4cdb-ae16-e7c444311356", "sighting--5356874b-e25b-43e6-b602-4f5329711289", "sighting--578ec5f6-ac86-4453-8392-da79621ef527", "sighting--11a1048e-3599-42fe-8d83-d00e73b50240", "sighting--0af10ab0-4931-4ccb-a92c-01d134e49549", "sighting--4bf02104-af9e-47d1-b4c0-16f07f10a304", "sighting--57c1d0ac-da4f-4680-bf91-7a0e3f525d05", "sighting--bea36f93-7b76-4c88-a5fe-14bf37fb4a21", "sighting--245c949f-01de-40f7-af92-998661c72839", "sighting--a66a14dd-6418-4bd7-98cc-39df1f66b9ba", "sighting--f1ec7000-60cc-41cd-8483-4b5d781d7bdf", "sighting--e3d05662-6b0e-4606-a151-96fc7004b553", "sighting--2b51a9f4-ae02-4156-8ae4-505ec93b728c", "sighting--34718da7-162d-4503-af94-8bc433c7a769", "sighting--f585ecfb-dbfe-4fd9-84e2-d29bd7143c4e", "sighting--5edeccb9-5527-43bd-a769-8c80d24f6d10", "sighting--292c166a-434e-4789-8529-b675f7d794a9", "sighting--bbebcc2f-1cce-4f39-aef4-9a4d7dcb3bac", "sighting--ffb613c6-6797-4f27-9261-ab45f9898f7d", "sighting--c215b480-8ca5-4fbf-bb1e-8d5802a763cd", "sighting--24319490-4184-4808-b32b-0a91b65d4848", "sighting--c8ae45f1-f2ad-410c-bc93-cd089d6d4ce1", "sighting--b2cf342d-f238-40aa-a040-43d18ca95f19", "sighting--24659fe2-aebb-44ae-867e-3c6190639c80", "sighting--f2af831d-9dd3-4c29-9d29-4705a7fbf563", "sighting--d33bc119-6483-48f0-afbf-a368818f4a6a", "sighting--597bb847-be1d-4a2a-ab76-efca1424d0a9", "sighting--e876ad11-16a2-42a8-a864-e865c16b2365", "sighting--6f3f9735-38de-49dc-a042-7688daf66778", "sighting--af04138e-b503-448f-87e4-d04c40f42c91", "sighting--229aa9f2-ef05-4ccd-b01e-7a28580421ce", "sighting--1639f415-94d3-40d0-9616-aa9e04fbda62", "sighting--f7a88318-d1ea-4c74-a9e6-dd8ef6126a1b", "sighting--3c1ce1a8-dd2d-45ad-89ba-e94662de3078", "sighting--a6ac3a4c-9975-46d9-8dba-04e752db7632", "sighting--4f96af99-1af1-48a5-a918-2bd2b6c6d336", "sighting--c928ec46-f5d7-48f5-9b85-ca0afb5962ec", "sighting--71405707-2d2a-4090-a00b-887361a27282", "sighting--102562b5-1a9e-479e-81e1-e133e0871ad8", "sighting--6c8f6101-d28a-4ebe-9f22-537ada25ee06", "sighting--a8bdd6bb-c28e-4e75-a96e-7bbafd48355e", "sighting--6c4e2273-b51e-413a-9ef6-0c43f651e87c", "sighting--e9d890ed-818a-4383-a202-56f69aff4386", "sighting--cc1353b2-fa3e-4017-b6ab-20ecac39d7bd", "sighting--796f9562-dda7-42e1-b417-a1c9fbba7810", "sighting--5d5f088f-f722-4a6c-a032-eb330e13b89c", "sighting--7131e07a-14c5-4ead-a91e-f9dfdefcf212", "sighting--6948e927-c8f5-440a-91f2-3177ea2b2fd9", "sighting--91a5ddba-e193-438e-be08-9af06aaf382d", "sighting--88d9b5e9-7d0a-4152-b419-e8219579450f", "sighting--9782cd6a-2ffd-43e6-9df4-c97674de24b3", "sighting--8b7b964d-bb9b-40a8-a967-d8aee0f42b3d", "sighting--e1c101b5-bdec-4cd7-922a-ee7508bc45a4", "sighting--7f62361b-1524-47bb-86cf-fb7c277a961d", "sighting--4d0e1992-2dac-452f-b2e5-44f24ef9dfac", "sighting--884ccd5f-aa78-44e5-9f95-5c477b9fbfc1", "sighting--891e7643-513a-4f03-b255-a135d41ec40c", "sighting--9f22e6ae-6210-4728-8f9b-e99720daef09", "sighting--9ab0f305-758b-464d-9cab-b26ba752e089", "sighting--3e682aa8-ffe2-4b73-b165-62f3e54fcf34", "sighting--5f59b77d-0a57-4d0d-a7ab-cef5e2272d3e", "sighting--588757f7-307b-4ed6-a7ca-7c71283104b1", "sighting--a0a19566-bf52-4ca1-a1f8-9838df13b583", "sighting--5c044ea4-a067-4820-81a0-2220028d31ec", "sighting--1268b893-9854-4629-9e0e-8446bfc497bd", "sighting--8f2772a0-5f29-42e5-9713-10b2eb661dae", "sighting--3bfa4e49-d3b0-4844-8f92-3dc032afc7b9", "sighting--3804d2f9-2225-4918-b2a1-76aec5d3ba4b", "sighting--5c0ed1c9-7261-444b-bc5a-dc1fd5a51e11", "sighting--ac84497c-d15c-409c-8a1d-2c74a80c0383", "sighting--b90b75f0-cf48-4d17-b90a-ee15d137a3e7", "sighting--0b63d623-9276-4dc5-bb07-2a7c8eb0eb6e", "sighting--bebcb18a-6e89-4a1d-8e8c-c6d32fd9f849", "sighting--0c3fcbc9-48de-42de-b2c5-26bd995f1ccc", "sighting--34484e8c-ceb2-40a5-a6bf-692762245c34", "sighting--90cd3189-81bd-4d77-b597-d436b8ef2b40", "sighting--a1f8caf8-fd34-4144-b5a2-559ff1c2d277", "sighting--beab26ad-d39e-4cb7-8fec-e0bc4cfb5415", "sighting--f30a9ed7-4bd3-42b4-9059-0aafb6bba56f", "sighting--cc62cae5-1833-439e-b251-c64d738342ad", "sighting--1e2836c0-a22e-45b1-8321-b2e0f7765455", "sighting--7ffc1df3-dab2-49f8-ae5e-c8d01892292b", "sighting--82b9c429-592e-4657-8998-638dc9b8b2d6", "sighting--ef9d36b3-a038-448f-9214-52934da7c8c1", "sighting--924fa60a-8bbd-49d4-a256-56494f165663", "sighting--ed3736f8-a18f-4acf-9d14-140e3933a9eb", "sighting--26d4a8b7-5751-4439-8204-86a636ee6128", "sighting--a234e786-cde1-4cf1-bd64-a72e838b4851", "sighting--dcaf02f2-0261-49b7-9dc9-dae651fa4803", "sighting--604b54b7-bae6-489b-8cb6-da27a46b74d3", "sighting--27773fd9-c105-4d39-a688-7c29df5351a3", "sighting--8eac4485-c509-49eb-b03e-4c2080a38745", "sighting--d9ca4749-acf2-46d1-a196-d67f2e748677", "sighting--46add84d-81b0-4c1d-bc72-bba2852f17ba", "sighting--dd6c6dca-2a04-41db-a66f-0e4866d02d49", "sighting--c36096bb-2832-4ef8-9458-b076ed7aa162", "sighting--32cbc083-bd70-464b-a09d-b77f2f7770c6", "sighting--7f001b59-08f3-4aae-a7c1-ff9f8a8667bf", "sighting--789d6e0a-daa4-4bc1-968a-d7a8ef34c32b", "sighting--25eab5ab-f522-4d6c-a055-af62e93cbb2d", "sighting--893df030-c0cc-4296-92a5-cec4181bcbf6", "sighting--0844f93b-83ab-4c31-9ea0-6dea7b136183", "sighting--d1a9787b-ab4b-4023-8097-c0db5b5d13c6", "sighting--800e1fc6-c679-4d1c-b7ad-13917c50c3bf", "sighting--f7c5e7ac-deb9-4c54-9d2e-4064044379da", "sighting--8365281e-0454-40f4-89b2-a76a4f3c4e1c", "sighting--9e169b4d-3f62-481e-aba0-b26fa61ba1ad", "sighting--12e708d2-9eb9-4a09-93d1-d6067b6649ad", "sighting--1144046d-d3f5-4d6e-881f-29d595b51ba4", "sighting--5d31f85b-2671-4f7a-853c-354f38b9faf0", "sighting--bdd9fc69-fff1-4e5c-8dc2-0e00dfa4ed32", "sighting--d93da087-a7ca-4e40-b4c7-2f2a67f17ff1", "sighting--b26c5e41-d0d0-416b-a6ca-f805e31f6ff6", "sighting--1d213cc1-f4cc-482b-878e-4bcf3b82b37e", "sighting--4f60d777-ee88-44b1-934d-ebaf9c1c211b", "sighting--27dd28a7-43b4-4d87-92c5-07434a2d267e", "sighting--cae67d28-d971-492e-9ce5-8f45f2ed4f71", "sighting--ef76f626-4b78-460c-ac1d-6499f9931d0a", "sighting--04741294-c45e-4e06-a6f9-e64f6b47af05", "sighting--a4847369-5a2d-4398-9bcb-4ffff4937770", "sighting--163aad27-b8b4-4c65-aab9-9892491d3626", "sighting--04e28a7d-d5d1-4e5c-9943-a76e7fac8b9a", "sighting--c5d4e631-9306-4933-a45a-3e004ed426cb", "sighting--6452a470-af22-43c1-8d89-6d557fa09ce9", "sighting--93233379-bd81-4be9-a5c8-b3c4aca12346", "sighting--02d84508-b8d4-40e2-ac0d-152e5bfeef1c", "sighting--fc06bff8-b0e0-497b-aba6-ea3b49966ee3", "sighting--ad7725ac-8db1-4c59-8711-5ad27e2da538", "sighting--b4b051bd-e86d-486e-abf1-f767bf48e48b", "sighting--7d04d816-c627-44b1-b7e7-a48d540a94dd", "sighting--3b443183-2798-41a6-b013-cb48d7bb00a9", "sighting--1cd7da7f-8856-4ff4-9d7f-a5fae6ad69a6", "sighting--ee7b9aac-42c6-49ee-a6a4-2bfb54b9e8b4", "sighting--90a8bde2-e496-40c7-bedf-ec5fd5672367", "sighting--d09c0fe9-182d-4cfb-8eac-ce114df906cb", "sighting--02c91f7d-5517-4bbd-880e-6b60279ff9f0", "sighting--8808a7a3-3fd1-4271-9c22-c89605b66f04", "sighting--1e00b165-03b1-4ac5-936b-cef0f51791ec", "sighting--fb3317e3-4bcf-443b-b111-49af86f04421", "sighting--22b0f104-e5f3-4ff9-8e77-f2300f032c6c", "sighting--763f64b3-e93b-42f3-ad20-a0ded0ba0d04", "sighting--bbe1fe32-2935-435c-9bee-8953777b5028", "sighting--df1974c9-158d-4dfc-bafc-5b1bd0fad058", "sighting--b8513103-2bd4-4f36-b82d-a1a391f6900c", "sighting--df8dac8a-471f-4d4b-90ca-9f91f1362567", "sighting--777bcfc6-34aa-49d5-afea-b0a62c9d2a03", "sighting--6c8d602e-b90c-4c9a-928f-f8d01a0b9480", "sighting--5327f349-b59b-41d5-b1de-a8611fbe13ec", "sighting--a47df1dd-edd1-4c82-ad35-740d18a91449", "sighting--b5f0f8ec-6524-45a0-a485-657a02e55f8a", "sighting--13d65b08-c94a-4ad7-ac42-ef0bb1082e3c", "sighting--47b3023e-2786-4ba6-abbc-6a0a3ac90195", "sighting--956cd6b9-539c-4d8f-ada7-d64383d34e1e", "sighting--8a0209d0-a90a-42bf-a8e6-4b2fcd4a1153", "sighting--9cc68882-6950-4a47-ad72-b7ae49901320", "sighting--1fde8ccc-b2f9-4421-be7d-fc3e48c3a666", "sighting--10319b0f-8f67-49a8-bb3d-4152264de7ea", "sighting--7fe35321-c719-4aa5-b52f-a82a4b5e2353", "sighting--5d327b53-fa75-40d9-8a83-196967225cb4", "sighting--425581d6-ebb8-463b-9284-6884e8ad188a", "sighting--2191061a-0f9a-4ea5-9400-eae8fbcafe0a", "sighting--c5beac0a-bcfe-4e3d-b331-9bac9a5e96df", "sighting--c0d8d5f0-0aff-4680-8f02-4c6dbf9ef0ba", "sighting--b4ced9d6-13e9-4bd5-a027-be390127f8f9", "sighting--0ece3e08-93a1-4567-bbbc-dd3e102b5740", "sighting--d6e05d1c-c791-4ef7-8a57-45cb45c7935d", "sighting--390bcd90-d017-409b-9681-48aed7a4da68", "sighting--50b8fb64-aed2-4e75-a00f-053671782915", "sighting--af368d88-634c-4519-bb2c-4c49d3cedfc6", "sighting--306afa16-6c65-40b1-8282-0a3ed9c751d9", "sighting--26088d30-006d-40d5-8b3f-f420d901f852", "sighting--a2d8b1c1-f2b2-43a0-8d54-5983a7ae112b", "sighting--b298a5fc-32e7-4f13-8ff2-e6200e6e86fc", "sighting--055e1e26-3b7e-4a0b-acc3-6c078d521951", "sighting--ddad3490-16ff-462c-bab2-adb65d2264f7", "sighting--cbdbf7c2-45ee-47e2-a74f-d7e9b1c4f374", "sighting--7f6ee357-51c1-4a29-b5a5-4175730f25ef", "sighting--18353985-aa46-4ae6-a083-7296d476340d", "sighting--af5a3615-6cf6-4eb4-b109-aec3fe595fc4", "sighting--8c5a763e-d00f-4a70-b8c9-b324c3886902", "sighting--dfe79470-d492-4f32-a59b-35fb6b31d243", "sighting--15fe0d36-21f9-4501-94ff-9ea4c4ee8361", "sighting--ae853524-bf5a-4a3d-b863-45b56bb9d180", "sighting--2ec7f1cc-45a7-4b92-9e94-246e4292af04", "sighting--a549c137-5289-411c-8595-12afa8f2a7e4", "sighting--187c0c36-84ca-4b91-9b96-c1c3fd79cdf6", "sighting--cb33fcad-d3b0-4254-adf4-5964496f2969", "sighting--06f0a9b4-eca5-484d-9ca6-d51b35538cba", "sighting--8f32bb47-d115-4e7e-bfa4-d8de68218f0a", "sighting--a8fe78c8-878e-4e60-b436-28b29ec4155d", "sighting--a6d811c8-b022-497a-adbe-0402ed203d32", "sighting--4fa678ca-efc7-4abe-b1ba-62396250b2c1", "sighting--88d1056d-c36f-4bf7-bf00-e0c05eed4f68", "sighting--3a315930-efb2-42df-8643-d35cbbac697e", "sighting--bc28075c-0628-499a-b07c-3524793bb8c7", "sighting--a0dbd857-e055-42ce-aeab-d312d824aca5", "sighting--501880a6-7c61-499e-95ca-89ce829b0321", "sighting--218c0523-6fe5-403d-9e45-e52533409ac1", "sighting--025e98b0-dc81-421d-a12e-060207f3c259", "sighting--3715ccbc-8e1a-49e0-8c94-c7c1957ff3f1", "sighting--e6361248-dfd3-464c-9c6d-70db55158ec8", "sighting--0f6887a4-fa52-4c08-b728-bcabed060c2c", "sighting--2481772b-da33-4eb9-b654-0ee7a1232645", "sighting--128832ef-6d25-4436-9206-a202eef8de30", "sighting--bb17c61a-a0c1-437b-ae63-269fe5325fd6", "sighting--fe61101c-e613-4a5a-85af-3775ca42ab14", "sighting--5a0cddaf-94bf-4e3e-87ec-4b20f4d0face", "sighting--670c8364-be7a-4bb8-97a5-0b9f147165af", "sighting--d89774e7-5203-4e4b-a9b1-e1a4edaa0d26", "sighting--c7d18eb5-d235-4fdb-adb9-a2fb1435369e", "sighting--6f9043aa-d3e8-46ff-bc3b-c90130a66962", "sighting--d4534639-02b9-4f49-a434-fee02581780d", "sighting--67a2c277-54e1-4e24-b49f-29d0d5c6c7ab", "sighting--21a25b8a-e125-4060-b322-7ad6d7741901", "sighting--093825ae-3341-4453-960b-073b7429d305", "sighting--9f6447a1-abdb-476c-9f7b-13ded01303c8", "sighting--eaf1d322-8c14-47eb-a32c-812ef44d928e", "sighting--84ac826a-6418-4f2a-a729-d02eb0536394", "sighting--f7f4cae0-b210-42b1-8ef6-d818eeb56d5f", "sighting--0a0cdd74-9d8c-4bc7-8892-92bda7290a75", "sighting--7519855e-249d-4c19-a44a-9880226c1063", "sighting--ad03a526-4942-489a-9494-bfa5f84a9e71", "sighting--e58231bf-7511-4122-92b0-6686781d9048", "sighting--c4c3e8c9-162b-42b5-9840-88fecc1f4a33", "sighting--fc96b2f6-ef80-4e60-875b-e90f7f66ffbd", "sighting--7dd5600f-a643-4ac5-a5ba-158db3971259", "sighting--78275c61-e045-47e3-833f-e1d3d1bb8ef5", "sighting--ef30c83d-1f88-439c-b837-9b113535f269", "sighting--c4531075-b9a8-452d-97de-47677080ecef", "sighting--1c387ed9-4605-4c85-ae4c-61b867fec159", "sighting--61e74d34-96a8-4708-9173-00c517bb67eb", "sighting--6cba6041-f73a-4a6e-b57c-9032e6e8c934", "sighting--b8182014-95c1-4ac5-a1d3-0170be9a28bc", "sighting--4d40a6e7-0ae9-4186-8c19-6c3089ec8b04", "sighting--969a9021-b640-4cfa-8969-4d6b3ec08899", "sighting--4cad162a-1b44-4037-82ae-97de57c7b6e0", "sighting--3dd0e101-f437-451c-a228-7edeb68024c8", "sighting--c34e6fba-60dc-45dd-a8e5-7141dedc1340", "sighting--20822f4b-e825-49c6-9599-7e0ec683228f", "sighting--6a07c20d-44e1-4bb1-bb11-ead632675810", "sighting--d57ca810-1d09-4a5d-8b93-98f2c62ce77b", "sighting--8a6fba2d-a169-4dc2-afa8-d67ace5aeac9", "sighting--1e9fdeb1-ed55-4d49-8c43-d0972a76bac1", "sighting--4edb27ce-c57a-4b17-addd-1049a3663dfd", "sighting--b8822e41-37d8-4281-b52b-bef443bf7086", "sighting--180eba9f-f04c-41a3-bbbe-86276dd2a285", "sighting--37c015b8-4cae-4cdd-8137-9a2ec7d1913d", "sighting--d5c2df60-5146-4779-ae0f-bdc3bb7dc14d", "sighting--205808b3-932d-44e0-98b4-d48eb41fdc09", "sighting--cdb6ec53-a8bf-4473-86b9-69eefeabd66a", "sighting--1a23bf7f-e529-443b-b5a8-d59560c05a2e", "sighting--50f9af88-5a51-4e42-a3b0-22b5f44ded71", "sighting--9c4f6339-b1b8-4450-a64b-d1e665c15069", "sighting--784ec347-30e2-4bfb-b1f2-45d758fa429d", "sighting--12dfabd6-7dcc-4a75-89f5-841b29dbd7d7", "sighting--e34d42a5-d13e-42ff-9f81-0335fe26a4ac", "sighting--b7c166bb-88c7-410a-8528-886d1adfc399", "sighting--da829aa3-891d-4c45-a5d7-3df31435565e", "sighting--0cc372e6-6852-4b26-993b-71cafa0619f7", "sighting--cef447a2-5c87-4aff-ac30-f4f8cd340b40", "sighting--d7f93a9b-4d37-470c-850e-5a67b14dec62", "sighting--26939af4-28c7-493b-beef-145467247624", "sighting--b4009bd9-50f0-4b97-a59f-843f0ea7789a", "sighting--0a46f9d0-0fd2-4c95-9739-93c56e16b963", "sighting--ebc30ada-ed42-4ad6-b7d6-406bf62ea099", "sighting--0d9bb95f-2798-4890-9157-a27acbc4643d", "sighting--d7d8a004-cc01-4699-909f-c8301f203674", "sighting--bb961ec4-cfc1-4470-8314-a03be2e97459", "sighting--f649585a-1e08-43bb-9816-ccedcf67ce9d", "sighting--5fce3e55-8509-45d3-b9d0-ab15f0867466", "sighting--d69984ad-abbb-4d64-8fc8-4b451d8f78be", "sighting--43bd196f-44c1-45f6-ba92-d89c883dcc13", "sighting--f7d51690-dd86-4a68-819d-d884e06e2d9b", "sighting--4f8a8ae7-e1bf-4b90-af28-bf8f44ce59be", "sighting--d90e5de9-d7a4-49a9-bb9f-58137be0346d", "sighting--384d778f-c50a-4a49-b496-cdde7f8e5073", "sighting--d072ea63-fd22-435d-90da-ef39aa6604bb", "sighting--8a888ab0-59c2-4a59-ac74-41a1974dbc4f", "sighting--4258504d-28c0-44be-b565-47c854dcd45c", "sighting--9e66b335-1894-49ef-aed6-f199ba7b5adc", "sighting--ec90beac-b724-4a60-be6a-9804bd7a880f", "sighting--8451fa16-0c0e-4d4a-965c-9aa113c1348c", "sighting--754ebc01-8a2e-4f11-b70d-e0d19fdf57cf", "sighting--0bd35c4a-966d-4dfc-9c4c-88a351ae6912", "sighting--8348aa9c-0992-4359-af92-ee040813e9a7", "sighting--06debf64-a9dc-4f88-bdcd-254fabda62fa", "sighting--515d65c2-66ea-4ce9-aaa5-71cd8fea6a3e", "sighting--390adfd6-7cb3-4285-81b4-d9cb3f75ee5b", "sighting--ad0fe7d1-aaf6-4bfa-a66d-a0a9b7661a4a", "sighting--8a4ea69b-69b5-4d2b-a63e-423474b281ae", "sighting--cf3a0055-2463-4e51-8031-42354d107e6f", "sighting--02f1c2b3-f22e-4c0a-b6c3-0e3ff9f0573d", "sighting--5deb212d-5bbc-4729-b6f4-5f4492f35730", "sighting--a1bca4c7-85f1-4f3d-8a9f-000efb4eeb2d", "sighting--6a38bc85-553f-4108-b5dc-a2cdf539466b", "sighting--1214389c-73e1-4e1c-84f9-31dc00662747", "sighting--087fe8b0-bca4-45c8-b369-76f821d595a9", "sighting--2d0150f8-d0bb-4bef-a260-94d08de02b66", "sighting--f8c66bac-6d46-44f1-aa63-aa4d50e520e7", "sighting--ca76b264-c9f0-48ea-b7a2-8d0b562447fc", "sighting--55eecd4f-dae5-4647-b9b7-08a792bed917", "sighting--48124b9b-01f8-4d6c-8a9c-ad547bbc93fb", "sighting--770a3225-dc15-4cb9-b813-a3145cf3c2c0", "sighting--c94dd109-a62d-4d97-8fec-b0d42da40cfe", "sighting--c6c2b516-4ecf-46ea-b8a2-a06b69c87bf1", "sighting--81c713c3-5f63-4cba-bab8-6bca79650370", "sighting--76cc9209-3953-4679-ab20-d3c1a562d35c", "sighting--3048a87b-9c18-4ba2-ae3c-103c1c23df31", "sighting--ebf8e9a4-7c25-4f94-a4ac-d031e4ef1fa1", "sighting--b91508c7-98bf-4c90-867e-80937c056c7c", "sighting--897d5976-8a76-4b1e-b682-70dbd4b099a7", "sighting--e8e92294-b4f6-457d-bacf-74b5e1047d7b", "sighting--7323919f-4c14-4942-bb5e-8258ce1aee2d", "sighting--9bbf6fe5-6c59-4e96-bf03-aec4eec5ba90", "sighting--d406b645-617d-4b88-af5e-1a63b6e97706", "sighting--272ff7d3-0463-4a8e-a848-42216608448d", "sighting--f764e113-bc3a-4adb-890c-a5304f828628", "sighting--56fcde5d-4ef7-4611-866b-6f2e51adaff1", "sighting--f2643828-4930-4ba6-bb16-8cbe62f2b4d4", "sighting--53a778bf-c456-4fb8-8318-fb9c9413b23a", "sighting--34b9bc48-3ef1-41a3-bcfe-a2cb7f0372a9", "sighting--21e6b48f-c0e9-4704-843a-3c0adf164242", "sighting--63679c75-5c46-4f87-82a5-c0fb78012f3c", "sighting--b4635299-cef3-4620-827d-718f35469bc8", "sighting--8a8af5bd-4b3a-498b-b848-60306b1961f3", "sighting--f71e8f18-1f30-430b-a2e6-2772352240c5", "sighting--b0bf4623-0630-4710-8014-ac65fa522539", "sighting--2dd973c6-54cc-4f15-a0b5-5d8c9f082260", "sighting--aebe3dca-0fdc-4c06-be5e-e23385f90885", "sighting--70dc3789-6af7-4088-ba9d-11a4cbff3da5", "sighting--048e9c26-5813-40f6-a120-e7e3d64a4255", "sighting--5b6a330e-5519-4e23-884f-9426a03383ee", "sighting--acfbdc2a-230f-42a5-ad4d-0e00ca85c6e0", "sighting--6bf7ce08-2d87-430c-a426-3c95d122e0e5", "sighting--36b0791a-5e1a-441c-8f0b-a5aeee3744cc", "sighting--9b36eb74-9ff5-4813-829b-69d2970661be", "sighting--66ab7291-ce5f-4463-9d92-59e34bcfcf83", "sighting--e02b050a-11c5-4ddb-9c56-3e3f3952b75e", "sighting--a6341d14-00f3-43f8-be82-a143e2b959b6", "sighting--f08b11b7-3bea-4eef-a9f0-85394229b4ab", "sighting--36f57bf3-4455-4f9c-b83f-9a3e929db790", "sighting--2f569264-039f-4a82-a9f1-da450da611ed", "sighting--862049b5-a5dc-43a2-93ed-16fd1d2fe3a6", "sighting--07e8d1fd-b740-4996-9fe6-dcf68247d0e6", "sighting--767b6c59-a1c0-49af-8c18-616e4976753e", "sighting--77d20654-3b50-49c6-9471-b91df5dbe0b4", "sighting--64a787f9-287e-4c72-a3db-8cb020365b08", "sighting--64bd2358-b766-4d19-ac24-2f92fa13376a", "sighting--adbf7f5a-42c3-4869-b3d7-c99b2d94ea77", "sighting--d646bd53-1329-4205-8ab9-5f5931894a74", "sighting--bd49a2b1-292f-469c-b616-4d2d5f7e06b5", "sighting--fd18cb8e-81b4-49da-8609-d65224d9247f", "sighting--6662b4cd-13e6-4783-a24c-36163b301b41", "sighting--d352ac69-c135-4671-84f7-154fd60ec387", "sighting--8614687c-ff40-461c-90c8-10a01af2f548", "sighting--73210cdb-b4b1-4fd1-984d-ef940328cf63", "sighting--ab8e4442-820d-4186-a16e-1695f8743c3e", "sighting--44d8b990-aeb9-48ad-82f7-cb66b65ba923", "sighting--d9a4d271-247b-4fd1-91d0-5784430f9b61", "sighting--ca95734a-87f9-4362-9c9a-d21b9ef05adc", "sighting--b1a5cbc1-6b67-4657-93a5-883cd0a36930", "sighting--87aa0c5b-7fe5-48db-b84e-850895b602ea", "sighting--27500f17-c85c-4bda-a464-1249640eb127", "sighting--10ec49ac-84b9-4c4a-8355-00967982be16", "sighting--d6a44d32-0b73-4011-b541-0eb64896af04", "sighting--106f42b6-a24d-44ef-8694-bb31e2df6d99", "sighting--7c631ec3-fb3d-4d7f-914a-d5ca9836bdca", "sighting--b7a52412-89c4-45de-ad97-261eb2c92b02", "sighting--ba5fb830-6ad1-4865-870f-7f988389ec91", "sighting--92fb6fda-fecd-48d5-bf51-c00926d4efff", "sighting--1003b5ea-a0fb-49e1-830f-a5f183a98fb3", "sighting--bd0a42e3-007b-46c7-b454-9e922ca921d9", "sighting--e18b4cef-345f-453d-ab6b-6c04b72bf903", "sighting--2eb8faf7-f8cc-4f73-bbe3-8cc6c29f5eff", "sighting--5ee0764e-f921-4ea1-b2f1-5f0b10bd1bcb", "sighting--0b7b024c-45b4-4f3b-a07b-2b2e7f57d3c3", "sighting--cd39857d-d9db-405f-92d5-93fa2dce82d2", "sighting--42b62d24-5de5-452f-abae-c317cdf2586d", "sighting--b8103bcb-7467-452d-9585-3bb05b2eafce", "sighting--27a37bc0-b9a6-4b3e-9995-5f325971d8db", "sighting--428dbd66-2f73-4b17-941e-f26257f52776", "sighting--0d11e8a9-cc00-4654-be92-5f46972f8478", "sighting--f961815d-3271-4142-a266-2b12ae918502", "sighting--ea857f0e-79bd-4498-8a3e-4fd0348e4931", "sighting--f9207cd3-b980-4985-bd12-eb4f6169bfff", "sighting--73e3285f-11ce-4f82-9c7b-6dac2b27d0ac", "sighting--2b623569-2464-4e2c-8666-f6e92973aca8", "sighting--8d2e46f6-2510-439d-81cd-d344511648c5", "sighting--d37c1df0-96ba-440e-aca5-d5f74cb84201", "sighting--a848514d-b679-42c2-bc65-c1d07ff838c5", "sighting--26a03955-82cf-40b7-8237-2be9b13b3296", "sighting--cfd6b944-59b7-42ac-83b5-97d36e153108", "sighting--b5f33720-09e1-4c11-8a50-9004936524d5", "sighting--8c5fccc4-e413-4f26-8272-f29638c8b8f0", "sighting--a6ed9f32-2375-459c-8469-b74eed9af54c", "sighting--986a17e5-a691-4721-99b7-93e77118792c", "sighting--581b773e-f0f2-4104-a812-d7d030f9fff7", "sighting--d817c357-f7a7-45ae-8985-21836f46aa4f", "sighting--3ac544c3-7240-40a1-82dc-d399d64ec688", "sighting--7997567d-8961-4a4d-9e49-1f21f13fba58", "sighting--ba355cd4-9947-450d-96e0-667fd3c754b0", "sighting--98c9c05b-48b2-4414-9003-ae32953ac8e1", "sighting--232e31b1-70f2-410e-9503-d18c6aec30b5", "sighting--7c49da0e-8ce9-4273-923b-42222de2d2fc", "sighting--4bc8e49e-c08c-4add-a64a-4c49abcb872a", "sighting--f0d49a41-a07f-4a4d-a71d-6c51450366dc", "sighting--152a1464-8eb2-4278-9367-80ed47a0c402", "sighting--73e5f3f9-db7d-43d2-9233-3c1e3f84aa31", "sighting--86af52ed-f01f-4f1d-9f01-bb64f7f4935c", "sighting--de57fdd7-914b-4a9e-8fc9-ce209174486b", "sighting--de693210-f921-4f00-82af-8d42de2630ed", "sighting--0f4c744f-db31-4100-908e-ceb218ccafe9", "sighting--f7ee10d4-9dfc-44af-be0f-28ccb5401747", "sighting--7b916c5d-62f7-470e-ab5f-098c0a10d34e", "sighting--86a2cccf-6820-4bf8-a043-40b9b109c3fe", "sighting--b2b413c9-4554-4a08-8ddc-fb7684877563", "sighting--213a401e-063f-44d2-8c1e-1817f635e91c", "sighting--88ec3fa9-c771-4233-be8a-6d8176ed5ea1", "sighting--afce6f5d-5a7c-462f-ae46-fe9fcdf3fe21", "sighting--21fc01fe-3ade-43d8-a516-6791999d487e", "sighting--3dfdb02c-0707-4172-a156-9ab91decc208", "sighting--8a569257-47aa-46f7-9050-2e436b42f716", "sighting--3930da4a-c091-47d4-ada7-7ad4529fe94c", "sighting--0aa3e941-af18-4860-843b-e3e5d2a8515e", "sighting--4c6336b3-61e3-40f2-a006-c1225fb3ccfb", "sighting--20e28ac7-a804-433c-8b65-25a7973a39b3", "sighting--c6597e38-6d88-48d7-9e97-93ad80afcbac", "sighting--70f61671-d5a3-48ee-a68b-3ea64c9c5239", "sighting--af1493e6-c8c3-4a10-a9e3-be741865c331", "sighting--443cce55-8d0b-461b-897d-b0ad04288b02", "sighting--1d9cee6b-360c-47f8-966f-5418fb953291", "sighting--5b674d23-0b89-48e2-b018-a63bebb2d7b4", "sighting--9adfc876-c68c-4a30-b861-40f6397aeac9", "sighting--ae5fb123-1be9-49a4-80e2-8f3a3c0442b3", "sighting--3576ef22-601d-48c3-b421-f157e49c527e", "sighting--8af01bf5-3c90-48f4-a0ca-190959b6230f", "sighting--edbca0f6-437a-4568-858b-f85d5d8f4578", "sighting--1a4f03fe-d9b6-4b91-9b18-8c1fb3f2bea5", "sighting--e2378242-fe3f-4869-8f15-87ddd48cfcb4", "sighting--ddf48029-aba0-4517-91ac-d9cb2ab948ec", "sighting--dd872207-b3cc-401c-b4ca-cdc64faf0a85", "sighting--753341f9-41ad-4518-a807-e6652fa2f83b", "sighting--92afa094-40d5-42c2-839e-c91c7882f31d", "sighting--c5cc9263-2dea-40af-b030-5de1cdf87205", "sighting--82fe4422-e53d-483e-b31a-c6330e3bf1a0", "sighting--6f2bd2c4-1da4-45ee-bbda-ce2a44710f62", "sighting--3378c5d6-8766-4cfa-a66c-3c166f323676", "sighting--828fe4d7-c272-4e9f-81a2-b2042ce8bd43", "sighting--0224360b-5676-44b2-8241-6649691ba093", "sighting--fe8f234e-4135-41b1-bbaa-6402f1ac3ca9", "sighting--6cf39123-b23c-484f-a667-42ef91e49e91", "sighting--b2f749ae-81f5-4681-a756-f574b03a5807", "sighting--8a31ee2c-06b6-48be-a4bd-57bd5da4d91e", "sighting--6c9de824-0eb1-4b02-ad78-4623faa522ae", "sighting--8443a230-0216-4301-ba86-e12ac2b459fe", "sighting--4ae987bb-655e-4409-a155-7618d832bb76", "sighting--a07c582d-920a-4351-8734-aba6a4fb6677", "sighting--4fe326f0-9a72-44e7-9d13-e556fd88c2bd", "sighting--909f218c-4227-4e7b-b043-16de6c523cfc", "sighting--f2b95376-9f4b-43ba-a7fc-1ccd25fbb362", "sighting--6f48e488-cab3-42a0-8b02-e2aa56201846", "sighting--5af548e7-9674-4895-ad7e-2018f173c3e2", "sighting--a04113ac-f147-47ea-8ed9-e21a7cf7c14a", "sighting--7ae6549b-3400-4518-94e6-ac41945d8800", "sighting--c0032a23-f630-4db4-bd3a-6927126c79ca", "sighting--86881f75-9897-467f-88d3-214ee7f315d5", "sighting--f828cb75-3fb7-48d0-8cb5-48379ee6cc61", "sighting--e1786945-31d8-4ae1-9652-4f1be94c572a", "sighting--75e7a5a2-bb81-437d-a060-5b7c58152d4d", "sighting--7a7c346f-3dfb-4e75-a8d1-3bcb0f79a80a", "sighting--6049d352-ce8a-46f5-98f4-64150082e991", "sighting--1d5ccd20-7c50-4cbe-8db3-ea979100b1bc", "sighting--2c13ca1f-5b69-458f-b07a-f50caaafd2a3", "sighting--56aeb443-ea13-4518-baef-2d61ef71e5fb", "sighting--bdbfa6cd-f945-4cb1-aa80-16e8845aa12c", "sighting--b9265339-c7c9-4bb3-a1a1-362ed5fb2d34", "sighting--2e6aaa93-9b6d-4e88-b0ab-8a36ea56170e", "sighting--313858cd-f1ea-4a29-a855-48293f033af9", "sighting--7a51da67-30aa-4f48-b10f-0ca125e06cf5", "sighting--92fa02be-9c7d-4eb2-9b25-2cf4180b6e9d", "sighting--06219639-8364-468f-8f53-93d9291faadd", "sighting--08e0ec16-53ed-4bd0-afb6-5e6050b8611a", "sighting--597e3a34-8dca-4136-80d1-8e64162d655f", "sighting--531c6348-a6fe-41b4-9a93-1e89983acd68", "sighting--9d541fa9-f977-4452-955a-87d3451aa416", "sighting--f2bb536b-2359-4a53-b279-8507fb668c05", "sighting--57dcaf85-7d78-40b7-9c13-e9ecd5a58fa8", "sighting--ddc2e214-17fa-4b57-a1a3-4c5f8b2f8166", "sighting--65b2f1ff-9359-4420-aebc-c53daafd919b", "sighting--c1947d17-fa09-4a5a-97a0-41d41d6cb66e", "sighting--cecd279b-13d0-4863-9c2c-e2c417a8ac81", "sighting--8d6cd712-ac54-45d8-9cf9-ab14989be2b1", "sighting--34f3f39d-dfc3-4fe2-ab01-9f2a76a0588a", "sighting--f9adf796-e8df-459d-b525-569c3f8ef6ad", "sighting--509a33d2-e74e-4f50-8b6d-671f63cc6304", "sighting--e7ad791d-e369-4acb-ad2b-d432f97cd56b", "sighting--dc668eb3-3aa5-4562-8b5a-9a142cadda88", "sighting--2ff08e5d-4f08-4236-800a-99051bde02e6", "sighting--e0c552de-3f9b-405c-b97f-a0388baf779e", "sighting--e4fe62b3-c2bc-4560-9620-38920099a777", "sighting--d74aa73e-6e3f-443d-b148-e4930adb2c57", "sighting--163108ee-0b24-465c-a2c5-8948cd554e5a", "sighting--2ca98858-a74d-4e6c-9eaa-913b509a378c", "sighting--4befd9b8-cc66-4c24-8cf5-90adc73bf22e", "sighting--9367b989-d346-444b-891e-362b31092c45", "sighting--a1d89486-3060-468a-b480-c4939fdc5a46", "sighting--6dd4cd5b-b42c-4f9c-a02b-fd00819a65c1", "sighting--f9160df9-a2d1-4119-89a3-aa23d51110fa", "sighting--6f7b2301-d344-47d0-8630-6daa106b94be", "sighting--ea5b32f2-0600-42c5-9ab5-4cafbea45554", "sighting--fff3f3a4-479e-499f-b346-010ad155818d", "sighting--a77eb9ff-039f-44c1-b206-7615ed567295", "sighting--926cb16d-89da-4c44-a485-4dce61a608df", "sighting--ed74a861-89aa-4af3-aa6b-0def56330f39", "sighting--39235bb2-5573-4e48-ae51-41dfdf424a94", "sighting--74faa204-2b38-40a3-bf30-07d349385248", "sighting--79ad5bd3-dd75-471a-b18e-ed785c7523c1", "sighting--f9a2c20a-5998-4dc5-ad05-732674d62284", "sighting--f60e0ad4-24b6-4cf2-8dc4-ebc95ca51642", "sighting--23bfb1a6-28db-4566-9efd-e30c1649e6ae", "sighting--e340e96d-4e26-4311-8e21-51d1d6e2a3d5", "sighting--cb9df458-d0e2-4a9e-a39c-a2ef038fc779", "sighting--0fa7ca8f-168f-4d11-8b11-bfba563815bc", "sighting--09f92dfa-444f-453e-bf63-7c1e96d1d495", "sighting--3547df4e-f7e4-431e-9e21-fa3f107e46b3", "sighting--e600a010-f932-4de4-bcb1-be879391b963", "sighting--49846552-6bf4-4354-b12d-1f3aa6fbabfe", "sighting--6d93a9f5-30dc-40fd-bc42-33b1d6ada435", "sighting--244e1ee0-a492-44bc-8e79-dd41f663739d", "sighting--e16bb6f7-3d92-462f-9e44-567ca46d1369", "sighting--27f62a13-d90a-41f8-b765-ce1c25e57c89", "sighting--dfbabc1c-c0af-4df4-a9be-81f69672690e", "sighting--04d7e101-6025-4f8d-84d8-fcb6cce32e2e", "sighting--bf25ceb2-5c3d-4228-8224-5b77ffca9cc1", "sighting--df0c6184-e3dc-465b-91c2-228f04e8abc8", "sighting--b7cf085e-1b25-4bd8-96d5-34048dcfb3c8", "sighting--92fd3936-c46a-45c0-9415-e6f91b9b7a7a", "sighting--45fd9220-6826-4bf4-af49-7d6a0393c893", "sighting--e08a6406-34ea-45c1-ad57-b4c848c930c3", "sighting--c3ac434a-e875-44d1-9a9b-3404ddee3ab5", "sighting--41ddc27b-a4c3-41ae-8250-638037c813d4", "sighting--c6c44ec8-85c3-453d-b610-415214ed65cf", "sighting--904d8bbe-ad43-4199-828d-d3470d69d522", "sighting--70329418-832e-440f-9182-ff14f231c48f", "sighting--f7e83ed8-e5a9-45b1-bac6-1c3f8bab86d3", "sighting--a21218f9-d03b-45a0-8592-ef5c502b270c", "sighting--3f5b3e43-b848-46ad-8e6e-db1ccfcf617c", "sighting--4a899d56-da38-44f6-a804-c66cb99658dc", "sighting--f6e19ab2-9615-4615-b88b-b005d1b2e87b", "sighting--de3a025d-f8df-4409-80dd-9530103c11a5", "sighting--b14dd292-38bf-4294-8e91-069898315b91", "sighting--7684a0ed-d9e7-4eb5-8387-a0a582f3f11f", "sighting--c92cd8e0-b060-4884-8cd2-113bc4b43008", "sighting--4f9b6fbc-b5f2-4327-a4a7-4e810213858f", "sighting--41aa204c-8c00-4f8c-9a5c-12a4def8da17", "sighting--9f28a25a-6d62-458b-b162-2164992e7cf1", "sighting--f4d5f2fe-a9d4-4ac3-85cf-e1b0ed2d07cf", "sighting--3fa4bb95-b1ff-424e-95af-894219dd5d59", "sighting--ff7d3961-6d08-4b94-b054-fc1a494d1465", "sighting--77303f2e-3187-419a-b5b8-44bcabefbf2b", "sighting--7c899d35-922c-4217-ad16-a76c8c1ea3ce", "sighting--22d6d6fa-d739-405e-8248-24735c382baf", "sighting--af624f08-507a-4aa1-b7e8-4e5f5ad53b93", "sighting--ae61dba0-f19c-4dfa-988a-f9d0ada2fc73", "sighting--c72937ee-4b5d-4d74-84b9-2ca81fd02817", "sighting--f0a90108-336b-44d7-a55b-a3b947852460", "sighting--aeabdf29-88b3-4d30-b58c-1df178282bab", "sighting--03bd50d3-07f7-4708-8240-ab5880f3196b", "sighting--766eaf2f-c187-4384-8209-bf82bb32f066", "sighting--f64011ec-a1af-4df2-8bd0-2c21898353b3", "sighting--63426be1-e8a2-4eca-b213-15398a549691", "sighting--e3ca2458-ddff-468c-a2e0-11c71a56c88f", "sighting--34840569-ae49-4bbb-aae0-8f40cabc4a01", "sighting--b618c02d-5c02-4e18-b5dc-942335755735", "sighting--cdda47ba-150e-49b5-9a3b-a642dda103c6", "sighting--b7ebc267-2103-4327-b6f2-08d27bb094be", "sighting--02a5fdf2-92b6-45d8-a73d-739cdcfac905", "sighting--c698e39e-f83c-4f48-a67d-f4be2ce6ccd5", "sighting--b97d54a8-ab78-4876-9989-7b6b0e117473", "sighting--c87ce4f5-0fb1-413b-86b8-4cb98c30fdd9", "sighting--7a8c9be5-6b24-4942-931c-0e65d15ee9ab", "sighting--e6942347-7a3e-4ea8-922c-e82a16794b99", "sighting--160c44c7-c357-4ee9-83a6-d54ec36b49e5", "sighting--350e38a3-4f44-4afb-939a-4f8df1cd4e69", "sighting--5a6b5a78-e200-4303-8438-97439feb9323", "sighting--83b34502-80d8-47d6-95e4-3ac6d0efd553", "sighting--0a0355e8-4047-49a2-9310-f1d7e21c2384", "sighting--79fbfa9e-36cf-4ff5-9ddb-d01717a4ed25", "sighting--11307e75-55cb-4bb3-b228-e1031db68abb", "sighting--545802fa-0dde-44b5-b1e4-602d3ceafc59", "sighting--0246975c-34d1-48d3-850c-adb82633b069", "sighting--3f63dfd7-092a-4112-a018-1e898c1d8ab4", "sighting--8afb1305-d6d2-486b-914a-6eb71ff95836", "sighting--486554a1-be85-455e-8e76-1c9e303ff468", "sighting--a2961486-c7ea-477d-b9c3-87e6ec39f22d", "sighting--69787b3e-d1ea-4971-998a-3c33650681c4", "sighting--fc377adb-82c1-478c-a60a-fc2163e8f6d4", "sighting--378514c5-d8ac-4d67-a424-0634127077a3", "sighting--7e9e031a-71b9-4ae3-968e-2b465e2fcdb2", "sighting--ccf5b967-1106-412c-a673-bb9e71be6654", "sighting--38c57151-d9f1-4d53-a0be-3859c59f39a0", "sighting--e9a3e10c-b56a-42d1-9be3-c6d5aeecac72", "sighting--8e1c90a8-44db-4409-8570-a6b13b95f726", "sighting--49bc9d38-fda7-4803-b258-d755ca3ca59e", "sighting--e5cdbd85-0bb6-42bb-a824-83c90952630d", "sighting--803aa51b-894b-4e27-8eb5-24602a428049", "sighting--b2e2c1b4-4b92-473b-a751-3d701875899d", "sighting--329434e0-84eb-4f94-bc72-d1694a656f2f", "sighting--e79a84fe-312c-42cb-961a-470bf448d607", "sighting--38bc419f-fb5a-40a6-a155-e12e3f17e812", "sighting--e4409b7f-b4bb-4b89-abf5-b2849194adef", "sighting--8dec6ee1-8e51-48f1-8696-f08d362e43e4", "sighting--af3925ba-0bcd-43c9-bfa4-96f89aa2ee09", "sighting--ee22c3a9-7c71-41a5-82dd-1b7f96be31fd", "sighting--40cd3c65-457e-4ef9-bd99-35892c68fcde", "sighting--078a947d-7ee5-45d1-99e2-aa7bbf35fe9f", "sighting--72cbf3e6-7e31-4894-b213-f4dc4cd51936", "sighting--8bbdd821-e650-436e-9c58-61a56f913d54", "sighting--c3c55ba8-200a-4962-80d6-2d24b2c3ce2f", "sighting--cf545796-27bd-4876-a1e4-cc5f5f9f9ba5", "sighting--775c9097-c5aa-4303-bc1b-0e0ac4f5f16d", "sighting--c6a149dc-dc02-4225-8453-c9a5863c46ab", "sighting--41007e3c-ae20-4516-be57-a6226bbaec58", "sighting--8c64f457-fc28-4ea8-af2c-86cc2d24c42d", "sighting--e68134f2-f0ec-4f0c-ba91-eb13f8be80bd", "sighting--6167f079-8a1a-4ae8-905d-c5e96118354f", "sighting--74bbce0b-5294-40dc-a53a-04545629ce1f", "sighting--248741e1-f4ac-4bf8-a98f-3c9550e1c71d", "sighting--b79b3baf-2028-4cf4-9344-1082e2a86d31", "sighting--2c230e8f-a4d1-432c-ae3a-7b29dfb76e38", "sighting--6a44d228-3c6e-4686-8d37-d8a4c9133d84", "sighting--64a79d31-5ab3-4fba-be6c-25e008b15ed7", "sighting--69b0ac20-bac5-487a-985b-2b93a1125960", "sighting--118b3682-f66f-406a-8ad8-f0810a480c99", "sighting--d263f0d1-cbe9-483d-83dd-7f2d23c84967", "sighting--2e7b2cae-0011-486a-bd3a-e5ed7e014a42", "sighting--c5e38f59-e25a-4f04-8d87-ee295b5f3307", "sighting--a0c3a670-35e1-45b1-b54c-72ac07a63bcf", "sighting--e51ea2ed-7482-4de3-a55a-6b661873b33b", "sighting--708dee89-20c7-4ff8-a1a8-557fdac92212", "sighting--37a9fb6e-791e-4205-8f1e-c7ace6c50cca", "sighting--f007650c-4f4d-45e4-ae65-95b05304ca6b", "sighting--1885d762-03c0-4a6c-9edd-b6956edcc338", "sighting--79859926-eb68-4965-83cb-b517b4921fac", "sighting--12fc186f-6437-42ad-941c-dc35d345ebb0", "sighting--24c52793-f2b2-4c9c-a3fd-2d3a7405d5b6", "sighting--1f3df9eb-9dfe-4a93-abf5-b81bc77aa0a4", "sighting--590423f7-6090-4f1d-b546-5f79b64d0c30", "sighting--515b2398-f01d-4417-8615-9a5e796da43f", "sighting--af6b9230-a736-4a98-a38a-5f424fd8d3a7", "sighting--090f8355-a93d-4f0c-9d47-5c19a65c238c", "sighting--9062e8f7-f777-4864-9377-1b5ec34bfff8", "sighting--a689b45f-59b3-464f-83cd-5688c5915961", "sighting--76247f07-0f87-45c5-82a7-a60e6a01c95f", "sighting--21827e1f-a891-45fd-af58-1758b23762bf", "sighting--3040b9ab-4191-4208-8bc2-1e2c7f449570", "sighting--311db150-2a0e-4a9c-96a0-7ca82ef45557", "sighting--36e8f73e-f8a4-470d-9c49-f533605861ef", "sighting--9757ca96-88a4-451f-96d5-28672f656383", "sighting--723eb3f2-1dee-4348-a075-99a2519284a7", "sighting--daf435a9-aa9d-499f-911b-cf27d84478c4", "sighting--3727e7c8-6cfc-4a0d-98b7-2004505cff78", "sighting--1515843b-c8a7-41c5-bf36-6c257f46b51b", "sighting--89c46b59-d735-4eb0-8129-b8581162614b", "sighting--b1caa3cc-8a4c-45c6-958f-467f056a3b95", "sighting--569eabfa-06a5-4388-87dd-efd959229458", "sighting--a09b507e-d598-48bf-9038-5d9a765090a8", "sighting--0946f140-7340-4bd8-b20f-340c2023f95f", "sighting--01e3b4c4-bd4c-45b5-ab3c-8f8feecfc1da", "sighting--4625b983-34ce-40c9-92a7-f5d94997e761", "sighting--02d9f200-330d-401e-b4e7-35339df63e77", "sighting--1d1a1d6b-214f-4854-bebc-5014885f8481", "sighting--ce9adcdb-7bd4-46be-b42b-afe7f8c3e078", "sighting--ab11d531-e816-43a7-a29c-dec5de5bb55a", "sighting--01863481-5527-43c7-a458-5f92af4fd659", "sighting--8d522c32-4049-4d44-9755-47f59c1e35e2", "sighting--d8ea70ed-6d0b-4929-abbe-de514d7fafe1", "sighting--781b77b6-d840-4fca-b7f0-d2f9fa36eb74", "sighting--c9882b07-0b40-4fe8-9769-ff361a442994", "sighting--3bc6a5fb-4354-4cae-83d3-ed5bc771d80d", "sighting--1b35e64f-953f-46a2-b339-1db3e66d6aba", "sighting--da6d6e37-28b5-43da-b82f-762c8e433ab0", "sighting--2def2846-5367-4846-9123-e6436e977e21", "sighting--cc5130eb-51f0-4584-919d-f774cd0c817f", "sighting--e93d036c-1fb5-4306-b760-3b8b9ef6af4b", "sighting--e5bd070f-11a6-428f-ad8e-c56429321b2f", "sighting--6b6400ce-65df-4486-9dc5-fa03dad76f21", "sighting--6589c418-819a-4b55-a43f-b242a542f786", "sighting--3e92507e-ac4c-4187-a8e8-6715639b0dd1", "sighting--85e50022-938c-48fa-b470-42caa0d1b7d8", "sighting--c7ab5ebd-8914-4119-99e3-f4954de08a15", "sighting--b84c96ab-2d08-411b-a476-d3c5a15d76ad", "sighting--05bed809-abd0-49c4-8f18-4cc503bd006e", "sighting--63a6f5ac-773f-4f5c-82eb-d6478d4e95cc", "sighting--d299775b-c167-4bb6-9f20-715a776588b5", "sighting--83297ec5-97cd-4da6-b5a9-ed87cd040eed", "sighting--b9281422-ae80-4c5f-9054-1f7302fca9dc", "sighting--e5d7eac2-5990-40fb-8db0-d89cada0ce51", "sighting--821449bc-f51b-426f-a6b1-6cd387f3d809", "sighting--83243961-b295-47ad-ba58-19930a313411", "sighting--37035d3e-72e4-497c-a86a-b5dbc427a3ee", "sighting--414f3965-9f9b-446e-9d29-1dbf41959547", "sighting--7559f6fe-4359-4c0e-9a6a-155afff4047d", "sighting--63b2b7b1-26c7-41b6-95b9-8efb68c54eb3", "sighting--11991854-2fa6-4576-b8a6-ed9835b76a5e", "sighting--1d3d7a8f-5503-497f-b8bd-937663c7e439", "sighting--89cf2c05-29d9-421e-a40a-2f19a48cc876", "sighting--433cd97f-0b86-491d-b233-7648e95b2897", "sighting--91c6fa24-0467-46f3-9d28-dcecf81d01a3", "sighting--44851fe3-aee2-4d0b-adac-da82d303e6b3", "sighting--84271dda-040c-48e6-8e2e-890ccd9544ad", "sighting--4b01b44e-4335-44ac-8836-bbc4847c01ac", "sighting--d92e1936-3389-41ce-b01d-2b118138743d", "sighting--003ff7ed-1538-483c-a2e2-b5621875ea21", "sighting--f0ffc30d-8ccd-4478-a525-4dcac6c17184", "sighting--164d9fe3-9b42-400b-9441-38fe2ee787b6", "sighting--663ce199-18cb-47a4-99b8-893aa47e56b6", "sighting--aa88adb3-3487-4d2a-a526-ec1788446e08", "sighting--80e0a5ef-e827-4d24-95e8-8f989121fc22", "sighting--bb5b0b91-96cb-4a55-976f-f4b53bc13554", "sighting--c7b3302a-90c6-4da2-ad5c-1c80283eb607", "sighting--cb6fa3c2-d63c-40ef-8ab4-0aa8b4cf3b1e", "sighting--c04c6090-ad66-4671-ae4a-89073538957e", "sighting--191eceb1-aeda-42f7-b291-3932fddd274f", "sighting--722481c7-d9f6-4dfb-bfdd-3f42d5b2b269", "sighting--96dd6117-e83d-44f5-94b6-ad86a1ec840e", "sighting--ab46afe3-96bd-40e9-b870-1353e413c989", "sighting--eb80c90c-4e40-474e-9a58-5178a5cd5f0b", "sighting--d815611a-87d2-4670-85d3-f266bbfdcfe3", "sighting--371f5bea-45f6-4e86-8b9f-a16d49b38e27", "sighting--6d9228a7-cd0c-4767-b8a0-685dd028482c", "sighting--16249967-39eb-4edf-bf29-d34f84ccdb05", "sighting--13077277-1b65-41a7-9bb0-06807a8acd70", "sighting--fa870000-8a27-4f78-a371-c4875940b38d", "sighting--7e60045d-521f-4182-9f5d-0d9cb3602647", "sighting--b2c1202f-b2bc-4edb-91ca-bbb9ba6ff912", "sighting--9b9834dd-aee0-4fc8-8382-4132fb367643", "sighting--5b9d61fb-8fa8-4c66-a785-2238c65fde57", "sighting--31c665a0-db4f-406f-8639-f0ce5b701684", "sighting--5d09c651-ea38-4ed9-97f3-5c6b624ac4d7", "sighting--99b00551-ec16-4f09-8d89-11746e1f1a22", "sighting--874aae0b-8353-4ebd-b048-1ee77688382c", "sighting--3a948ad5-44ee-426b-891c-9a1a9917c4c9", "sighting--adc4536c-c36e-4cc8-8932-a0ed41e5c159", "sighting--36d8326a-a2f1-4c87-9922-d8632188ff62", "sighting--9ff8a3ba-05bb-4a97-b24c-8221a6133399", "sighting--75f88bc2-f75d-48ff-b309-eae102e5ac1a", "sighting--3d040ff7-2c8a-43f7-b531-88c2f1ab1bd8", "sighting--a3dde0b2-e037-488b-bd76-6a3093003560", "sighting--9b97eb44-dab4-48d7-a08f-dbb0bb16f17d", "sighting--3a74c2bd-cacc-4206-b2ef-f11f09c79816", "sighting--c21b807a-6928-4bc0-81cc-d3182ac46e18", "sighting--0c74f500-63bc-4fc6-88b0-202ab90bda71", "sighting--9b07ae55-4198-46f8-bf4b-37146596b41b", "sighting--4ae4a667-0769-4a27-ad31-28bce29b5d41", "sighting--49d4dcac-a5fe-46a1-ac1a-fc98c1123be6", "sighting--26164046-0d64-4528-8220-4c8dfd6b6740", "sighting--a7bd4c2a-941c-4bdd-9725-19bf71f2dd40", "sighting--a78b1cac-344f-4d65-97d3-32a853de5791", "sighting--1d91c061-9a39-44cf-a7f9-0cef25b84ce6", "sighting--f84a49e6-9769-49d7-8287-d7f93800936a", "sighting--7aad4b87-40e5-4d9e-9fac-858dde1b0e18", "sighting--6aeabcd1-03a2-4e2c-881c-950aa647ab70", "sighting--92073069-c017-4533-8327-cee1d917d0be", "sighting--ddd2c7c5-c5ea-4a21-a135-cd9bc101d12c", "sighting--d2778936-750d-461f-9a12-a24847a0487b", "sighting--405a6ac4-a949-47b2-a84a-a266e1d59d85", "sighting--d5bd56ed-7673-42a5-849e-8e63666dc6b3", "sighting--82d59a3a-9feb-4980-bd67-c2e3c09ecfe8", "sighting--cca8e932-f8c7-4929-94a0-c200d8051388", "sighting--b7fa5077-a5b2-4379-8f88-31e030bc208d", "sighting--76db2c03-0dc8-431d-8303-094e153bf734", "sighting--93bf6619-601e-43b1-9809-7f04cbfab69c", "sighting--6316a8e3-908e-4750-b617-5c97d3ff3323", "sighting--38992810-483a-4c38-a5b5-7f091cd18da6", "sighting--c4fdb1d6-202c-4ded-89ef-8452728f2d2f", "sighting--41c324ed-30ed-4797-a7a5-780bf9c362ab", "sighting--c1f5b783-60c1-4911-8286-3eaae12b10ee", "sighting--81cca8bf-7971-45b1-9f88-c3f9c90d5e70", "sighting--380f6cd6-8755-47af-a2b5-7a53759cb28b", "sighting--4e423b45-ec68-4cb0-a7d5-94837d02ac46", "sighting--68f19316-5635-445a-ad2a-c598f456ab14", "sighting--89b384f5-e308-4d13-9d2a-a184d6bfb8f7", "sighting--37d176a9-5ec7-4060-9183-0913b74cf427", "sighting--f96a8f17-746b-4bdf-8c0a-fb08e3da1749", "sighting--01d15955-6874-4aac-b98b-a4bcaf1aec3a", "sighting--ff42d978-dacd-4abd-aae0-5ee1d9ecef6e", "sighting--bd23133c-9dbc-425d-9645-1b56adf16aef", "sighting--fb47af6e-35b2-496c-a193-854b9ede8ec5", "sighting--a238301b-0bc7-4fc3-a0bf-e541083db609", "sighting--b5b849c1-121c-4d96-92d5-f45951565f82", "sighting--153c8356-7ee2-4f7b-999c-645569241bae", "sighting--fea68840-e32c-4a1c-be3a-6911d74afa8f", "sighting--e4af6e00-21bf-40c6-aa36-bf18d0d6cffa", "sighting--5b80928c-8c1e-448a-8abd-8adf8d18df06", "sighting--b9a82f4c-b781-44d6-af9b-06d0c38e2bb5", "sighting--822b8448-024b-4a00-b5c7-887e32b8e3f6", "sighting--1afdec45-888e-4640-8586-c7bda08eeae1", "sighting--de230174-ca84-4f39-bed4-401305f2f5a7", "sighting--17a9bd4d-2191-4066-b1fc-844e165ad98b", "sighting--4101fcdf-ca80-4f00-bfd7-223463aa767d", "sighting--6d8bea0e-9af9-470d-83da-acc1168add85", "sighting--0220c98a-8f27-49e4-b1b5-43bf0edbc150", "sighting--c33b3e6e-9c41-4fcf-93c9-0e1ca52089db", "sighting--b3748004-8b51-44dd-95ba-4ad234fd025f", "sighting--4fed5154-2ad3-4b47-94f5-f05ea7e44227", "sighting--73b7acc7-fe75-4fa7-9f0f-89adac1e3ac2", "sighting--6f285b65-9bab-43ff-96d6-62e29fe04cfd", "sighting--befdb93e-a476-4903-9989-fd686c2b57ea", "sighting--a0485167-68d7-4fb7-afc6-861ff2bbc5ff", "sighting--0c6b8ac8-c113-481f-ba9b-8cb2e0af2cc9", "sighting--d5dee0b7-ad1d-41a7-bd2b-3cb4203c5799", "sighting--2a6d86c2-7904-4c9f-ad58-037e2421cfca", "sighting--51994592-def7-42ef-9c74-8a72d89ef709", "sighting--4e2e1353-2375-47d1-8520-30d18d77b792", "sighting--f3ec50b2-af92-48c7-b018-f59649093854", "sighting--0cc4a3b9-76ec-475c-a713-aaa6a6e0f6be", "sighting--862386d2-66f6-4f18-a322-e87965581200", "sighting--84c8226b-3d90-4cc0-9046-137213083fc5", "sighting--c583fb3c-8f38-46cb-b7cb-cc9e11ab96b4", "sighting--a06b9d49-63dd-4d5a-9e4a-7abd8246b3cf", "sighting--4cbc41f6-37f3-4d4c-84f0-286482fb7789", "sighting--b00a1839-631a-47de-bc82-76beff128262", "sighting--5039a096-b17a-4c19-b081-72791ec2994c", "sighting--c16e9095-e432-4e50-96d5-7c1b180f4057", "sighting--5957d20f-6a25-40ed-8b5f-98d0ae2b664a", "sighting--048d293a-3459-40bd-bb8c-eb7b6a94a506", "sighting--164c5e5f-8cec-436f-9586-a0a246108c52", "sighting--3a9fb05c-61ef-4491-9868-6d765922b2b7", "sighting--4a59b5bc-561d-49c7-858f-d46598b90ead", "sighting--5e2eba43-78e8-438e-8581-6dcad395ec7e", "sighting--1dea294a-a8cc-4402-b936-1a3e67a70116", "sighting--3fe44f0c-a2a5-4c5d-bb1e-30c8519e3ea5", "sighting--34bfa5bc-450b-4785-980f-23ca24cc8312", "sighting--247322d4-1ebd-48c9-8493-285de9f5273d", "sighting--bcdd5f3d-1b80-4c4b-8f7a-675818ea90c5", "sighting--2def63d6-a8eb-4ba3-abf0-18c97b4b77cb", "sighting--9a6022f4-c526-40ee-80d9-807991e0732f", "sighting--6c12feeb-23ff-4d97-b8e1-7a8558523174", "sighting--dad21584-c346-4a6f-8e3b-62d524c8ab76", "sighting--0b0988d8-d240-4dbc-8110-2926cfa0bac6", "sighting--df29fc65-a1c9-4172-8033-0dd9bb7ec4c3", "sighting--f0e852b6-97fb-4d79-bdde-0c9d69be2274", "sighting--7f93bbf5-5178-478a-905d-3c2a0fb15bdb", "sighting--b5c6d33d-6990-4d21-9418-49d7f341300c", "sighting--3066392b-1773-42a8-8b9b-340cf96cc28f", "sighting--48462a3b-5fce-4a94-92dc-f3f4375e5165", "sighting--4f2de9e9-7a55-47cd-bf10-358e27ab6a7d", "sighting--48999ded-089b-4d18-be84-17752a8494c0", "sighting--3b4751f0-a792-4682-b755-dec4fc264e13", "sighting--58852405-f5c5-4627-9043-a860297f5281", "sighting--69343507-7f58-4696-8469-94608671a499", "sighting--fc0c1a9d-899e-49a8-9a74-c000c2d526e0", "sighting--6470cebc-0869-45d9-ab22-13d22230a15b", "sighting--f609dfc2-ef73-4213-b211-d6a642989a81", "sighting--0da40a47-69ea-4ec6-9b0a-0c06786675f5", "sighting--d1d533f0-3f57-4456-8536-4d214b3e74cd", "sighting--2468c7b8-7de5-4baa-8e7d-5f9b8756c901", "sighting--d44194db-41e7-46e4-9d00-3a9cbeb6982c", "sighting--1ffebfc9-0ce0-4cd0-b202-92b8fe705f57", "sighting--d06bd047-ecbf-4311-b8b0-240a49fb07d3", "sighting--0b9f1883-7955-4a02-ac8e-7bb5e51db3b8", "sighting--9425fcbf-a44d-4724-b3b4-4ad0d4887e1c", "sighting--d6dd2cb6-8ffe-4956-a69e-2fb4ca412236", "sighting--28f3f949-e8ca-435e-84ea-518f61e01360", "sighting--8a6566bb-3fc0-4d2e-a9be-3bb77913fb92", "sighting--ce4e8d93-4745-4f31-bbec-ca49b72eb99f", "sighting--f00e36d5-fc80-4982-8558-b6d945b19b9c", "sighting--775ee130-c755-40ee-b90b-ab69f1df1611", "sighting--829d1f24-6853-4d2f-9e80-8f5e93a2b4f1", "sighting--6d27a788-8b54-465b-83df-6388e8fd5a02", "sighting--15106740-2f14-407e-8af6-1204c23264d0", "sighting--a49c97ac-0d05-4a82-a2f6-d6894cab42c9", "sighting--5084a557-c58a-44d5-ad51-908999ddfd43", "sighting--396f095a-a346-471a-8952-b1900f9bcd1c", "sighting--8b418c6d-ea29-4152-8133-c81a0b3915d0", "sighting--67416a33-9cb3-451a-a02d-d4176e4f55e8", "sighting--0a895fe4-63ed-4f32-8721-e3c5b65af94f", "sighting--2ed0a70f-5d4f-4b90-b5c1-13300cf088da", "sighting--4d6dd9f4-b405-464d-be3b-8258340510f8", "sighting--20636883-18e2-49fa-acdb-cd0654e105af", "sighting--9311de55-2783-42d8-92e1-c9a2a9a9d2b4", "sighting--699e565f-a99e-4ccb-8add-1d137a87145f", "sighting--d57c8c4a-8bfb-45bd-8ac2-7b6aa35b24d8", "sighting--339e2550-dde0-45c1-8dfb-d3b63ca8c9a9", "sighting--e0ae9c7a-eded-4622-9ac1-d058c1407c5d", "sighting--3769d563-20f4-465e-975e-843eadc2772b", "sighting--6b2e7076-1c9f-4403-8583-167ff36ae470", "sighting--d852e260-a6f6-4730-b58c-c61470aa059f", "sighting--d38482ae-49b4-4e9a-98a2-26115c88cc40", "sighting--edc56c0f-526c-4f9f-9f34-66e418744315", "sighting--260f084d-cd29-47e7-af7b-fc29bfb61de7", "sighting--488b7498-9e01-4ae1-b08d-65bbc2a26e8e", "sighting--b43b2563-3b00-4f14-abb7-60c66702ff12", "sighting--5a1864b9-d1e7-4fee-b588-8756d8720789", "sighting--96154b09-1611-4919-a0da-aa55bb882507", "sighting--5b080903-c36d-4388-819e-8d9ae5c5ecec", "sighting--aa5ab18e-0cf1-4f36-ba11-06f8ea972597", "sighting--36ff7555-0098-4f70-a780-3d7e5a590aff", "sighting--7df06791-6dfc-42a3-9b11-c2ffc353b020", "sighting--e5c354fb-91ac-482d-802a-7dfd39778275", "sighting--c98df40d-c4af-45d4-bdfd-aa693879ce94", "sighting--995e3a6c-5ee4-443b-9b44-ec0f174224e5", "sighting--82b637f9-2d05-4d90-b97e-d35d339c5c95", "sighting--5d91fa26-3f2f-47fe-a3b0-3debf2b234b2", "sighting--967977a9-3e06-463d-a6a6-2ddeef8a9cb9", "sighting--4818cf9b-a017-4e57-b17d-c4f5c667d7ed", "sighting--87d4542d-d9fb-4eb4-90cc-f5c25608b0bb", "sighting--73833308-9383-4a81-8b06-728ad9f43c95", "sighting--eec3c933-51dc-46d4-836c-e8af2339bd1b", "sighting--096d19e3-3e77-45f2-9247-f5c20fa6070d", "sighting--c4cd8601-24e5-4094-8277-af1b2debeeae", "sighting--64083c02-88a1-43b4-a12f-b987c519e6bd", "sighting--0af061cc-e664-41ff-82eb-e31160f5257d", "sighting--b27e332f-7536-4540-9c57-841270c3c287", "sighting--5615fb07-31dd-4cf9-94a6-d630f6cd2255", "sighting--6850afdc-9188-4d0d-a0f9-0262bec2e7de", "sighting--d124e707-ca8d-47b2-8465-d7acd41190a7", "sighting--2eae2906-5c76-48c4-8ef9-5c711cc4e886", "sighting--ec32fb2d-345a-4e05-88d8-007e41b05877", "sighting--fdcda2b6-1eab-4dd3-ab50-5ba7b06ddd21", "sighting--7324e806-f53f-4cc0-9f72-3948a24ac04f", "sighting--6995224e-4b7d-4e9a-844f-a0aef1501a20", "sighting--75cd2b0e-9c67-4b7b-afad-cb42bca363b8", "sighting--da6cb7f4-26c3-435d-9710-dceff9330f2e", "sighting--42dc72e4-3635-467f-bb11-ea474d4075d1", "sighting--d354b824-9cef-4fed-a4e3-0fd4e2de3017", "sighting--bf506bcc-604c-4d93-a3ca-c2b9fe366155", "sighting--32928d22-34a8-4367-8a73-5899e95866a2", "sighting--08abb5a1-a069-4674-9644-a3d469c4ab6f", "sighting--1325576f-e86e-4fb0-b1b6-c11babc68df4", "sighting--3f382bf6-659e-406a-bcf4-7234fa9b6be7", "sighting--7e24053c-1ab1-47fc-a44a-7ebfc2f984e6", "sighting--88b93dea-9519-4596-be0a-324fe4b15436", "sighting--77156f68-ca7c-445e-a5b7-2bde54831b59", "sighting--ad75f14b-6286-440e-96c8-56ffaad014c9", "sighting--e465c879-2988-44c8-ab18-9a8c03956c4c", "sighting--4e73c5c8-f252-4f6b-9415-41748d1dc585", "sighting--67c1c70a-803b-47c4-aa68-7fbb1b1f4002", "sighting--02c1d89c-c5b7-4a81-a9be-08fa64ce46ea", "sighting--5ab48317-675e-40f6-be96-45658cc088f1", "sighting--cb306a0c-365b-4f50-9861-beb02c3850de", "sighting--36bfb39d-e119-4730-842b-4756327ebd1a", "sighting--517d2624-7ba5-47d8-848d-42a30e980aaf", "sighting--17fb3a54-5936-4995-b917-ffad5d21fa61", "sighting--0d1d86d4-fc03-4d8a-8175-6c088d542191", "sighting--97fb9057-45e5-4ac3-aa98-8e887ff423e2", "sighting--2be9de54-2197-4d4b-84a0-e625adafbd1d", "sighting--5433d727-8453-4a33-bfd0-06962618d905", "sighting--ce1b6ad0-db6a-412d-a3a5-e813106e1f59", "sighting--0e0b0c8c-a151-4ea2-99b1-ba22510c076e", "sighting--917d6867-ac69-4795-a0c9-ed837ef4e158", "sighting--0b22e208-221a-4b69-ba50-bf14e2eb909f", "sighting--019f532d-e5e6-4000-88d2-60912b7c703d", "sighting--82ec01b2-6386-4a96-891e-bf3152386ec1", "sighting--4c21c7c9-94f8-4e23-b868-53aaa594d5e3", "sighting--4ec95b0d-6f23-456e-aa7f-162413b88515", "sighting--99a5f184-e8ca-40ff-96fe-daf0da475ba5", "sighting--c073f22a-82bd-4924-87e5-b6763c47973c", "sighting--979e2484-03d4-4668-972b-2f201f4f5079", "sighting--f3528ebd-b8ea-4e55-af7b-6a4ce342037a", "sighting--02281f23-63da-408b-903a-b87af846469c", "sighting--77f4663b-9f08-4892-b0f0-0bb4a8e33063", "sighting--6366dfc6-f4b4-4c4a-8191-c6d8bdbe6de7", "sighting--1e1fc997-bb53-4fb7-a89e-5638785a0c0f", "sighting--92599651-3046-4c4a-aaa0-34fae1bcc405", "sighting--e3d24cd8-7c59-43e5-b47e-357cf9c249aa", "sighting--755901dd-1971-457c-a25a-732deeb46090", "sighting--edeaddf3-2485-45a8-964b-281936bcec7c", "sighting--5ab5b462-5c70-4900-98e4-a92da0a44a6e", "sighting--16c345fa-3fc2-42ef-82e4-dc635e42df8b", "sighting--5f4ebc6c-768c-4b66-802a-1e50a1eeca03", "sighting--c5628c00-e661-4c95-882c-ae044e8fc3b8", "sighting--e9cb58c2-9f88-4a27-ab6f-fde656b517f1", "sighting--30981a24-074b-431c-b862-e16861f739cc", "sighting--82caa482-c093-499a-8cf2-bc9da50c6867", "sighting--76a08937-a362-40d8-91e7-98d908fbcdb4", "sighting--c36638d9-7cb4-4524-9523-c6a56d696517", "sighting--90a94b09-a229-4777-a063-298d619ac6ee", "sighting--a18495db-9e7c-4eff-b298-b385ead741ce", "sighting--90d8934f-77de-46a0-a0c7-d7d283bc1b1d", "sighting--158dee6d-1a4f-4f2d-b5cf-7e448e417b51", "sighting--c3822403-93b1-4483-9ec5-f22587a91cc3", "sighting--0f934d85-a8a6-4ddc-8f17-328630fe2cb7", "sighting--cd7506a0-72fc-4a6a-bd28-32cf2c3beb6d", "sighting--fda02461-39e0-4ea3-9765-f494e3e6b471", "sighting--b2b704c8-b572-4205-a279-33ef731c9388", "sighting--f43bde5e-92ba-4ed0-affd-e442703d9c26", "sighting--01219461-6952-4c16-8344-933577b85aa7", "sighting--a2d99472-da29-40c6-809c-cb742eff67d5", "sighting--9e1358be-5003-4352-9961-f900e2af7fa3", "sighting--1024291a-0677-42b0-8c39-063447b54835", "sighting--151c5d8e-a12b-4106-9a4e-e4fbf96b4146", "sighting--8de44f68-19f9-4a92-9f5a-d1c537a0bd13", "sighting--74cdd0c3-2e61-47c7-88c5-d41e94e612c4", "sighting--bfee0c42-388d-495a-8c04-3d56cf67b1cf", "sighting--521fb539-82e6-403c-9db1-79740f166687", "sighting--c9bf10fc-d06b-4a8b-bbbd-6c4bca6c2726", "sighting--cddd9b8d-2906-49fb-b0c2-54940536f517", "sighting--0b7ba04b-f406-402a-b54c-f21e6a8dab36", "sighting--714f036f-87e6-410a-a16f-7eeac7fa2d0b", "sighting--c07d3b4f-5d32-4249-9ee5-8a4b72416790", "sighting--dec9b557-154b-4167-a408-f4611232aeca", "sighting--0003d35e-9be0-4225-8fda-8db5d5360d59", "sighting--2119f2db-1c1b-4551-8c51-c1d4e1b46b75", "sighting--28880348-0a6c-481c-af19-a97f7fa47e05", "sighting--35d6dbaf-4e91-4e6c-ad05-724154574cdb", "sighting--bca91383-7e68-467e-b887-2fd91672869f", "sighting--8d73a1ff-d171-464b-af2e-5fb105206216", "sighting--6393f9b9-59d6-47cb-909b-c7b5141f5d41", "sighting--b8ef510e-f361-4003-9e47-9e3653954dcb", "sighting--187fa1e3-039c-4fb3-bf65-5cb76b0c4598", "sighting--f52f0028-7ef1-464c-a70c-d3d6c5accaa3", "sighting--035b9516-4a38-45ba-a4c6-42a2d1f0fb73", "sighting--a16d75bb-64cc-478c-841e-594cb3ad3f32", "sighting--52644d04-d877-4be4-a688-85ba32f54c6d", "sighting--69419cde-72cb-464a-81a4-8696f83dff3b", "sighting--69bc7ea1-cd66-48b4-9cf3-7fd92a426007", "sighting--cec7ca5c-feee-4088-a537-c442a35a8902", "sighting--80c01983-3d95-4710-8a01-8e7878a264cb", "sighting--bce96f32-5a3d-481d-9edd-78114c5fa171", "sighting--affa4307-4355-4737-bb6a-f29383bf938d", "sighting--786cef2a-3b5d-4792-99c2-4e16e8620cd4", "sighting--2215f28c-c2c9-4fea-a79b-baf35c368f26", "sighting--8b2e1244-4f5f-4215-a438-b0701c5f45f4", "sighting--e32e4f5a-34ea-45ba-ad92-437dfa1bf7cd", "sighting--8ea197ff-eae2-4a67-ae60-ab8cd7c29a0f", "sighting--c6c37e0f-19dd-4315-8ac5-490ec86484c5", "sighting--e784a530-a16e-4e81-b13e-dd215057a0ee", "sighting--c0d5943b-3059-401c-ba7c-ada7947f1725", "sighting--a347cf68-4bd5-494e-ae82-7fc15b4155b1", "sighting--f173f6c0-b3d4-4806-a0d4-ce5f7b481559", "sighting--11e824d6-56e0-4b50-9128-f678ca0624d3", "sighting--82974427-1639-4d76-8d7b-cda3fae3ae32", "sighting--3d89e720-1147-4a34-badc-52afe5fa3bde", "sighting--02898bd1-120d-494d-849c-ee1c94b134c7", "sighting--c98b6f27-45ac-4bdc-b67b-4fd81777b123", "sighting--ab2f8198-eec6-489e-83a1-7c0b678f6cc7", "sighting--45709f17-74bb-47ea-a722-27fa4af9d5a8", "sighting--483445a0-b5ef-485b-a936-9d6c51db3e51", "sighting--6fab0732-538e-45a9-849e-ff4010d1999c", "sighting--8fd269a5-8679-4ae5-af07-a0871c882657", "sighting--4852b78e-399e-4d7f-abf3-6b476a82836f", "sighting--4f0553d7-f993-4977-8712-2369c464921a", "sighting--496683fc-412b-43a4-98db-718d543db7e3", "sighting--a0cfea2d-e8aa-415c-bd94-9edd01f92d16", "sighting--70709c41-3e0f-4ca0-b160-6699d3a8a84d", "sighting--e281df40-790c-49fa-8f8f-41a0c7b5ea29", "sighting--111b6350-a68c-43fc-9d4d-ce47e3d6f313", "sighting--0094b499-625f-4b22-83d4-3b49adfc5404", "sighting--3d929e12-6f61-4b69-9899-cecec6b8e06a", "sighting--d223d287-3578-4006-b5fa-ab09ae4b035d", "sighting--0471c20e-504c-4699-b184-104b96011e8f", "sighting--d04105fc-5893-40f0-840d-9efb10006ac9", "sighting--a75035f8-4db4-4a3e-8be7-e1fc2bea4fa7", "sighting--704ebcdf-fb7e-48ae-a8b0-1df563c641fe", "sighting--9853c74c-1b9d-4b3b-8780-491859fc510e", "sighting--08fbddf6-0b1c-420f-a344-bc2cbc417e45", "sighting--e543f7a1-6fd3-4979-a94b-f4fd6c75c320", "sighting--4148824b-f174-46a9-ad20-366a3ed301b9", "sighting--692231e4-db48-41cf-bcb4-c49482962314", "sighting--8bb11339-f32e-4015-b8f6-875f13ccd69a", "sighting--93db2bf2-9b43-46d4-a6f3-57b67ba997f0", "sighting--c85e8078-c953-4d09-9f2f-0893b1ce479e", "sighting--068c63cd-88fd-4d86-ab57-b6c4a3b04eef", "sighting--f5eca77d-b037-4e43-a6de-60e0fe6685fa", "sighting--482d8a07-1837-489d-83c5-73a812bcf4be", "sighting--86daeb2d-179a-448d-ad67-58abfa6e452b", "sighting--e27d3e0a-501a-4947-958f-0a41ba6bb442", "sighting--b35a477d-f2b7-4247-9eb8-426b337f95bc", "sighting--b7d0592c-49a2-41ed-91d9-351453ae28da", "sighting--7f017e3e-b2ab-4000-aaa5-386470297d79", "sighting--07409c72-41ea-43bb-8a23-32935f93073e", "sighting--b233a2e2-51e3-44ec-bcd6-7578e9f2f5e0", "sighting--08674254-e328-4a33-9108-428bf56785c2", "sighting--b345030a-03bd-4530-a752-910351a1e898", "sighting--865f2d67-7082-4912-bc95-ee8d539ae91a", "sighting--6318f4b3-19f2-45eb-87e1-28414e3fadd5", "sighting--e81696da-41ed-4c68-8fc1-4d39b3683a6c", "sighting--42b0fd65-06b7-4fa5-9ed5-2a74045e7cd2", "sighting--4ea7cefc-e801-43d7-ab41-a5f43f84f73f", "sighting--3a1bef6d-4a0c-4317-bbd3-b60f84129e09", "sighting--61be2f87-377f-456c-b617-e7e090448054", "sighting--8dc27dad-9839-48c9-ad43-afbc4b5e8f48", "sighting--c5f06a6f-d8ba-4a4a-9efd-1c105c7faecf", "sighting--2af66b78-e854-4e9b-8aa2-b720a99f3e3f", "sighting--7fcd66d0-7b8b-4895-b36e-6e78c36f82fb", "sighting--ad0eba2e-31d9-4637-8d76-2f330a94fbdb", "sighting--5b05f7b5-af3e-4287-9c4f-721b75af0251", "sighting--6c777df1-7f3d-460f-a01a-5cc69cf39944", "sighting--4dd19cde-0925-423e-8693-b7a71a85beab", "sighting--08c3da0c-2f69-407f-a00a-7519c3a311d8", "sighting--4dab27fc-1cb5-44b0-9be6-fb5c5fe5864a", "sighting--b3daf3f7-6501-4b4a-be67-922bac6aa91a", "sighting--5a86e4a0-79e4-4cc2-9498-53a257f7ed67", "sighting--0d6543f5-0ff8-4931-b818-4d2433794845", "sighting--d500f4bd-44b6-48c8-ba20-77424e80bc45", "sighting--2cefd432-f6a9-405a-a46d-2cdc7b7fd6b0", "sighting--f1029dc2-92b6-49ff-bc63-7dcf27b9946e", "sighting--19d57fc3-176d-4cee-b3f6-e4be38672495", "sighting--f4545794-cff6-4390-9b43-a1c07df95faf", "sighting--a9e8daa1-f8fa-4c59-ace6-34f844367055", "sighting--a230922e-bc52-4625-8ca7-f4985634e2f7", "sighting--2ded480a-ae3d-497a-8c8e-dc508e407d72", "sighting--c8eba166-5f0a-4315-804d-508784cba36d", "sighting--e733f52b-c732-4737-8cc1-6487bc3687d4", "sighting--23009ee8-2d88-4d97-9241-281016779d4f", "sighting--3196dbe1-0f79-406c-9886-8971e262b38a", "sighting--e4c7c05f-16df-40d6-9048-70b6b5f09e41", "sighting--b0b157b5-7dfe-4448-acf6-823744cde453", "sighting--c622c7d5-0001-4acc-835f-a019c9446919", "sighting--ede1e5b2-1ecf-451a-a508-6f511e71aaa3", "sighting--116135d1-fbb7-48da-aaf1-0094920f4aff", "sighting--656712c1-fa73-49f8-b4d3-892a3f2af0a2", "sighting--8751917d-9b52-48ea-b053-bda112aba86b", "sighting--5c31487a-7235-40cb-a4f6-0aacddc2ab04", "sighting--b310b874-fb1b-4b42-a90a-60a98eaf98dc", "sighting--f16dba48-d42a-4048-ac93-64bc946264c8", "sighting--47106154-5b43-467e-be64-3cee053e5cb3", "sighting--e30b5478-f294-4a99-b41e-f53e2acd24fd", "sighting--d6234e31-1d4f-4da6-b765-712a9d2b02db", "sighting--d66f0159-33ff-4105-a092-74dfb0f5b896", "sighting--c63a337a-619a-46d5-83c1-2d6f805b1de7", "sighting--42080eb6-aaeb-4c8a-8729-b7ba66da9912", "sighting--c7064525-5dd0-4431-aa57-0533e236d487", "sighting--78429d9b-3739-493a-8655-8fc31ab87230", "sighting--e25f5f05-ce75-4dda-9d81-efe919d09a8b", "sighting--a5c2e6bb-dc8e-4977-a375-3c4c1e27bcd5", "sighting--1795b516-a780-436d-8cda-0218980468be", "sighting--67d6a24e-639c-4422-b3a6-e35202cd4a2d", "sighting--6c1ce5ce-6b14-4ce6-8b15-85d18142b773", "sighting--f08bafad-4aff-4a66-87d9-63d5aadc9a24", "sighting--d209c8b8-5da9-4ca4-9328-becd0bf44fe8", "sighting--fde7a42b-fd82-4bd7-8113-66c5b24472cd", "sighting--3d5e855f-1929-4f55-9246-55ef171cad2f", "sighting--ccb8c3b8-b45a-466f-a3bd-e6be12093f4a", "sighting--3ea993e7-f2b7-4488-b39f-aefe0ab21ba2", "sighting--a82c149a-39a4-456c-b607-3b41d7054d12", "sighting--f531439d-4e56-4d14-9e89-c25ca1fe1e56", "sighting--08e691b1-c303-45f3-abd1-008573f9b1aa", "sighting--21ad3940-5cdb-4f0f-824e-4f3e86743eb2", "sighting--e17940e0-1c86-4a36-8b23-b72d3da74acc", "sighting--66c0bf5c-5e64-4e58-a096-cf73a2f9dca7", "sighting--f5973ebf-11c0-418a-979e-016ac6e14c61", "sighting--d9034e9b-46da-42f1-87ac-fe2fed71f96a", "sighting--cb5cb7eb-bfec-4068-bd20-42e725a25d75", "sighting--4e0c97fc-cfab-410d-a8b6-35446adfab2e", "sighting--ea69db63-3978-405a-af63-6eabb2cc54cd", "sighting--1a9146bd-d291-43ed-b3e3-666363ed16de", "sighting--b546a3b9-1d5e-46ce-9fe9-4b8255e9b64a", "sighting--a7791a78-ef24-44e2-9bbd-5774e0ac21ba", "sighting--134cb20c-568a-4bd1-ae5a-c641003e9b70", "sighting--733700f6-6dae-4cbd-bc4d-8cd83875f091", "sighting--c8ded298-e382-4acf-8404-4e2a9b680544", "sighting--327ec166-76d8-402b-ad18-14b59b4d4258", "sighting--efd8762a-f624-46aa-8a8a-b68cf85d206e", "sighting--ad4c5222-d747-41f6-9167-747a8b69d9e4", "sighting--e1fa4a73-a073-4f16-a5ee-56a815a21867", "sighting--19dbc800-52d2-40cb-9b7d-1260b68687c5", "sighting--c0eeb99b-5044-451e-a556-e505a297ae4b", "sighting--e0e251bc-2d92-4251-81fa-9e675b574074", "sighting--1aa81ab7-829b-428a-8512-f6e341dc511a", "sighting--ea6f6715-c937-450a-958b-7dd129963f01", "sighting--020d56d1-3f34-4c48-aabd-22c22325d498", "sighting--854bcf17-d4f3-400f-8393-b8d6fff6f676", "sighting--4515de02-6e79-4821-aac0-44c9696e3f73", "sighting--ea0eb4fe-6e60-40e2-9e83-ceac23604c03", "sighting--b63e007c-d060-4d64-93a9-f17e89d43d83", "sighting--79e98850-a5d0-4906-89d4-a752ab451c8f", "sighting--893226d3-261e-4e79-8846-cb248cf1311e", "sighting--d5090159-b9cc-48ed-95dc-39ac137f7258", "sighting--51535bb2-dc41-4a9f-a4c3-4c237f8ef268", "sighting--235baf08-e8b0-4ec9-af19-7481201e75d5", "sighting--73f18b59-084b-467d-be4f-4fd44f410020", "sighting--f6958f79-a2ee-4f01-ba96-624cacebc839", "sighting--094c7585-1463-44e6-be67-7eb8ca984fee", "sighting--29b4b086-d76a-4aaa-bf61-ff99f17ee1e1", "sighting--64cee849-9b09-4342-ab5d-9e0bfadc3913", "sighting--b8345f9b-2bb2-452d-8f28-777da7d5e6f6", "sighting--1c82b6ee-101a-40f7-bade-1dc9f83460a4", "sighting--510110ea-720c-4af7-bc6b-0e12f68d90f4", "sighting--d14f0e4c-b453-40a1-bd2e-507f2e0a8eb6", "sighting--7b553ba8-9cd2-466a-a105-06cbd51da150", "sighting--a9731d05-b7ae-42e4-b2fb-1d15efeb196a", "sighting--a12da869-f8a3-4a77-b9fd-a7109aa7bf5f", "sighting--e6ea1970-9e7f-40d0-8dcb-b31faf2672e5", "sighting--d3372ae3-4e6c-4eae-a694-f733087ab9af", "sighting--f1fc5c43-cb3b-4716-ae42-869ad53d8441", "sighting--bef934b3-da39-46cd-b1fb-ae9d78a813a7", "sighting--69774b2f-aca8-4edb-bb1f-06e15f9af0b5", "sighting--518232c1-3908-44d9-8b7a-026f22d86b96", "sighting--af34bd45-4fcf-4998-913b-1bd6c1cd7278", "sighting--e0cffb04-45ab-4a52-b0a2-e0ca978ccf90", "sighting--69ec048f-9ccf-4427-96c9-b7e181205c13", "sighting--62ad452d-8631-4d64-81e6-826500ff23bc", "sighting--3794456a-3066-4e64-b01a-3ce257b9429a", "sighting--5effd207-ee2d-4a98-bf19-93c7a0b3585c", "sighting--e287c10c-8e4e-403c-9876-02ca3e7b2bd2", "sighting--2f2fefc1-6abe-4e0f-86b7-99eb603cde3e", "sighting--e48646e2-74ae-4ff5-b93a-338764ba587d", "sighting--5cc649bf-9694-49cf-9069-1b9274b7429f", "sighting--e5c7306b-da16-4eec-9193-6b97e7666505", "sighting--30cec121-d5da-4b3e-9df4-a8fe85ac7938", "sighting--bf32c998-3f31-477e-9ac0-0f23852c49fe", "sighting--2aa61608-e4cb-413a-baf0-c30c2e21c7d3", "sighting--a8e1fe9e-798d-45d6-a499-5163d124fda7", "sighting--9aa6fd57-6cca-40c7-a607-10a2df477fd1", "sighting--6d17cd82-b1b7-4771-8b5c-a209ee9c231b", "sighting--c540c258-50c6-4e1f-ae28-cd566e942810", "sighting--46f65dd1-1b5a-4747-9799-a1a30e48ebf2", "sighting--d669c1cc-b8c6-4306-870b-e39d58ef3828", "sighting--85d234ef-7c5c-431c-8db0-44bc141c5de2", "sighting--98836dab-f122-4cfa-8e3b-788f8e370492", "sighting--b4bea9df-6d36-4bb0-bcc8-4d20aef20a63", "sighting--3a58cb31-dc8f-49da-b129-f67947f2365a", "sighting--0de61e11-e1ff-4e43-b74f-a8faa9229929", "sighting--3b709ab3-924c-4f96-afc6-bab6e5489953", "sighting--3ff6f15f-2825-46d0-9436-de3b769069dc", "sighting--3d7f9a5e-e420-40d3-8ec2-ab0cf3b9d05c", "sighting--99f96e62-2709-4f93-9f0b-a5c8cab44794", "sighting--61675c16-5fc3-4853-afbe-e8849e2259b7", "sighting--6fd3071f-2f47-4a7c-a4c4-8034f588efa0", "sighting--d28d2b05-91a0-464e-8da0-5afef966cfe6", "sighting--24649d52-73f6-485e-ae37-c43a421b6560", "sighting--a2d09874-bb99-4514-b909-547d444dc186", "sighting--f098ef29-5409-418d-a566-6234d66bfb78", "sighting--ced87f7e-4c81-4d4a-ae42-53c24c0291f2", "sighting--5fe6360a-d160-47ab-aeed-a1b1c5b8f212", "sighting--8bac7891-14c7-43e1-931f-ce694129200d", "sighting--f11b441b-a95e-467a-83e3-ed6557cc7038", "sighting--e3465728-e280-4a22-8ca5-afdacd4ac50f", "sighting--7cbb795e-db9d-43c2-a91f-5318c02810f1", "sighting--b63f9412-03a0-434b-8e50-92dc3fc60731", "sighting--895cc967-4ff4-480c-ae77-86c4eadd5197", "sighting--e0252182-17e6-4791-beb9-0eb36facde82", "sighting--91d723b7-a7c1-492c-9738-03e458bcf631", "sighting--d9fb80ca-8b5b-43b4-96cd-44e9c91b44d6", "sighting--464c65dd-a1de-43a1-8bb8-de5f7f10a243", "sighting--f1cdcfbd-7a88-46a4-a20a-0fb22fe37647", "sighting--066a429d-44e7-498d-a009-0b63adeb3f35", "sighting--63c36eca-5c2d-4bc9-b0f5-1abb2b0e43b7", "sighting--78ab012c-bbca-44cb-b0ea-210b0fbda37c", "sighting--81017104-976c-4ce0-82e7-846e8860de12", "sighting--4b2ef2b5-c7c2-4fe0-8875-1fd7d15306c5", "sighting--f7791064-59ec-48ca-8477-1026d25f3e03", "sighting--188c70e7-13fa-4881-8514-4c868f0609ea", "sighting--b32be4e0-c3a2-4e71-b3c1-587ddfd771df", "sighting--e446dd66-3a23-4f36-94f4-fb7e7bf9f83b", "sighting--228b0ee2-4b5d-4018-a4be-f934c0943d1c", "sighting--dd3ef697-7225-431f-a800-37fd053baa93", "sighting--e1deb8ff-5656-48e9-832f-8c1d1c5ada3d", "sighting--06ad7b10-9d70-4724-ae2b-0e5d4f331bfe", "sighting--7a200b68-9b2f-41ba-97ba-8741321b2f67", "sighting--451a26c4-1767-43e8-902c-1e36bdcb8090", "sighting--03682f05-3966-48c2-9b2c-d483878fb1ae", "sighting--ee2bab20-f6da-41da-925e-70552f3fb67b", "sighting--fdd9d2c1-c607-4d0f-b33c-db84b7494c63", "sighting--6c78c19c-6b54-4fef-831e-9575aae77686", "sighting--0c9bcedc-0a52-4e28-8a96-6f967c4bd865", "sighting--188e9fce-92aa-4042-b32d-0ba60daf273e", "sighting--558f114f-e70d-4ab5-8789-d15faa81a3b4", "sighting--e3b922ce-58d8-4320-9052-346cc62f5e7b", "sighting--8907d250-8504-4980-89fd-bf47314cd9d5", "sighting--8a43ec3e-495d-4c3f-abc2-afdf2c07e106", "sighting--a9476d86-b4d8-4d7b-ada0-0797d5d5ec8f", "sighting--ba26496f-36cc-4e25-b573-bf48555e1030", "sighting--9bfe7bbc-fb42-4437-beec-afd3541040fe", "sighting--44c99c7f-1270-4657-804c-d901f0b46226", "sighting--d24445a5-f7a7-47d9-aaa3-d85f0bc8728c", "sighting--feddd6f8-b27d-4af1-a632-5fda48db4ef3", "sighting--ca5a0b4a-cc77-4b8d-af22-9566fdf48686", "sighting--c1d9b95c-ee02-4d35-a198-578fec58fb5e", "sighting--1dc8447a-052d-4726-b331-effaca083068", "sighting--694d6497-d2f2-403e-8a52-0f55abce80f7", "sighting--56861791-50a3-433b-887a-1d44f495f2cb", "sighting--138a6d2d-6c80-40f2-a2e9-5868a58d9af8", "sighting--f5eb0334-b0e8-472a-b0c0-59f2a121f0ea", "sighting--1a537ac9-8648-4c8b-83b5-705e3a4ecdac", "sighting--c5728e66-f4f7-466a-ae9c-9789f342cdfc", "sighting--eb2f3687-662b-400f-9ae3-798bbd853690", "sighting--4a32a00b-ef18-42c6-9858-5ff613b21c35", "sighting--9540e5a8-fec4-4672-9414-66ee3fe34f39", "sighting--32ad0027-fdd8-4381-80cd-529f17fad9ba", "sighting--f6d3ec08-09aa-439b-b5d7-4da09d4b8783", "sighting--e5bd8b40-ed57-4ce1-8a37-4de8b672a7b5", "sighting--bb60221e-071e-409e-a88c-dd5463c4c524", "sighting--05c2b984-1aa2-4ef8-88ad-60dab051e809", "sighting--b2a3f7fe-e492-4fc7-ab74-3f5830a5e778", "sighting--34648837-8324-40dd-8568-4e159f11ae12", "sighting--e3c86e05-8059-4003-a943-2f4b0a614f74", "sighting--0fb1e8dd-f997-4cdf-9eec-b2564d925a06", "sighting--33263e80-7b48-454e-8c31-d1dd4b6ba8ac", "sighting--073897ad-202a-4050-9b74-211aa578c839", "sighting--91cd1c87-527e-4379-842d-631698861679", "sighting--cd022dbe-d1f8-47e4-9ee5-f16ac3a43ad9", "sighting--64148707-dcbf-4d15-9fd4-1239bd5a9184", "sighting--a646e771-4465-434f-9eae-77caceafc29d", "sighting--9dbf7b5e-9152-470e-87f6-36d1567a91ec", "sighting--4d0e10bd-6df2-414c-9ab5-85b494b0219d", "sighting--14f7be2a-5f7a-44d8-8fb5-f4784ec909a0", "sighting--bf641238-16bd-4086-a35e-07223fb0a35e", "sighting--5e647e81-34b6-4752-80f7-25a39870636d", "sighting--f2e5edfb-aab7-42f9-b0c6-974b7236ef5c", "sighting--b1d1ee4a-3d79-426d-9504-399b8a6998f5", "sighting--82b4c81c-52c3-4dc6-b107-201af56e48e6", "sighting--50d31493-0895-408c-8a8e-6a9ac7ef6932", "sighting--b3fe11eb-8959-4486-af13-4a7c755f184f", "sighting--0667e59f-f338-427b-89e4-8b1c0329214c", "sighting--e9179d73-40eb-4afa-b15b-de232470ae84", "sighting--f1c18a03-dfbe-4952-a797-976fdc9dcad5", "sighting--9d5cc643-65df-485f-9d76-b38381b3fc40", "sighting--ae35d98c-f1f5-48d8-8b5c-1b50e4648130", "sighting--73afe389-eedb-436d-9fd2-4cc071e6aae2", "sighting--95add529-6549-41bd-9c8e-593e6049dce1", "sighting--295974d0-691a-4f37-8e6e-e134bb5761d1", "sighting--e825b276-608d-48af-b457-11d0bedf4ae3", "sighting--78d2f4fa-30b3-4499-b3da-03ce1b53e325", "sighting--ad08c830-f5f4-412c-9c0f-093557d02311", "sighting--3e9a9c0a-ff90-455d-b42e-910f1c7459a4", "sighting--e2bbc7da-98f7-4655-9269-fadfee88596c", "sighting--8d701684-c2f7-4da0-a8e7-a5cb1547f570", "sighting--35f74499-a141-41a9-a7fc-9643d373162a", "sighting--f8d91622-8daf-474e-a60e-dc7e272fa09b", "sighting--29e0bf13-cfdd-4cd3-a091-1cec383b7763", "sighting--bfb4a852-66e0-4df1-a3ce-a39edb6e8740", "sighting--09865baf-2904-4f44-96d5-647f9be5de71", "sighting--2f4c2dfa-4ded-46b7-b7f2-d3764bac233f", "sighting--163be842-0ea2-4bc9-a8b1-9080c4e23bd0", "sighting--cc50141b-43a7-4f7d-b1ac-ddc0573883bf", "sighting--8b27f938-cf3f-4014-9dc7-c55f3c4be87b", "sighting--ebf46614-3683-4183-abcd-03e7ea1b1320", "sighting--e24b082a-aad4-4c36-a2f4-8d45e29406da", "sighting--f0f41e2c-5073-4487-8663-d3664fa51f82", "sighting--a6325371-a24d-4551-bb01-5056bac7a8dc", "sighting--308e5280-05fa-4e82-a537-ff9887f0f015", "sighting--8b7d4232-7569-4086-8f61-f4125cd3765f", "sighting--0e40610d-ea56-4773-809d-870d0fc2f12b", "sighting--4ad56dfd-0a50-4c52-8d44-31bb6707a419", "sighting--d15874eb-1d6f-4d6d-a265-caf34a99d1aa", "sighting--e5d46931-c3e6-46c3-9afe-7e281738f472", "sighting--d7837ef6-0ad5-4c7e-9ce5-f6529aea5fcb", "sighting--deaa0f1a-2ca1-4c3c-9054-c9cbb1536653", "sighting--ff7d4f4d-056e-45c4-a9c9-67aa20c10e27", "sighting--797582f9-db8e-4a95-9345-1b05b53450e2", "sighting--6d401336-9755-4f62-b3fd-1a66f31d7635", "sighting--5f53efa4-f194-43a6-be34-a038fa3fc2b7", "sighting--20de8782-4d6a-48a6-b5ee-ecdc56fdaa28", "sighting--e3fc2ab7-7d32-4266-8cff-b6ce0f982e64", "sighting--0b260b91-fc06-45f3-9e8e-91fc1f11a034", "sighting--b8c08388-31b4-491b-8c55-e5fbff3833e2", "sighting--86faac1b-b281-4213-98b3-bc7a8653dc63", "sighting--aaf8a8c4-698d-4084-af61-09babb00ea58", "sighting--21970465-4cb7-4707-bafe-fe3b5e7aee63", "sighting--ed120b72-84a8-4b9c-bbf1-048409b0dfae", "sighting--d4ed706f-9501-4e5b-af53-f0e38c6c4f11", "sighting--4de17f04-b28f-4b90-bd4c-b12fc50c8f1d", "sighting--3ab081a4-40bf-498f-82fd-001ec0d5f438", "sighting--9ed09756-374b-4a8e-9397-81d5dce96c64", "sighting--7ec431d4-b0b8-4db9-bb3c-770eceeb1654", "sighting--ef8fc6af-c77d-48d3-bf39-535e45b0e805", "sighting--7cf3332f-63f1-4dc6-92b7-72f743669ea0", "sighting--3dd5d0db-050e-4bf8-a4f1-424d655601f8", "sighting--ad80bdde-f3a7-44b2-8f78-4419ef5e9463", "sighting--4c9a97f8-3d62-457d-8b18-53753baee88a", "sighting--b4c0fa76-e9e9-4f16-b1db-11436309018a", "sighting--1f62a1f0-0e9a-427c-8f3e-a8e51186a410", "sighting--98fb6fdb-c5d2-441f-9dd4-b13abc95159f", "sighting--7e432c1a-11bd-484e-8625-a00114df94cd", "sighting--1d061c33-37b2-46ac-9d5d-b2e742f0ea6f", "sighting--83e66916-2f10-48b5-a66a-340f3d8b4e9d", "sighting--e79a9bd3-c6de-48ec-9fc4-284a65473ab6", "sighting--3dd6ab91-fc98-47ef-b060-e413565ff536", "sighting--11694888-a8d5-4130-a87a-35b993beb120", "sighting--4817cf6d-224d-47f0-a923-61c7e15d23a0", "sighting--82353f62-e515-4e18-91cc-a0a1ff12ef7e", "sighting--4971285b-9f38-4a70-80c2-f39763f3c9a8", "sighting--7ba4b2a4-695d-41fe-9a01-5922ecfbc5a6", "sighting--c690f5fb-50a4-48bc-b570-93e212336666", "sighting--6b8fd85b-a84e-4af1-b8ff-28dbe58812e3", "sighting--195f824e-0011-4208-92c8-66e98e9f4704", "sighting--48f8efb2-7072-43e8-a2f9-85150ceed2b8", "sighting--d14d8df6-286c-4ca2-a6a1-ca96f9c65819", "sighting--c4701dfa-2726-48b9-bd8b-b766e453de68", "sighting--720d30b3-4a08-4bc0-bdc4-2fa6799ae371", "sighting--92944147-39fc-4736-b4a2-acfbb0683eb7", "sighting--47a02308-a26c-48d0-908e-c2bed31fe872", "sighting--26fe4f87-7ab5-4908-bf82-c38d90cd44da", "sighting--483829a3-fcf5-4ac1-8f9e-16a74adb9733", "sighting--088510c0-f3d9-49d7-82e5-d56a3645df30", "sighting--127d077a-f366-46b9-8503-99c3ab71298f", "sighting--113fcabb-6734-4cc9-9ee6-5e9709f4d2b9", "sighting--5660a5b7-ded8-4e3d-b340-cb82a33c25b7", "sighting--e4dcb836-8e10-435c-9134-da18fd7bf938", "sighting--1b8dff17-1f62-4722-946a-81254a078cfc", "sighting--013a531c-8070-49bd-a984-a605e3bc1823", "sighting--c8b51f06-dd76-40bc-8dd0-b0a07fd0f839", "sighting--35f5672f-8ec0-47a9-ab31-94bf40f52140", "sighting--a65113b2-e249-4edd-9284-a3d8679bc921", "sighting--311991f0-c6ff-4ca6-957b-67166199ef53", "sighting--64607771-04cf-48db-94da-38f8296dde5e", "sighting--703b7f3d-ddc7-4a5d-97a8-a6c75279628d", "sighting--6fbb18da-94c9-45d2-ad27-337821e996fa", "sighting--5d25f437-4064-4a23-a9a3-e311ff5ef515", "sighting--3f5cfdd8-58f7-4e1e-b182-33a37e91194e", "sighting--66cd93e2-79f2-45ec-8adb-eac052848636", "sighting--045ec338-4364-482e-a4cf-d0a0ba89c56d", "sighting--3520eeb2-713f-4459-a139-6fbc5f7a409f", "sighting--3e2ab1ff-9c46-4b29-a8e8-8d252f6fdb9a", "sighting--496ecbfe-5e54-4b91-907d-7ec6b3028850", "sighting--230232f5-524e-4a8e-863a-d370eb40e5ff", "sighting--03806ca6-6eb9-400e-b62c-2ef14f636800", "sighting--b10e2b21-d224-4aaf-b3b2-1f912c53b21a", "sighting--e2ccd08e-f522-41ea-b1b1-0b7af748d7f7", "sighting--ae79e525-fdc4-44dc-831e-f3b0b73e881e", "sighting--a2a55246-d9d4-41ff-8656-28447e0c210f", "sighting--9ef7936b-c3d1-466a-ae80-5f4809e74b7e", "sighting--74740594-59dc-4b5e-8e5a-a058dc5eb503", "sighting--db2fedc1-7dc1-47d9-a052-a4f2317cc485", "sighting--0a9fc71c-ae14-402e-a7af-39c2c15b15ac", "sighting--8bb554ce-53ba-4cf1-bf57-b21d3c031422", "sighting--ddc59160-81de-4246-899e-9b56c866be42", "sighting--f2733c2c-c682-459c-9364-f55cfc30cb5a", "sighting--cedce62b-2a81-4906-8639-2aa74df13921", "sighting--bfb530d0-d14a-4655-937d-c42ad1371bc8", "sighting--b3f34211-d5e9-479d-8ff9-8244611ae024", "sighting--f6a1d4e3-78ed-444a-9fac-2331e4f3beac", "sighting--e1685e99-72fe-4590-a780-6065106f8649", "sighting--0cd54631-1181-40dd-9761-d2bfee572a88", "sighting--9e4dd1f1-0c8f-4c00-860d-9b1291c36f89", "sighting--e5d66b1a-2e5b-4e26-910b-27df04fb1121", "sighting--44952923-42d9-4227-b939-06550fc27a57", "sighting--1c71b008-68d3-4dbd-967f-451de49f9a8d", "sighting--20fe35d6-34ff-4688-bb92-320ff4082df2", "sighting--1c54f53e-fbc5-4ae0-a07b-4c6688ee3d02", "sighting--2f9deec3-8610-4bff-94c7-6d55fc44529a", "sighting--8107dec7-33c3-478a-bf2d-c400aeef751c", "sighting--6fced04c-da3b-401c-8b98-961d9856e8ac", "sighting--a0665be6-3de8-4c1f-8ad7-dd8a273a29cc", "sighting--988fe191-8610-4e06-adea-6b473eb5270f", "sighting--c1f8a44a-2cf0-43eb-8324-964fd6e9940b", "sighting--b2e422ac-b018-4299-8354-cd2a0baa9adc", "sighting--ecc0d876-3915-4314-803e-3fd1ae605695", "sighting--0642aefc-6eee-431e-9924-a805d4cd5528", "sighting--0bac28b9-2296-4ddb-9400-0b38e85287de", "sighting--131f2032-b6a1-4e67-9559-4ca356c0fa93", "sighting--7cfb2797-ba92-4b16-91dc-aa79c7a6233e", "sighting--7d474bf0-8554-48dc-8a90-0ba4a319fd72", "sighting--df7972ff-0d4e-4273-8af2-3341fae35ed6", "sighting--3c40cefe-d348-477b-81ff-2dc3fb00e5f7", "sighting--abd791e3-64ca-4946-8ccc-0276cfa2d98d", "sighting--5c7eef7b-2c38-496b-9a70-7cfaa1235423", "sighting--4407e650-3f4f-4a62-b582-f23f0d3e2724", "sighting--7ae6ef9c-be79-426f-8431-f276b1dde74a", "sighting--23046101-46c3-440d-82cf-3bb76685840c", "sighting--f577a34b-2013-415d-9bfa-2c5f6e3c0c76", "sighting--62d5ba6c-2fd1-43dd-a97b-8313871abfee", "sighting--3d84f3aa-1ad3-43fe-bdbc-6711e39bcf87", "sighting--a65111f0-d6ed-40a0-82be-61566c967fcd", "sighting--543fefe0-94c2-4a12-bc58-d02cc5823727", "sighting--398a10ed-02fd-466f-8a00-95ea0dc9ef1c", "sighting--2e316cc0-c785-41a4-95d2-32436cb51cec", "sighting--720f1aee-9ba2-4145-8afa-ff79be857b7e", "sighting--c8f00cfb-a7b6-4d93-a36c-75c250f80bc3", "sighting--cc9fe4f8-0c5b-4677-ad05-56a401d028f8", "sighting--d1f0348a-3229-484d-843b-11e0f3ee4c51", "sighting--e3208d84-e0e7-476a-8dcc-40bb8b9378e6", "sighting--f6344d9a-d667-481e-bcec-f1d1d4c3c3e1", "sighting--24f01182-cdf7-4d84-9a40-97b1f2a8c357", "sighting--7dc394e4-15be-47b3-896a-34b0f6732dc2", "sighting--c64eeeb5-4b94-4b6d-a689-65609bdad487", "sighting--e1149e97-8171-4471-805f-b2d1d0ed0590", "sighting--66b11dc8-8e5e-46d2-9628-4f29ece166c6", "sighting--85a81b6b-153a-4327-a8ba-c5663b7e4dcd", "sighting--a9fddc32-444b-4c4c-be42-659507d6a8d3", "sighting--4d52ebd1-e6fb-4108-9e5a-b5af747d15c4", "sighting--1e7a3e73-06bb-455d-b35f-37b80abcd96a", "sighting--27ee6d82-16f5-4afd-b462-f292cc118343", "sighting--8238234f-0ba7-44b7-9135-7b12ae52e0cb", "sighting--053e2ae2-5446-462d-9e1e-2d91109ec5ed", "sighting--af6b9183-61c8-4c2a-82af-834d0d8e5aaa", "sighting--3378cb8f-03ad-4a6c-8178-f463ff103bbb", "sighting--e83fa72f-8920-4e7c-8d4e-bda073238137", "sighting--8c742b95-11c0-4de4-902a-10cb62cff5f0", "sighting--2e6b547e-cb5b-4fed-a3d8-e9a0cccddcc4", "sighting--87d909e4-ef61-44b4-a192-b5454a090ab1", "sighting--2958f45b-b880-4d53-aa84-294276b05b60", "sighting--163ac54a-5374-4559-8ae0-b26dda7bf236", "sighting--6431b1d0-de17-4927-b8d5-d9ee1cb84385", "sighting--c034ff65-f1dc-4930-ae8b-4109d6d6c2bd", "sighting--e83468ec-b622-4a0c-8011-912d8e40bcf3", "sighting--10d38ccd-cc33-41c4-8b23-dd13149d23ca", "sighting--b861278d-8206-4c4b-a2a9-7d1f5035e3d2", "sighting--97ef9855-3f7b-4afa-987e-9408bae110e8", "sighting--b7018c97-28e1-4bf9-913d-473258ad775c", "sighting--eda8b987-4b51-43d8-a820-462188bb7e88", "sighting--b24c21b6-7bc8-4dc7-8a7a-850e35a15e14", "sighting--b16cca5d-0b6b-49f9-800c-86bdea0c1605", "sighting--24cfe63a-4cdc-47a1-812e-028c9819971b", "sighting--dca80cf0-65ef-463a-b9e3-a69b8fddb86e", "sighting--08805ed1-98ed-4f16-95af-7170a5d23c2c", "sighting--270df2d6-4860-4d19-bb4f-379d888c1802", "sighting--24ed3f10-8aa5-48fb-b73f-785f6e83ff86", "sighting--fe6282b5-9909-48b4-a3fd-2524d728817d", "sighting--f7b2eeca-25d0-45e5-8de4-29bdc1b6059d", "sighting--9d51453e-5064-4a3f-acc6-e56ead88bcc6", "sighting--f143edfc-11b9-4fc0-804c-a94f21d0b974", "sighting--a962d5fc-6137-47a3-bd1c-973581c5c05d", "sighting--355e0f8d-79ef-479e-87dc-4bd4d6223958", "sighting--4c72c5fb-4a24-416b-8231-290816b2bdde", "sighting--b89aa2cf-e616-4335-ab50-a6b790209ecf", "sighting--0f12f162-c5ad-4779-bb09-5eebd24a1880", "sighting--7ad3df76-9986-4ba4-8987-751e9538c2e6", "sighting--956397c4-9c51-4fa8-bf08-fd0ffaf1d91b", "sighting--db156cec-e426-4af1-aae6-6cf64b1c6a77", "sighting--7183d5d2-e17f-4ffa-923f-a1198badcf1d", "sighting--1219cb96-b53e-4d04-909f-0bc627ee6d5b", "sighting--1c11927e-f01d-49c3-863d-77fae1352bae", "sighting--faf8286d-76a5-428b-b0ee-2c81be8632e8", "sighting--011b0b2d-c83d-47d6-9a33-8282b5c3ec34", "sighting--8693b412-86f7-4651-8293-def5f68e26d8", "sighting--60029075-d4d3-4a01-8e6b-e70b9cf5faf4", "sighting--4c8a60a3-ed23-4580-885e-76c260c6e68b", "sighting--5dfb6183-301a-4f1e-9020-6c60c406fe82", "sighting--e2f975cc-b8db-4477-9f4b-3469da942011", "sighting--fd510a9e-b49c-461c-a29d-cb706cb7934a", "sighting--5481147f-e367-4009-bcba-c74a4d29e993", "sighting--d4f61ce5-6bec-4d04-9af9-5e439158d307", "sighting--c55ce315-f982-4742-b9b3-4607357c35b6", "sighting--a38e8697-9ac7-402f-9226-0298146bd602", "sighting--8c039347-b27c-4a1b-a872-f2a8b6ae4717", "sighting--4e86cc80-6118-453b-b7fa-988936896afd", "sighting--d754ccb2-18ba-4906-b6eb-67e064569003", "sighting--294236d8-ab75-4b1c-8e60-290bae88afa9", "sighting--ac1d1a88-60b2-4cbd-ac35-4b16bec4248a", "sighting--78fc411e-b4a9-4020-a510-8e438ecc2672", "sighting--1438d78e-669f-4f2a-b79a-7598fd8bdccd", "sighting--ae5ab65e-97c9-4db7-aaea-384cac24d023", "sighting--2fc9701c-a310-4808-93c4-4513016804ed", "sighting--aea10d98-008f-4c94-8800-f9f9193f1d10", "sighting--5b6af703-26c8-4ae0-99e6-34e21bd3984d", "sighting--e6c852fb-3102-4494-a1c2-9d8a27f48d87", "sighting--1769656f-065b-4305-9c53-75d490e6d6a8", "sighting--4b90edb8-7a6a-4166-9652-7ad6866ff28e", "sighting--c6ce1c53-d092-41d6-a85c-35c1607fb951", "sighting--bb8db69a-fee5-45e4-bf9b-f221e8c43025", "sighting--ae223595-4707-4955-b3b3-911d13d063b7", "sighting--f9f8b014-d086-4f61-97b8-71bf93e7a3d2", "sighting--fc8f1bca-f418-4192-932f-458e7a821e65", "sighting--44a1e2fd-6e8f-4794-a1a3-bda2e65dcf27", "sighting--976d01ae-e364-4ea8-8a8c-8aca2afef96d", "sighting--f53f6fba-233b-4e44-8b96-e47ccb402aa0", "sighting--1c17a492-1c0e-452e-b31d-3b7372fc9a6a", "sighting--4fdcb297-ee11-4085-9d17-82d7a98d8180", "sighting--b1ef2385-b296-4fa1-ade9-5cce0dc2d5a8", "sighting--a53f8ea5-049d-4b5b-bf76-8ffa3c78d70d", "sighting--838b1c35-4a55-4f3c-85e2-5c0e08cfb689", "sighting--f2e4d92c-157e-4da2-9117-b51b88d4dd4e", "sighting--d8658156-3b2f-46bc-98c2-c3c944368036", "sighting--e312fcd9-1684-4374-91d2-90d5d22b91ef", "sighting--96650c17-e3fe-4005-95e8-8ee351d00612", "sighting--ab24181e-dfe5-4974-9fc9-09f9c99e1131", "sighting--56466453-0c30-40d3-a75d-daec94c568a6", "sighting--67c4d8d3-a493-4a78-bf49-e89f3ea3490a", "sighting--837c2402-e73a-4a9b-9c6b-47f0a0b88e08", "sighting--905420f4-2528-4e27-8154-0ccb762c84b7", "sighting--543b8d59-9547-4915-9f8d-938c2bd19b7d", "sighting--88f308ee-968e-4d46-9553-cf01ff88d1c0", "sighting--ba654010-f56d-483e-8e8f-8c82a178b689", "sighting--9a774bde-4840-40c9-9b06-b6f1682918d9", "sighting--9cf19df0-eb79-45a2-ad78-e13ccdbe0ea3", "sighting--bb4fd266-438a-47dc-ba5d-26b0baab3876", "sighting--7e80e6b7-59ee-46ea-a3e6-c205628ba715", "sighting--8589510d-b77e-497b-b2df-6ae4ee9a6616", "sighting--fd884a82-5ad3-4129-9062-f2ca928fb093", "sighting--37ca06fa-a5b5-4bee-acaa-7524b0841ec5", "sighting--ba0af704-c882-43b2-b002-63bf33ca7ae3", "sighting--7d83012e-3df3-4324-a7e9-9923e0d4ee70", "sighting--1a3c9f38-cb23-437d-a291-49427e6caf4a", "sighting--ee045044-4eba-4134-89b9-6da14e87291d", "sighting--c53b98b8-23c5-4ab5-9862-ec98a71a783a", "sighting--54418cc0-1667-47a9-b305-079733fbecce", "sighting--71ab91d4-b3d2-462f-a89a-df146f28d1fe", "sighting--39075d00-b362-448f-9caf-eb1304eb55d1", "sighting--396794cb-9f95-4f55-bcb1-83582933194c", "sighting--d23ac412-cbde-4764-a6be-50578ea36767", "sighting--2d61603d-795c-4062-beb7-f5edd9ad4c69", "sighting--534888d1-4e57-454c-b691-4b5f5b371dc5", "sighting--3dd9b629-d1eb-4598-a6f2-93223e5682ee", "sighting--be828e6a-321e-4fbe-aa09-e092701cb45f", "sighting--0d24bf79-6a44-4266-9d5e-6222fba17a87", "sighting--a35909a7-0e3b-4581-8009-c613460f524e", "sighting--32efed83-0b49-406b-b907-1def72a1593f", "sighting--0577b709-354b-406a-8b55-702dde64c193", "sighting--8144c41e-be3e-4822-ac82-864fa3d317a4", "sighting--9084b810-ec28-4a53-927a-e788980ed3ca", "sighting--b1622659-3c5e-40f2-9f94-42d7a261bcc7", "sighting--9b99be5a-2872-498d-8a37-1f1293838872", "sighting--74c73ad8-25b5-4e54-8a96-c9bfdadf1be6", "sighting--178248d2-4ad8-471e-ac3b-6f4d98acdf90", "sighting--e27e7fce-9a8a-485e-a9db-1b49b2a5bddb", "sighting--639f9987-5a63-4da7-ab6d-bbff9fda0297", "sighting--07f00aa8-38ff-4733-aa78-3197b67bfed7", "sighting--666e85d6-63b9-4037-bd48-c89d6618a10c", "sighting--b6dbab06-77a3-477f-9265-d28109c41fb8", "sighting--40511f4c-c742-4646-90f0-eddf228f945d", "sighting--29eeca2b-21f5-49a4-a1e4-01ad51b2b787", "sighting--14e91e99-1ffe-4a38-813d-f0b487c976f4", "sighting--50425bb9-770b-43ae-ad64-ee32ea835d15", "sighting--68f73cea-c5f8-4b18-96a0-9a5f07c885b7", "sighting--2f7178c4-fcc1-47fa-8ac4-71d979a5d56c", "sighting--17c5c128-892d-468a-acee-b3fe058c165a", "sighting--0da4c63f-3fc9-42bf-a58f-bb484cf14f67", "sighting--c82e2680-d6f4-4ef6-9ffc-333f6e962176", "sighting--0a24e82c-9fab-4b36-b4a5-8c7304b7a794", "sighting--1708ee62-e148-4117-b4fd-8dc1e14b92a3", "sighting--ba690b5a-1397-42f7-84cb-d98b74abd023", "sighting--34eeb5ca-8c27-44f3-856e-dbc8fb9d059e", "sighting--cfefb655-4aa2-41f0-be5d-250eef57286d", "sighting--d3bdb3c6-129f-4a37-8d5d-0fd02f2ee513", "sighting--60bbc3aa-3878-4536-a16e-fd9c7169f375", "sighting--dc3f6592-e8bb-44f0-9812-042ec628b193", "sighting--1abaa64c-16d9-44c5-9cfe-51584fa91a4a", "sighting--1ccdbc0c-3ead-4681-9116-373d057e573f", "sighting--5ac82c17-8ffb-4fb4-8475-24a6148b417f", "sighting--3f2593f3-1d7c-4ea7-867b-34256d6dc7d0", "sighting--cca18bda-2e88-4328-b20c-691b24e0496c", "sighting--38276294-3786-4491-a338-74ee2740e5be", "sighting--01f3a972-c561-424f-bd69-887ef7b3b591", "sighting--381e64f6-1627-4ce4-a4e0-0c26761b6081", "sighting--f27ab3fa-1607-4ea1-bf50-d038b3bfd3db", "sighting--1f85a8d9-4c5b-4eb4-9117-c5860f16f13a", "sighting--4f52323c-4b6c-4ee5-b0b2-84627890074f", "sighting--9034d588-df43-44eb-af2e-cd445ec74242", "sighting--10108d0d-9d9d-4d1e-81f2-56b24914e251", "sighting--ef6ba5b9-486f-4218-8104-1d3ebf60d7ee", "sighting--d90b2ffb-11f0-4a45-b542-5e81a667608a", "sighting--7d91af32-5005-4b2f-a97e-7bd5a7e65fd4", "sighting--a5d2a0fa-31db-48c8-8a9d-9ad4fa31af89", "sighting--24ab4b20-c0a4-4c80-937c-2c76bc0a4d52", "sighting--78a4f00c-093c-4a91-a6fb-34d4ef6eea85", "sighting--e9c78a4f-7a3a-4a89-b844-809d662458f1", "sighting--eb739126-8002-4132-a053-104adba28cf2", "sighting--34b78ee2-9d84-4e1e-8c02-5aebf78d84dc", "sighting--372f15ac-7948-4c8a-a010-2bec81920c34", "sighting--df4e0908-74f8-4229-bef3-e4602d1b7a7f", "sighting--782f6e77-1150-47a4-830e-7b8240286e8c", "sighting--c1bca4b2-09a1-4614-9488-30ff78370af0", "sighting--bbea35d6-afc0-474f-a2c7-b061d2fa07e4", "sighting--b5ceb73d-d183-4940-926d-d0e6e78d4ac4", "sighting--9aa2fdb6-41a6-42ea-a6f9-1e52d5a2dfe5", "sighting--d9640706-188a-478a-8df9-2e220927d8a0", "sighting--38b839df-01e6-4c3d-9503-64a8e258069e", "sighting--187f838f-6d32-4cf0-9e5c-5e523fc90a9d", "sighting--b43c0ca8-1c81-4c43-9ca7-0870dba94d28", "sighting--b8b5303b-0496-4456-9441-1084bb5c39ae", "sighting--833a98d9-3e4c-4d5c-81a9-8ea41cd84bd7", "sighting--1b7c9842-9415-4008-8ca7-6b2c60335062", "sighting--8d337ab4-3cd6-4a92-9060-572921941803", "sighting--76a08af3-b021-4749-bba4-48c5c70b5322", "sighting--cef7e634-9767-464a-9024-2279977299f3", "sighting--12b19970-aa7d-41b5-8bc9-c17ad4521136", "sighting--11983e5a-7a7f-480a-93ad-1f05a42d4139", "sighting--2e8e1673-6a5d-4232-b774-944b32bf13b7", "sighting--2d06a8b7-7ff8-4c65-a92c-6ad41266da8c", "sighting--50f0d9de-b1bd-456f-a376-7547b8e9ac38", "sighting--ebdcc239-1c03-4bc7-b2b3-964006935f12", "sighting--ebadebaa-2859-4f36-8f33-71c3348a9ba2", "sighting--92a282a0-7f8d-405c-980e-89e41819c6b7", "sighting--47fbfdb3-96e8-4681-9049-4392868619df", "sighting--8db9fa62-23d0-4d74-a0d4-91be6ca3e2fb", "sighting--9d9d9641-aecb-4e8e-a0b6-8c5fa4b32aeb", "sighting--f48492a9-2b68-40d6-8ee1-eb5c6153ed97", "sighting--bd20e22a-cf39-40a5-9234-eea735c66b07", "sighting--b18d4215-eba3-4fa9-976b-dcf2462f2909", "sighting--bea884c9-1b11-4bd8-96b4-86f839f9851c", "sighting--8d4c1713-25e1-4353-852f-d5accc6d8d0d", "sighting--4e367a42-58b4-4c34-ae60-673b28256654", "sighting--45acbfc4-b70f-449a-bc52-31279405e6ee", "sighting--1800f7a4-f0b9-4b1b-ba27-a38824cef3f6", "sighting--5ccb4c21-2c2b-446b-9318-127b6412e6b3", "sighting--75c2dd1b-a818-44f1-958f-2b94a5abb6f0", "sighting--2a53455a-b985-4551-a081-4b380184dc57", "sighting--1a2bec99-8a0e-43a6-b88f-8a1c98aaa490", "sighting--be3458a3-4d53-4019-8ecf-1d3630559b64", "sighting--02208c27-20b9-40ca-b375-cbd230b893b0", "sighting--1baa1c9a-6a62-408b-9c05-1590ab985aae", "sighting--33affb6a-84fa-4049-b08e-afac15f5e73b", "sighting--76e36be2-7701-4d08-93f8-72b04ec2ef97", "sighting--5d11c446-f7d4-43b7-9445-b1c895de8a7c", "sighting--4c8c5638-389d-47ab-9596-e459fa1db744", "sighting--69c514a4-9841-4854-8b6a-957acb0ae605", "sighting--2a19c845-0b34-4a0d-9491-7caac6703456", "sighting--41387452-c0de-476d-8314-55e0f2ccdaf6", "sighting--fe60c800-a07f-4c12-8f72-080aa706c4c0", "sighting--f9d97bc0-ca38-4295-9109-5a56830887a5", "sighting--99cc7ee4-e0b7-439c-bcfe-e454319d03e3", "sighting--5c79ce62-deb7-4e84-97cf-ae2758bf55d3", "sighting--bbf2fd3b-6d21-4577-8e83-58a27a7e5d30", "sighting--8cca25ea-4d48-46ee-a2e7-2432122bc908", "sighting--62760c24-6be3-4249-a7f4-54ea815379fe", "sighting--7f18b454-3c6b-4e19-9864-429fac856904", "sighting--d12d2724-ebfc-419b-9054-fef42bdb91bb", "sighting--ae85bad4-ccb2-484d-a063-c2af36286731", "sighting--fd1e57e6-c19a-4ede-ab2e-061033c7ac8b", "sighting--f56998dc-4988-4902-a755-59b06ddcc326", "sighting--b65829da-4447-46fb-95bf-50bb84bf5406", "sighting--188512b1-9576-42f4-8dd4-35018a9cf2b1", "sighting--8fd60c4a-71d3-4699-a44a-86507e256dc2", "sighting--403a5449-20bc-47c2-af4f-4814ad80a41a", "sighting--1642cf35-26b3-4bf2-948a-11785720f94e", "sighting--6888fd23-5841-4313-96a8-264b75dea34f", "sighting--861d7729-5c7b-4c85-a8e0-a8a275846f7c", "sighting--50cd9df5-c35a-4fb8-8be7-b7044d84c8e3", "sighting--312b55ba-0aa2-4da5-a028-9fc324c7bed7", "sighting--124404bf-6ada-40d5-ae9c-687082ce1c1e", "sighting--f2300e06-7361-4047-b0a9-b02af02068df", "sighting--fc04d307-6efc-4824-9bcc-9b28439883cb", "sighting--36b8bae5-0062-4e07-9116-434808d61afd", "sighting--c77540ae-2e6b-4846-b713-5ab4051a7f00", "sighting--0e23eef7-b7c9-4cad-a4bd-e240d9b6faf3", "sighting--d3ce7357-19a1-4db4-ac8e-24e37df06a3b", "sighting--01e75193-795a-486e-ac05-bad6fe02a892", "sighting--beeac215-28a6-43dd-a610-84e05387ea38", "sighting--a7af55ee-0441-4f92-8070-d96f5b470b3f", "sighting--93222be6-4f14-4541-bc67-d484739074aa", "sighting--d6cb83d4-c3f0-454d-bafe-253864626d59", "sighting--b1a1677a-17da-4bcf-9303-ff9b6518fee5", "sighting--89879be2-a77e-4b47-be1d-edd628912050", "sighting--7baadf9d-14e3-41b9-87b7-30ad31e81191", "sighting--760aba16-86ba-4b16-9001-319135582599", "sighting--dedea45c-0f8f-40ec-a6dc-554dacaf683f", "sighting--540af50e-21dc-4bcf-88ca-adaecf4b79b4", "sighting--d8078b02-58a3-49dd-a5aa-53b81c2a76b3", "sighting--46780db7-013f-4806-b9a7-1a1892462be2", "sighting--e59320ee-e025-434e-907a-16a8b2c2b3f3", "sighting--0b7c002a-7a94-4335-85ca-7eb97864328e", "sighting--909b23b3-39a9-46dd-9a61-63b534e4ed32", "sighting--50428090-6746-4c42-9fd3-f221c6e39560", "sighting--b6da2380-144c-4d48-8233-dc74bcbf7de0", "sighting--daab2be7-c98c-4243-af04-a97c6e9962f3", "sighting--13eead7f-cdee-4217-8f8b-c9cd989db76b", "sighting--e5ea2311-ecd3-4aa2-8d79-4c2a8b365229", "sighting--dcfa3afb-0d25-464d-beb6-7b7ddcb37549", "sighting--c7412e80-f0ff-40ae-bfaa-75950eff1eef", "sighting--aa51f3f0-fbb9-4c58-ae5b-126cc158cd9e", "sighting--3db62022-c70b-45b4-9e3a-3aac61d5f556", "sighting--97060f1a-c43e-4799-849d-d30bf8b2ba42", "sighting--0d8484ae-1eb6-45ac-b333-9e409c39f0b4", "sighting--21b25866-d14f-4063-908a-ab095e799eba", "sighting--1b9cda0b-c8ff-40b5-97fd-42743658ba64", "sighting--88364af6-cee2-43b4-ae14-b0e2262f6591", "sighting--1559bd05-d8c4-4a59-8c16-18328922fe78", "sighting--35f2b85a-ffca-44d1-ab27-40d79ce5bdb7", "sighting--9d2e2cd2-afef-4026-9a11-65fa8ce153a4", "sighting--a731b6ad-1586-41cd-a68e-12000199877d", "sighting--4731288f-ccf6-441e-a782-b16472f82dd8", "sighting--0a06cf0f-cd75-44aa-b985-44f33c9604b4", "sighting--aeca070d-7a35-4885-bbd6-4de4f58907a6", "sighting--d4ae3aaa-8542-4a27-a136-1d60521201b1", "sighting--067f33e1-70bf-47c8-b5c7-1d76e97500bb", "sighting--0f6b0137-c325-4c93-8e1e-9ebd0dc89e95", "sighting--082378da-a1ed-4037-bfd3-0c1a0e7d496e", "sighting--e8541173-2cf6-487c-af1a-ecf9c3d014c3", "sighting--ad80cf9e-b3b6-4326-a974-f5ddfa16f34c", "sighting--a1f25965-b834-4210-908b-cdf80b1aae18", "sighting--25c3b335-d5a9-4b77-b7ae-5c640ad5c3a4", "sighting--27405aad-815c-45fc-9e23-e30495e6b7f5", "sighting--8ba675b3-ae58-4c32-9719-f26b2739f94c", "sighting--25732f62-efb3-4f26-abec-f8a350cbfa2e", "sighting--05c7d918-15cf-43f8-aca3-ce6ec83aee63", "sighting--811a122f-f467-49d9-816c-e67224d33a68", "sighting--9e2f4993-b7cd-43a5-8afd-d99d0a9c7897", "sighting--e4023277-a492-4996-b2cc-c0f9cf117139", "sighting--bd388b33-ccaf-491c-abce-a9667bb92c3c", "sighting--da5c2ce9-3154-42e4-87f3-4d0ff364d01f", "sighting--09189d75-15cf-4907-b042-5f585bb1fbef", "sighting--9ff1d8f2-d867-459b-aac2-ddf64138686d", "sighting--adc48a28-58d8-497a-88cc-0b92131c99e6", "sighting--41b78ea8-b39b-45a1-af7d-1d499acad56c", "sighting--8818b553-46ff-4317-b309-7310aca634dc", "sighting--8112bb96-5e1e-480d-b93d-45e33164e2ae", "sighting--91d6b1b5-adb4-4b5f-9b13-5efa64f50eea", "sighting--01c0c1f2-78cc-44e7-829b-737802a73cbb", "sighting--23ad8324-695a-48d4-91bd-46aaed9d10ef", "sighting--1e882e10-e4de-4bb8-8375-53cc01d2b137", "sighting--25d58c94-e161-477c-a153-40e28ddbd8ca", "sighting--9ed9dbcf-7ecb-4120-b55a-3fc4eb845378", "sighting--08a0d1e6-be56-4053-8920-a67da0968b83", "sighting--9243c4fd-4a19-4821-94f2-0e9a2f428e74", "sighting--43b88166-d8c6-400b-8eea-95c29e3ddb3a", "sighting--d384d99c-26d5-4d7e-9fb1-e8da9cada19f", "sighting--3ce278b6-34bb-4ca9-aa84-52cd990e698c", "sighting--ab0d547d-1c40-4973-95c1-6756159fb733", "sighting--5a867f68-86ca-4564-8a7d-67c8ce4c6919", "sighting--6a4429ba-786d-466f-b535-370ba7a30785", "sighting--7ccc2103-0b84-4622-95ad-30cd1e34584a", "sighting--8a8f734d-6ce2-42ee-a4f1-0f1bd39c2c5f", "sighting--3f3df11f-fec0-4ffb-829b-8d17185e5b7a", "sighting--9e0066ea-b4ea-4a3e-b007-50eec5f26f1d", "sighting--86133ce4-e9d8-4915-a530-44be5d6f8757", "sighting--79b28ccb-546b-4750-a23e-df07940a421b", "sighting--f38d95c7-bc05-4264-8ffc-55cf575d1471", "sighting--176f3199-7626-40fe-98f9-84f2c5a85af2", "sighting--01ad5b07-2162-4313-b83b-7b021a687993", "sighting--17ce2bf5-fe99-4d62-895d-e7696d885dbf", "sighting--4338b661-22a4-4423-8631-52790227da46", "sighting--df5ff0c5-7bb7-46b1-8739-c2bac4ee3ca5", "sighting--40f03003-52c0-4871-80f8-f9f8738b6fb3", "sighting--7e182533-5360-4aaf-bc34-f57e454b0d6d", "sighting--2cc88208-f146-4248-b56d-0b5b89145790", "sighting--498cef09-f759-4b7e-917e-58647147bf4e", "sighting--1b9737b2-10ff-4a69-87d4-731014136bd9", "sighting--ba43e525-8bf1-4859-bfe4-cc8a11b6d518", "sighting--9bca2007-7d84-4422-a565-2691ec676a52", "sighting--18116a07-f1de-42f4-a55c-4b6da3467381", "sighting--b323bbd1-9fe4-4666-bea5-25a847c2ff92", "sighting--3ecabfcc-9234-4511-817a-f525a114467c", "sighting--3bf805e8-bdf6-47d5-99d1-ea86e2abfba0", "sighting--b76aa6b8-ab44-4334-9af0-1a09a174c81a", "sighting--7dce03e6-f860-47b9-8745-a0e026dc54fb", "sighting--03dd52ad-dfff-4151-8687-fbdad30386b8", "sighting--1c9fc5c3-01df-4399-847e-4864c1f8ff2f", "sighting--521d3a2e-5309-40d2-9cd8-0f2d519644ec", "sighting--bb3d433a-52e5-4d1a-8efc-7a49b7e6c541", "sighting--d70a8617-0b44-465a-a5a5-8519ec3f4ccc", "sighting--11f9d329-4a97-4f03-8f99-06ebecc6e5b5", "sighting--e6e3121c-f9a7-43ad-850f-d698472f702f", "sighting--18660339-351d-4b83-99c4-8b61f47cc21c", "sighting--61a213d4-ba0a-42cd-894f-116485cc1e2f", "sighting--16148da0-18d9-4a59-88ea-55c10569df83", "sighting--f911d458-4f9a-4c9e-8851-43c2cbbf4bc4", "sighting--70a299ae-6abd-428d-88ab-0047d2da274f", "sighting--40ee48a0-a9a1-4fd9-af3c-9b80f6b5516b", "sighting--e83a2c15-2e6f-4c9b-9724-34b2dcbad2ab", "sighting--11a84ff4-2931-4e37-ae20-ac15ca1ea179", "sighting--fc4ee38f-1e27-4f50-8097-aa798839b9e2", "sighting--e3c7fb61-53f2-47a8-90fb-fa9dcabe5d99", "sighting--4411af85-d00e-4152-8644-5121db3c620d", "sighting--8e75b0fa-77f9-4eb9-8ef7-e430956402ca", "sighting--e7b3abcb-48cf-4122-8a65-f4feeff4e9bc", "sighting--7998630e-62bc-40eb-b860-a60309633093", "sighting--5f7d96c5-4c2b-4fa7-9b8d-acff1886bfec", "sighting--77a17f50-5c41-4c59-a809-809446ae8908", "sighting--eff4c471-cb60-483d-bfe9-ca009de7dd92", "sighting--a94015b1-04c2-4158-8c68-6539eebf6ee2", "sighting--063f6334-b4b4-46f9-b791-2abb82e9f33e", "sighting--baaac92b-ae30-4987-b313-9cbe273752b5", "sighting--23c59f78-314a-4c40-a8a7-2474221eb1a4", "sighting--0e1d0e31-cca6-475a-9e9b-8832472efe3a", "sighting--a213ced1-1a25-4239-8176-284cb987432c", "sighting--f4556cda-2c5d-4a74-a0c9-e3faeda0da56", "sighting--aa89ba20-1cf3-4cc4-a1e6-5b900fe05856", "sighting--e2b0f620-21cf-4940-99df-e0fea71ed86d", "sighting--ea751296-35cf-469b-8399-b512d2e2b09b", "sighting--07d790b1-3090-4c8e-8b17-e393babee062", "sighting--f9bd44d3-b803-4e10-b41c-e5fe2f1873a4", "sighting--2b40bde5-3074-4a97-bcf2-1cffda4dbb7f", "sighting--db140558-7a9b-4307-ba30-31dd33f2b4a0", "sighting--d3528393-4107-4f35-91fa-40430b843860", "sighting--ca49f716-cd52-443d-994b-fe3eb8d40962", "sighting--11f7b7df-67e0-47e6-ba0d-9f152fd5f360", "sighting--902de66e-3a51-4e3d-bfad-8bc41db81c5b", "sighting--1874d003-386d-4fce-9cd8-eef6cbf1dc6e", "sighting--4f2c586d-67d4-4ea7-949e-0e3e30acbf7f", "sighting--bd140095-a126-451c-afbc-1b00c81fb8f7", "sighting--b1a29e57-df14-4a80-bdc2-2d242fed19d5", "sighting--267750dc-866d-4d30-b056-4b593461bd05", "sighting--ecac0ee0-4031-4f66-a563-6fe46f6eb7fb", "sighting--05753d91-4192-44ad-90b0-5e728bb2722a", "sighting--c6e1eb73-ce22-4671-8a2d-9b233d8f10e0", "sighting--c2588d31-d8dc-4c8f-bea4-2518c2893b52", "sighting--dd869cab-d84e-40a5-8a23-28d7537372e2", "sighting--6f4ade22-bc28-4281-9b22-51bc253d763f", "sighting--b9ddc66c-a8c7-4246-971e-9e5ef961d31e", "sighting--ab72e4d7-a74b-4ec6-a729-4e6b8c832a88", "sighting--a30e0acc-eb2e-4779-a69f-7f1395a0fe71", "sighting--08d0715c-eb0c-44de-8270-a3838d74a83b", "sighting--9f236087-94f9-45d9-b5b8-d104a535cd6e", "sighting--14b6b90c-988c-484e-b7c9-8251bad1d464", "sighting--ec55dba3-f3d0-4920-a3ce-2011be669f1d", "sighting--842aad04-69c8-4c50-8026-c8a3324f329c", "sighting--9bf5d1e6-f6ba-40f1-8adc-39fcb343db11", "sighting--9aa764a6-1069-411e-9f8c-34e817153d79", "sighting--b2f43856-5365-4e1b-a0db-c1371d42c029", "sighting--f9111a0a-b952-4bbe-a2da-1042585c711a", "sighting--51681679-c6db-43e7-9792-08a14bbfb5ba", "sighting--a13b3506-5bfa-4c17-81ff-00be88737d9f", "sighting--95d240d7-9c75-4d91-83d8-7601acf20cc6", "sighting--af070793-9b4e-4e8a-8c4c-10ffe473a1a4", "sighting--52472160-d58c-4fc3-b8fd-360ad67abf6b", "sighting--d5750424-024a-41e3-80d4-7b485f0903fc", "sighting--9d5653c4-e29d-4de0-9505-b80c4d036dbc", "sighting--4a5ce1e6-b05a-426b-beff-848fea631cfa", "sighting--3a1cad04-d735-4872-be44-3d86fc31c89f", "sighting--86949a7d-c692-4081-92d7-dffb30bc35d6", "sighting--2fd8b7a9-d01f-47ea-ba4e-1ebff6700baf", "sighting--b6e4fd97-e28e-4568-829d-f588e9fb5fb6", "sighting--a553c92e-6dde-4db0-ad1a-9340ab949afc", "sighting--6be2e4b2-90b6-46e5-b244-161bd136450c", "sighting--8301025e-c4a5-4834-990e-dc8d5e84dcb3", "sighting--6b84b517-2238-4e1b-9e55-d0b97b684d46", "sighting--b59120fb-9550-4572-99ed-47febbed5d87", "sighting--b6fc3ac7-303c-4b57-875d-28221a2f9ed1", "sighting--450c38e8-8fa4-412d-984b-206aed772dae", "sighting--4f84a2d6-fe0e-49f8-a1c5-85904de070a6", "sighting--41864bf1-1100-4f5a-bb82-ca4194fd134b", "sighting--215f6b07-0b3e-455e-86a1-5a97f3b53158", "sighting--4b5fe192-ca9d-4afa-8631-976afa1c03b0", "sighting--86e48971-6b96-4147-842a-4cfd0cee01ec", "sighting--54f7cd0d-559c-415c-b2f9-557366f58f7f", "sighting--5e6b2ced-084e-4de1-8cab-d15a26d88aa1", "sighting--666a885e-defc-4940-a7a1-b509138e2844", "sighting--d6397697-a6bd-4f9c-ab42-faa9700b2057", "sighting--119ef0f3-8f4c-4598-8e4e-0b89a85a244e", "sighting--97e7e1f3-8d33-4503-8350-9d4ab2f0f03e", "sighting--1acf6ae2-5d09-4b23-a40c-c2e20e3d0dbb", "sighting--a0a9b8a8-e966-44d4-b481-9ab2a8e7bfeb", "sighting--78a252e5-9a86-4b17-acf5-0f3806700d94", "sighting--4eaa7215-7d05-4ddb-ac35-b7db63015c99", "sighting--56ba9073-d1eb-4f8e-8f06-d2518c60fee2", "sighting--2a7dd029-7aca-412a-86fc-e250c857f428", "sighting--e36ffb3c-3b8b-44ef-a833-72eb4efa4846", "sighting--a8aaa7fb-b053-43ba-8a02-f9dfc0056e49", "sighting--20dd3d42-ffe7-414d-8e7c-2be8fecafe9e", "sighting--ed3368af-99df-4430-90a9-c09b1d8c4b38", "sighting--2a2229a0-126d-4ffc-a6d1-b601824d34eb", "sighting--8f1bb02c-5d11-4650-8138-548c205851b8", "sighting--979821f5-7283-40a6-9eb3-f85b4f0cbc35", "sighting--71ca4ed0-686f-4bdd-8b60-ca2bfe111e5d", "sighting--1deb4e0c-973f-487c-b3d5-da5826b1bc8d", "sighting--a7e01a41-4332-4d09-9ce3-8ee0db7a7c6c", "sighting--9dfb9531-5da5-4ebb-aae5-cbf6792d7a74", "sighting--f5198f50-f2a4-4d61-8016-dbaea7a9febd", "sighting--59dcffee-609f-4948-ab62-fc817cdeed01", "sighting--2be6e1d1-e05b-45be-82f8-548b981c5827", "sighting--cae114d5-d06e-4c42-a558-6c003b0eef16", "sighting--3d7ed13c-9333-47cb-916b-1752dffbdfa8", "sighting--32c98ae5-badb-48e7-8fdd-d3696017b63e", "sighting--242212ae-4ffe-414a-9c27-5ff536646561", "sighting--04757b55-4eb9-4ee9-8e7b-565f388e4732", "sighting--95683420-4736-4c15-a0ae-b787365103f0", "sighting--8d71fe46-c3b5-4751-86d6-a7e8f06cc150", "sighting--d81dce1e-3429-420c-b05c-42b73f70ff1a", "sighting--de161a88-7ce6-4366-92ff-605f5c52422d", "sighting--f0857d4b-3025-47ae-90fa-f98e7e3e447c", "sighting--a79483cc-dd30-4c76-bf7f-95d54ee732ce", "sighting--de11c417-bd06-4276-83c3-2a50ff9d33bb", "sighting--69e27b4e-d200-46fe-8f44-8db6af452bdf", "sighting--fa0086e5-ab5d-4abc-b872-5fba92297326", "sighting--72950c7e-2876-4abb-b13b-1f79e36a9982", "sighting--f181963b-b8e8-4616-a9f0-9c7962cb83cd", "sighting--172c2e5d-2416-42dc-b6e0-eae02430a5f4", "sighting--d9d10542-8e9b-4e17-8907-22dbbd0b4743", "sighting--9fb21fd6-af79-4b83-9969-cb73ef1c209f", "sighting--438fdb82-42d4-4ccb-8aab-bfb4e9fdf6d3", "sighting--f61cc208-599a-4488-9ae0-9e62aa114185", "sighting--d1cf05d4-815b-499a-a155-a55d037557bb", "sighting--bcc44e35-323f-4ba1-ab4a-2c7f7ae96542", "sighting--f6a6190a-f502-42c8-972f-91140d632394", "sighting--3c1acc52-50e6-4bb2-8e79-a2e627d6857c", "sighting--33b6ecc6-1f56-43fd-b040-fd2e17a4d1c4", "sighting--171d6b70-0c1c-4e10-a1e8-c8c4ff4e99c3", "sighting--39977412-7aab-44fe-9561-98bf11ee35e0", "sighting--0a6f4c66-f3f1-4c0e-9c39-83cf7df2c8ee", "sighting--fe8ef819-20fd-4c3a-a00b-b7ef5c349d69", "sighting--cc7e20d1-a253-47da-8629-110ba6be5f85", "sighting--99190ec8-a538-4848-931d-69c1e97a0f46", "sighting--30ba4f65-48fa-498c-84a0-8472b95980e1", "sighting--e66f09fd-375c-43fa-9ecc-d79d13882196", "sighting--f44fae8d-8abf-412c-b554-779dc94fb9bd", "sighting--a6c44e58-0d71-41a6-a3b6-3e72d5ad8603", "sighting--497269ce-4e63-4925-a012-88a291ac71e4", "sighting--d9e633a8-25c8-4387-851b-6f0974406725", "sighting--cacfe5f7-a632-422f-8f90-21d82c9750eb", "sighting--c427f742-9814-46d9-8a65-9969317fac41", "sighting--4be918a8-935c-4450-9c2e-c13b55205529", "sighting--8128e60d-13b3-4660-982b-9dea6cd97fdd", "sighting--94ab4afc-eeb2-4bfb-98e3-a2924fd74f5f", "sighting--4a4b9115-0abf-4a62-a1d0-e07e7a4f7e94", "sighting--345cb3bb-1a78-46dd-a18f-17ec87922cf4", "sighting--948f82dc-959f-4819-9b81-0bd7e8839aef", "sighting--54d2366d-1fc5-4591-9209-f610266de1f5", "sighting--877032d0-f69c-4903-81a0-f5ae1e6a1beb", "sighting--900847aa-a6f1-4f10-8c60-1060a831a01e", "sighting--1df02d3b-7414-454e-b904-c658123ba7a3", "sighting--a24e8c26-872e-4226-852c-eb61901bc2cf", "sighting--184aad10-aece-4efc-8a2c-f374d8eaa65a", "sighting--71bd8356-c4bf-42ca-bfa5-aab1644e1b6e", "sighting--0d131103-ac01-49b0-b8ac-2e4f509ce20c", "sighting--afed4b07-2c1e-4c5d-bf1e-681ed31020ce", "sighting--f1843bf9-4d08-4fc9-869e-3c0351b7404d", "sighting--e45de312-f952-4a58-8c84-d19e2a249704", "sighting--4d598849-0530-4a9a-b4ba-fe53aff23ec9", "sighting--c7db6183-b63a-4c1b-85ac-616d04160dcd", "sighting--22d1671d-17b1-4e14-8223-00d17a740def", "sighting--235cfeb1-fa85-4686-a494-b9bbca2a7e5d", "sighting--ddfae1ba-6232-40b9-82e0-23ad50cce748", "sighting--a041e120-6488-4c7c-a048-4884bbc944dd", "sighting--9ad2444e-0814-4cee-8ccc-f0d6df122499", "sighting--bea94230-1956-4462-831c-a9205cf83f93", "sighting--b101b496-9c24-4db9-a27d-c34c5e553507", "sighting--0007b90f-0c71-454e-a9fa-5cad203ed445", "sighting--03e93fab-4738-4c53-b8bb-089682d611ac", "sighting--b4839fd7-acc6-4694-957a-f0ff54aa2b41", "sighting--f7b5c7d3-5f19-4266-8a4f-f9c0da0b58dd", "sighting--0523d4dd-4d79-40c7-a2b1-0521ad0af76e", "sighting--cfe261be-f6a9-4c34-95d1-3d699235b64b", "sighting--dd62197b-16c6-40df-93fb-ad0549fd4c8b", "sighting--e667fa46-0b07-4494-a7db-8498ed974e17", "sighting--9e302756-7433-4bb3-b783-0848ceb51ed6", "sighting--4391a6bd-2219-4499-9416-c8524e327fd8", "sighting--5bca1be8-ac4a-4483-8742-8dce99c4c8f8", "sighting--5296e728-bb04-4b7d-ad74-5de50f6d64b3", "sighting--662d51c3-cfa3-4423-825f-57311d0ff8db", "sighting--614b3082-de40-4c41-91cc-02098dabcd34", "sighting--e8989afc-89aa-4bd9-a650-a727e56b3e00", "sighting--0b2e2e8d-20c7-4b61-a815-d4426c7564a7", "sighting--ce229eda-491f-4d06-8f05-93d4975d0ce8", "sighting--81577b6c-2afc-4e00-a2e6-7fc6999fecee", "sighting--3178a222-602f-429e-bedb-73d3b76d9bd1", "sighting--9630400a-a1c9-4e53-b373-88c0c3bfa3b9", "sighting--79b7c4bd-e5f1-467e-8dc3-e0db91cac1c5", "sighting--304daf7c-631b-42cb-9dd9-d14c36fa0034", "sighting--ebbdb1f6-cee6-40e7-8382-37d3cd65d833", "sighting--af4d0cc8-6789-495c-93a8-58aa4dd6f4d0", "sighting--4d1dc70a-3db6-40e0-8987-404c0beb6892", "sighting--ae8e1b59-3f77-4d96-bfb9-32e351595bbe", "sighting--dbf72e90-caf6-45f3-a7db-741dc941fcd4", "sighting--2b87d415-57e9-4d6d-a362-1a1f967544ce", "sighting--d777b851-6535-422a-9abf-62c3be426d76", "sighting--7ed1e9da-9256-46a5-b5ee-7382fc93e225", "sighting--ec8e6b5e-8b15-4643-8fdb-3ae24db2555f", "sighting--1e5e9498-228e-419d-8d40-187b727dde88", "sighting--a98a7a10-f32a-4821-949e-02d9a424c1b9", "sighting--11270728-3412-4131-a19d-528836f4d89b", "sighting--10704631-4cdc-420b-8a5e-f625f3f33433", "sighting--072a833e-7058-4023-a8ae-7c3924165afb", "sighting--1c71b940-e76f-49b9-b32c-cfdb8b660d1e", "sighting--7ead930f-e027-4d07-b0e5-c5189739f275", "sighting--67b77a90-0a44-45a0-bf18-a72a87b36ccf", "sighting--0b50e290-6efd-4c9a-ba05-ff8dd6a893e3", "sighting--ded72e8f-4ee4-4517-b1b4-dc6b5bfe9bdd", "sighting--d3f4a7a8-e6df-484b-b7b1-39550b7016cd", "sighting--73e459ff-ee08-4fc8-b1b4-1f4f6ea0b1d8", "sighting--2bff4ae9-4f27-45b0-87a8-58ab13133e57", "sighting--f446abe0-8c29-4f6d-a871-505f305e20be", "sighting--3800f145-85df-4956-b8eb-775c0be620d7", "sighting--dbbbb7bd-53b0-4183-b863-a09519628c1c", "sighting--987e0a00-83b7-4787-be4a-880a228c41c5", "sighting--e9cb5778-cdff-4e13-8de6-272437b7c05a", "sighting--2998a528-7c23-43a6-95fa-9bf0c7bd30ce", "sighting--592cc6a9-5e3a-4112-8b81-021ecfcd9493", "sighting--e1f75915-9cc4-46dc-9de0-20ffa05a61da", "sighting--5ed8a9b1-773c-4c9d-8fa4-ec56d2c0707e", "sighting--2b98b1b1-4c0a-4221-b890-3414e112c414", "sighting--93b7b86d-303c-408e-959b-eaaf5920ecb6", "sighting--4e869d05-8852-4d3f-837e-f327703655ae", "sighting--6e142bdc-e543-4021-840e-86ca0f197a45", "sighting--302aa8b9-9b73-40cc-9a94-3fe56db25b3e", "sighting--aa1e748e-6d49-41b0-9431-a4598aa8f0d8", "sighting--6d9ad7c2-92cb-4569-9892-c8a1c361bc7d", "sighting--f861a9ff-9756-40d1-89a1-ecdee06fdd2e", "sighting--b8625288-2185-4b58-88fa-9bc2796d37e1", "sighting--7644c1dc-74e5-414f-8d30-134596b35ed7", "sighting--1bfbf141-5450-401e-8815-e69895a52df8", "sighting--f2aa9414-d90a-40e3-94c6-641a58b9f395", "sighting--c10dd988-a7a0-4f68-8303-e3e012271d21", "sighting--7e98bbc6-59dc-4a8c-90b0-2ae8deeab324", "sighting--f4117707-1c5c-4cce-9cde-08bd02954502", "sighting--1eea3335-2b3a-4938-aef6-09add5d7225e", "sighting--b6a5ff0d-e94e-415f-81f8-8ad98700a3c5", "sighting--8b758c48-8e67-4f70-aad6-4860dec99b66", "sighting--98a37b29-450e-4f6f-99cc-1601fe970a13", "sighting--45628d5a-c99e-46da-97aa-a0930dad9ce2", "sighting--8e7a31c8-a3e5-49f4-9f0d-6b88d5bd5da6", "sighting--050ddf71-c070-4ea3-abe6-f0e78c67d5c0", "sighting--783395e4-0483-4df5-8b94-2441196274d3", "sighting--4d84f099-3348-4df4-8daf-d66f5776c69d", "sighting--7ac18d92-edd8-4041-bd23-a9f98f8dae5a", "sighting--306f3eec-f164-45e8-8990-31d4954e8ecf", "sighting--a440dae5-b586-4bee-927a-35402bb47080", "sighting--c18ea2eb-dc8c-4bb1-8031-9607b8ed489c", "sighting--a96eb3a4-91f6-41ee-ad23-9d9f3397424c", "sighting--77382717-38a4-44bf-ab44-3809a80eeae0", "sighting--bdcd55cc-d311-4f73-b792-56fff7b0d6f7", "sighting--ef391b2c-8b63-4228-b279-b07ea1c13e8b", "sighting--e377b325-b9aa-4d6a-b0f2-2cc62b397817", "sighting--71c2a54f-c1b8-4ac6-a364-0396f80e7374", "sighting--2ca660ce-3455-478b-be88-0e37d038baaf", "sighting--33038230-18d6-4d2b-9284-c9b2b79f11de", "sighting--15922c07-8082-48ea-824d-6264a7bc0407", "sighting--d0e00868-a74c-41ca-bf36-20eeee4a55df", "sighting--46285e24-38f2-4d44-8cd9-5dee75490cf1", "sighting--5539507f-ff4a-4518-a338-abbf36d2aee0", "sighting--ba3a9f38-d52f-4579-b97b-ba10fe4c95b1", "sighting--ff610bb0-64c0-49ff-a993-551512e800bf", "sighting--e1ed41da-3c48-468f-86ff-9be9d0df2ca1", "sighting--232d7a98-cc3d-437b-a90a-e159d6aec0bf", "sighting--40a5855a-d9ae-49bd-b2b7-48b8f78711ce", "sighting--78245ff3-bf04-43e8-bf8b-40e8e073a02f", "sighting--4a45b419-4045-4de0-9858-846fa547eeb5", "sighting--0052066a-22f2-450a-9ff8-836d208c341d", "sighting--7ba9d7ce-a456-4b2d-8791-8d7b939cb811", "sighting--26830cbf-11ea-4267-89b6-6b1daa3d2088", "sighting--d4cc57d7-737b-4075-a58e-a5d0dedd526e", "sighting--8ca297e2-1e7d-4bb9-8a90-f6e8744bba34", "sighting--d2e4760d-286f-46c6-a469-d4c7e6472a75", "sighting--543d655e-cdad-4e85-97bb-77f2284a6033", "sighting--3e42d394-cad8-469a-a1ae-6a44f6588771", "sighting--c90ea4bb-58af-4fde-884b-6e1b42698f5c", "sighting--7aa5e8d8-03af-4eb7-83d1-940375593f4f", "sighting--5da540db-63f8-40d5-88b3-8e27923bec91", "sighting--2c7cedd6-cbd6-4853-8d5b-7eac52acdbb7", "sighting--37bc78b8-aa40-45ed-b627-fce59414c041", "sighting--cba8a24e-05bb-408c-9823-8a1c12ef194a", "sighting--f4f7ab57-926b-4ee3-aec4-b2c646a0ec05", "sighting--8d944994-e913-48f6-810e-d0cb6ebc45e0", "sighting--64e55470-c15a-4389-9b66-86b37eda42a5", "sighting--24fa8b07-4d7a-4ebe-9d81-4ff2384f8d8b", "sighting--5740ac2f-4731-4e01-997b-4de70a548cfc", "sighting--9343a337-f742-4837-8231-eb9ca0749814", "sighting--2d8d295f-6fe7-4079-8a29-1fe6dc11d19f", "sighting--4980d210-5173-4797-87a3-35aced087a2a", "sighting--8b673313-ac1c-47de-9c1b-a792cdeed73e", "sighting--cc5d2f1c-1d35-45f5-a81f-9bd7a832f164", "sighting--3f66afee-0674-4e6a-a442-c6375da6b734", "sighting--0c420767-bcfa-4e9a-8133-3c0ff67204db", "sighting--971c612d-6b84-42c1-8a58-3dfb03e00662", "sighting--e642b82d-82b6-4847-98a1-af4377c82d7c", "sighting--2f12527e-e050-4209-9819-7779ae11a717", "sighting--baf8e7ea-9141-43cb-958e-821e8b210255", "sighting--580caf80-0074-4a4f-a494-a7285a035e5e", "sighting--41770a07-d486-4580-bd75-cc1e3669d55f", "sighting--4bdafeb8-4f01-4c6e-945b-d45bdd169598", "sighting--ab3253da-7188-49bc-8dfd-5f07d0ba1e23", "sighting--a4e513f5-03ef-4cd6-a746-70b9dad30e53", "sighting--2b5be085-d1ab-41bf-a896-31a2ff51c7bf", "sighting--0ed19249-98ed-416b-b109-bc34b10d492c", "sighting--0e5f853d-df1f-4268-8839-7133988098c3", "sighting--c5cca3ee-d7ff-4b3c-af74-29d45c5fe4c4", "sighting--3fa68751-d43a-4ab4-94f1-46cfcf757d99", "sighting--acf41927-017e-4a41-a27c-953b39d491ef", "sighting--edc6ce84-6160-4c23-a3e2-469f4aab34c1", "sighting--dfb2fadc-3983-4e13-9296-543549919e05", "sighting--175275e1-1b2e-4b93-a5bb-7f16d68f9b48", "sighting--9b93db27-8959-4520-a5d8-57c0b45b351b", "sighting--c9eac416-8149-47f3-8c9d-4a6d93409202", "sighting--de7f0dff-6e84-405f-800f-0c15a7692582", "sighting--4304b5e0-dd28-4687-a4c7-7bd69544eca4", "sighting--27a002f3-621d-4c26-8f0a-7b19c9f8f8bb", "sighting--3b73769f-7648-4d8f-baed-86d65d99682e", "sighting--6806eb90-2010-40af-b36b-8d061ad982b5", "sighting--4b6f1d34-1450-42fd-889b-4c655572986d", "sighting--93936e6f-21a2-4e5f-9183-32f746354dc7", "sighting--31e7299e-12e5-4f38-9a50-41688de07024", "sighting--9f528537-3b53-43cb-81dd-d652feed2dba", "sighting--1c23a77c-770a-4195-83f7-b85aadd5177a", "sighting--58bbfd3a-64cb-4735-82d5-d63a16e279b7", "sighting--3be2124f-d150-416a-9325-74deecd2e6b2", "sighting--73cffe50-1f1e-4335-bc40-9156963a1fa4", "sighting--c1821471-2881-4ab1-a815-ae1f71034f36", "sighting--ef468639-1082-4745-8dfc-2ac62574b367", "sighting--413117f2-2b0c-441d-aa7e-d3cfb0cb0e6b", "sighting--a076518a-55b9-4f79-835c-8c8b238c5f88", "sighting--50a2f2ed-417f-4337-b21b-2a0ecefd1c85", "sighting--101f509f-42a5-4f5b-b977-e153bda48010", "sighting--6fb43667-8cf5-4d85-ac2f-6ba99b8037e0", "sighting--8659f84e-42e9-4fd0-a97e-073934db1622", "sighting--53d21a7f-facc-487c-9059-5f51cdf9f252", "sighting--85b1b59c-c20f-4201-8034-fd3fa6a908a4", "sighting--c41884fc-42f6-45c9-948a-45b913b6353d", "sighting--aa3d9f65-9549-421a-b80c-40f9585ea9b3", "sighting--742bf8dc-62fa-4759-abc8-06ad21acf6b3", "sighting--8a9531ce-f30a-46b6-87ef-0890e849b9f7", "sighting--3fc51b0e-6e7a-4bb8-b746-80385a8bdd1a", "sighting--2d67e311-b9c6-4e60-8f91-0def3ab39c21", "sighting--c801bc47-6fa0-4333-a516-08f00ea18fe1", "sighting--d447b5ad-8de7-4666-adfd-ee676d465dd3", "sighting--1761deb3-0779-423d-80ae-dfc21a88591c", "sighting--3a58e27f-b361-4330-b310-b7a893edcc38", "sighting--2d735aa9-94b0-4b32-a90f-ed6d963fac24", "sighting--ceb36844-0338-452c-9d27-d1ebc447849e", "sighting--78fff71e-d70a-4b4a-bc41-0bf8249b0cf1", "sighting--15047dd0-f693-4d5f-8e56-4259d17815bc", "sighting--1b4d4884-ef07-45f4-bdaa-1c446d040800", "sighting--64568c27-5959-41f7-b841-e2cce065a9d5", "sighting--5422a6c5-a715-41a6-9796-57740e68f1ed", "sighting--cde5b2b6-c452-4c70-9728-ca67fb15f797", "sighting--7fd356ff-b697-4151-a100-8cd342d1e6e5", "sighting--543b5c81-1eab-465d-aa1e-f3f5b3999335", "sighting--c4c89e1a-20d7-4ba4-aa86-c80f1c9cbf81", "sighting--8fa6f89c-0856-41f5-9344-309b5f9959cc", "sighting--ee84398d-3d30-494f-a4f7-0738753c8fcd", "sighting--d6a3b0d7-4bf0-4749-8244-9b4f457e68f6", "sighting--508603ed-b942-4c00-b8b7-383d0afda7ec", "sighting--253da5bd-1f98-42ba-a180-0b6deda1a780", "sighting--6cfd599f-a6b0-4fa9-8e19-9c42ba142f96", "sighting--5db5a7fc-ffc4-4403-bc81-02cc1594dec3", "sighting--be1e657c-7f9b-4c72-8a44-45be5678a3fe", "sighting--09230cf4-7bdf-4112-951f-9d3471149fef", "sighting--5335a026-28fc-4d75-9569-e4a7efdd896d", "sighting--fc0a0407-732b-411f-aa64-e0023ec0bfeb", "sighting--891cd2c4-c118-4583-86e3-4d7d432d00ec", "sighting--b16d85c0-66b0-4fa8-a558-25ae952c9eb0", "sighting--d79c9e74-a46a-4393-b544-3023e70796cf", "sighting--94a47e88-c52a-49ba-bc05-f26049fc6784", "sighting--d3baa688-40ae-443e-9e95-2e1bef41de31", "sighting--c1d303f1-71f6-4e6b-aac0-e86605d7fc65", "sighting--79d734a9-72b7-4980-bfb0-969f5a3a6ace", "sighting--7b2c88cc-b977-4a56-b86c-9cb520f7d873", "sighting--190b5e08-6928-4ea1-a7c3-2e2d6a08328e", "sighting--e29dc220-5d18-48c7-b962-127d4f8757fb", "sighting--455f4133-1277-4c6c-bdbb-2f942f6c625e", "sighting--8c93675d-400c-4dd9-9532-38cb7ff1e371", "sighting--0470b214-76c0-4711-9a32-55beab518986", "sighting--afd79424-93c6-431d-988b-eca190f175eb", "sighting--e24266c3-ed21-4c79-b989-aeabc1d48dfd", "sighting--04aaca47-1365-4382-bd3e-ac764dd63331", "sighting--2bee11af-ac0a-49df-962a-85842e90fd28", "sighting--7f2313ab-782c-4b99-a616-7f34eab59465", "sighting--60e8ac16-9c27-4692-85ba-b30bc2ab8c10", "sighting--16683ab5-fff5-49a6-94e5-771936018e7e", "sighting--43f76a4b-67b9-48cc-aafc-d7e518757637", "sighting--8567b42c-8407-4358-80b8-4895a3782aaa", "sighting--4ade3956-36d4-4d96-a939-58e34ef67267", "sighting--44485404-5743-4e1c-8e52-36a74da1f645", "sighting--1cb33922-796f-4a3d-bb55-ded73c3c1be4", "sighting--c43350d6-96bd-44e6-882d-59e0edcb8ef8", "sighting--445ef678-a2b6-401f-b592-467fca2509d1", "sighting--89dc1baa-90bb-4871-9d49-bc42eb3146b3", "sighting--ca5f7e59-c706-4271-9a8c-432779357f5d", "sighting--492bc1c2-2f96-46a5-86a0-85f2e4f3e0fe", "sighting--da19d2cf-35c0-4a4b-8617-bf68483b9946", "sighting--2bbcf6d3-8ae3-48d4-ba1d-31fb1712a7a0", "sighting--65fcc61c-f511-40d6-91d6-f7643612b857", "sighting--0e876e8e-961b-4f99-a6f8-29d395ce6bfa", "sighting--cbce03e8-538b-48af-a86e-fa9cb3b940d9", "sighting--b1c6b788-c0a6-4d2e-99e1-b4a3b2fb3076", "sighting--52b81487-0523-4b44-bc84-fbfe52ce9a3a", "sighting--3e7bcf0b-d1ad-468c-a292-a705e3c627dd", "sighting--0ae2da1d-05c8-4b68-a644-a76e028455d0", "sighting--dfae1fcf-391a-4bb0-8da6-d0615e563432", "sighting--1303ce9a-bc6b-4bc0-8d8f-06db8245ea81", "sighting--29a4cdd7-8bab-4ab0-b952-683b927e6f7f", "sighting--89db005f-75c9-4611-bf53-f2e96de3ba72", "sighting--6f60ca3d-0624-4709-b6e0-8bbdc23f07eb", "sighting--e51b34ec-6bef-4263-960f-d40bc4581cfd", "sighting--7634718e-c1eb-4700-a260-13a6d72f0be6", "sighting--db7d41ed-1108-42fa-9981-f5620b8844d1", "sighting--749dbb97-faa2-46fc-8135-b778ca9a1555", "sighting--a2628183-74f4-4472-b322-b6bf0f85d1ce", "sighting--98f11f0b-3380-4bd5-8340-8f9aaf887185", "sighting--f68c0874-1dbb-41de-81ed-94c0ef6f76c6", "sighting--d052af77-5d9c-429e-ae6b-256e5347de53", "sighting--9fa9c6ee-ae20-4a4c-adad-e6747eeadae2", "sighting--a1655784-e52b-4944-bf64-0981a5ed7c23", "sighting--ae6412b4-6c92-4f9e-9d94-fbe703957f03", "sighting--0a23f166-08d4-4d64-9cd4-54a10f872e55", "sighting--a83eafb4-492c-478e-9b86-977f6fb0bed8", "sighting--0589f6d7-f74c-4f29-82af-07304dc9b772", "sighting--e809806c-89fe-49c3-9548-55a8498c809d", "sighting--c856cf60-888e-4111-ba02-f99f093ebb1f", "sighting--e7a52190-b6d8-472a-be26-c73dede30dc6", "sighting--3c1c649f-007e-49e2-b94a-f7ee1a1890c5", "sighting--837f4ee6-ff52-416b-9f5f-562315097326", "sighting--6a38a394-6b4f-41ba-b0b8-6ffbbe880bff", "sighting--3672a952-b7b5-4670-ac80-905063d765f7", "sighting--e5c5559a-5b83-429d-9311-9160dc2cf66f", "sighting--acf03eb9-e11a-4309-b30a-09131a527be6", "sighting--32f401fd-a60b-4f83-94dc-10879149fcf1", "sighting--1875fad1-1ad0-4745-a63c-b0c5d850c619", "sighting--9d6a2efd-096f-43c4-9026-112a848d10fd", "sighting--9ece5933-0a9e-4d4f-87b6-0bd3dab7d133", "sighting--ec0a1eb5-231b-4fd3-8af6-c3777ed956a5", "sighting--74dac928-8c89-4ad2-9314-9b47e5bfa2cb", "sighting--b899448c-6079-4c9d-b989-c77b93253a1d", "sighting--9b743340-5b23-44b8-bcaa-2c362a99e588", "sighting--c3c5eafd-558e-42d2-a675-5f8dde770e11", "sighting--f8b5adfc-577f-4aa7-8bb4-d79565b80f1a", "sighting--03f073c6-e2e1-4771-83b5-083e087be9f9", "sighting--a3d930f1-f82f-4de9-9e01-f869e477ece7", "sighting--f1abb93e-cfbf-4845-bdfe-840da4c2fd85", "sighting--bc44ce3f-515e-46da-bc48-e804157b9eb2", "sighting--7276eae9-0aff-44cd-8036-ccc5acf51f58", "sighting--7cf9b758-4022-45ba-acfd-d4af190bce5c", "sighting--de8a0e0c-4b02-49da-b9b6-f31879e29b32", "sighting--20ca3a34-1f98-456e-8919-bfa277c13501", "sighting--601d4ce8-dfa7-4c05-b9df-fecd99e4c37a", "sighting--3f428f96-c4cb-4bc0-bfa6-5237e236dd29", "sighting--725bb189-23ad-435f-b8e6-d677e4100bdf", "sighting--1677bcd0-9e71-4136-bd19-61011f396f20", "sighting--93581b01-ed14-4543-a1d3-ab3d8efd139c", "sighting--b2e37bf3-a6be-4c58-81ba-3a2e82e59a2d", "sighting--d0951ac4-a0a3-48f7-92e5-7e972461dff8", "sighting--1b8d56ab-0a79-46f7-a64e-1693fd2488e0", "sighting--96cf331a-4002-4468-9a30-7d860c7a69bc", "sighting--254ce268-534a-425d-9f7c-de1e2231b058", "sighting--1138ed86-1ca9-444d-b336-9099fb72745e", "sighting--d75e4c7a-2273-4ec2-a28a-36166f478546", "sighting--7ff7f2ac-8640-4532-80b7-c4df701e4776", "sighting--d20db80a-529c-41ef-915d-37e20fb9741a", "sighting--f1374b31-f696-4584-b482-e38ab2cac24d", "sighting--217b4268-bc5c-4e6a-bbb4-11715be1e9fb", "sighting--134ede79-0f6f-4909-971e-3038931ecb9e", "sighting--bc2b8f70-5a22-4ff2-8672-df542c803693", "sighting--6a51678f-7d69-4fbe-adb2-8981ad65cdad", "sighting--4118c869-6bb6-415b-abc6-5b884946d2d6", "sighting--3d59cd39-99e4-49cc-8e7d-f2470a4102c3", "sighting--bd912da2-6781-4017-97b9-2e9231a21093", "sighting--98a86577-f026-4127-9c9d-b15b4f90e30a", "sighting--405c601a-230b-4ad4-8537-a2eeb46de942", "sighting--089855bf-d653-4df3-9587-bf8b454f2171", "sighting--8c9f5c40-12be-4eba-9751-73c27cf89f04", "sighting--744e6cf0-3a3c-44bd-a25a-8ef0e3a85e4c", "sighting--dd2e899d-8afa-4158-93c1-920448223a10", "sighting--d405ebc1-06f0-453f-be3c-29e2f64e7ab4", "sighting--7f510cdb-6699-4074-9f11-fd8b6035f06a", "sighting--fecb6a19-9658-47b4-af21-58f323719442", "sighting--89202f91-f019-420f-8eda-1e456f5e8ce3", "sighting--2e279954-54d3-441f-9b97-ad483921ed24", "sighting--df3bd668-5e22-4504-a3a7-35df6749bcfc", "sighting--c0a2103e-f413-4061-84ae-d55c1427b728", "sighting--ed0e7130-5088-4c56-9acb-209c4d6ac355", "sighting--be8ca935-6377-4f02-a697-24e6457a46c0", "sighting--0d94f12d-b2f4-48fc-b107-905d79e813b4", "sighting--0652ff9b-368d-4331-a127-07002c2a3e25", "sighting--d61505bd-745d-4c11-af37-d608e7818268", "sighting--d25f4f15-b31e-4397-828f-8d301461585a", "sighting--5d4b7a43-401e-4f88-b1e4-0607a6fe8ed0", "sighting--f4cdee65-ac8e-4411-bd94-f807932092fd", "sighting--d7a945dc-6e78-468a-9d61-340d87bd4376", "sighting--0b913e52-db01-4cbd-bf77-c828f879fa52", "sighting--64af4719-b3a1-462f-b17e-a12fd242bd4e", "sighting--0763e42f-5a44-46cf-813d-d9ce8eef106f", "sighting--815f0471-efd7-42ee-b40e-ea4a9e9ed575", "sighting--ba654f1e-9f88-40cb-971e-e53c59f9b0e5", "sighting--71d854c7-ac5f-4760-83e4-67933aa718f0", "sighting--dec72e45-e202-4528-8a30-924e4da13e45", "sighting--c2e201ab-324c-4f81-8a17-26ecce50265d", "sighting--84c74ff3-16cf-443f-be3d-e2596759d77c", "sighting--7f5cd454-9ced-4138-b0f3-9f67a12dbee9", "sighting--387a0f43-c081-4da8-8d85-6fb884c03583", "sighting--6b377908-4a7e-4beb-9a1f-c5e2e5f6819b", "sighting--fa85e560-0ad9-4697-9dbf-160bf54e97d5", "sighting--c3b41304-acf8-4b4f-9b2d-46b7147beeb4", "sighting--8e9c7e65-adc7-4f12-965c-c526e12a0904", "sighting--05c71024-2d65-468c-bde2-4a041407afdc", "sighting--4d7c95e1-faf2-4a87-95dc-9b5ca2e85388", "sighting--e213b8f8-f8af-41f9-9d9b-10e427525f19", "sighting--da000e85-bbfc-4a65-abb6-6cf2dda3b966", "sighting--243a3363-5b17-4873-b707-39a4d44321c0", "sighting--39ce594c-50a6-4dd7-a873-54f48bb1da21", "sighting--c9e58d0b-ff8e-4b47-8d25-01ec66d4efd9", "sighting--6f2fac38-1862-4fcf-9a35-d53f82559186", "sighting--89482ce8-183d-4713-bf6a-30b3c0e7c6c9", "sighting--3d2ee6c8-8d0a-48a5-9da4-9f3077054be9", "sighting--dff8b595-7e9e-419c-9f7a-afc7454cf897", "sighting--ed33df67-509b-4bfe-b2be-201da72b03ac", "sighting--d3885ab8-300a-4d50-b200-49064aff4f37", "sighting--61a32b3d-127a-4cab-8990-3bd4be157e86", "sighting--71f6c48c-0449-40a3-96ec-0c94f8189a5d", "sighting--1540185c-98ed-4ab1-992d-dd2bac9d117d", "sighting--12bd65dd-550b-48b6-bb89-701dfc675c22", "sighting--bff16244-3f1d-46f6-9ca1-4c167b1e371a", "sighting--e511e01f-0a58-4f5b-a0e0-02e13af784f4", "sighting--5daa1dd6-da92-439a-a970-b4382bf7ed89", "sighting--5b5e8548-992e-499d-86c5-9922c7e341cd", "sighting--9afd69b1-b286-4246-9435-2ef68e4d06e1", "sighting--76c78d1a-f73a-420e-b6b5-f23da48c3033", "sighting--d6618f4c-050a-432f-b0d5-2123b200f58d", "sighting--d46472f3-b19c-4144-be5a-9ab416e4c2b6", "sighting--06176c07-75a8-4172-a253-c1845a027dd1", "sighting--32b08a98-ba36-41f5-bd72-e61a2f24b67f", "sighting--7abfc510-7da8-4a30-8d90-f76e999aff7c", "sighting--067f48c4-6378-48e4-9eda-b960e54051c7", "sighting--e7e9bded-7e3e-4552-9217-593db61c8a8a", "sighting--4c2e9234-a189-4931-ba8b-4c2d94167e10", "sighting--c43387be-22fa-4c22-bf92-b77c35d9a9c7", "sighting--ca375d23-290c-4f7a-abf1-410c98506c55", "sighting--8ed9260f-a2de-49c3-86d8-2cf3a9c2ca58", "sighting--96e8b74a-02a9-4738-8a04-c85cc42622c7", "sighting--425ad747-b5b0-4e3c-b611-a5131fafdfe3", "sighting--f858b5a2-535a-404f-9e8f-ff14fdaeb847", "sighting--6be62046-790e-478c-b152-63620634e9ce", "sighting--991f95fc-85a6-488f-925b-b8e2955a225e", "sighting--39dd5f46-4b0a-4920-ae32-df6f6c670b6c", "sighting--8ea0fe21-eca2-4e01-ab92-97611aaf4467", "sighting--a9e20836-cd18-4c3e-abd5-37aa9e412c3d", "sighting--4adeb6db-cfcd-4534-997b-851cd71c6f1a", "sighting--de3cc5bf-2b07-4271-a17c-419e2985b209", "sighting--73507cb6-df74-430f-8f41-c262ccded315", "sighting--0014b85a-f150-4ddb-a298-5aa405b0109f", "sighting--2f590368-2f6d-4dcf-b8a7-28ec2be800eb", "sighting--e21c50ed-7569-4088-b174-cbfa0fe61fe9", "sighting--437f7052-8609-4f90-8990-8f50c41c16b7", "sighting--84059b59-ce23-42a2-847f-1d578fc23481", "sighting--691dc98e-acae-4941-bf25-26e425ef19fa", "sighting--3eb883f4-0449-43db-a3c5-02d3da3eee1c", "sighting--abb3638c-1971-4ad3-915c-4643d8f33a5b", "sighting--8eca8b88-28e1-47b6-b961-b8d00095d582", "sighting--f80c565b-222f-4903-ac6b-878b5c2b831c", "sighting--6a911521-c15b-4852-b667-f8289bde7dd7", "sighting--561f9bba-5ffd-43b0-bdd2-9090afc13404", "sighting--94646f48-e1c5-4af0-9e47-368e98c17337", "sighting--1b27182e-3fdb-4a17-8740-8d22f28bd19a", "sighting--45628a5b-b9cd-4877-bd2c-e952d0d87e00", "sighting--f759afbb-928b-4f71-8239-3746af2f30a0", "sighting--ba130dfe-8cb6-460a-aa00-2c2858f3f7b5", "sighting--93d5befd-a2dc-45a9-bc80-bd0139fa5597", "sighting--0df6dbc5-86f0-4fce-92cc-44351ab1d07b", "sighting--3fd4d2f2-0201-4d73-9881-c44be54a626b", "sighting--4efa517a-124c-4127-a1cf-891090882b5a", "sighting--aa4fc6fa-3fd9-4915-89b6-0f068d7f8cf7", "sighting--2aa99f5c-98a9-4441-baef-3abca257cc88", "sighting--1942a4e5-e54b-4a08-bf45-a2e2e7251a42", "sighting--e1e3bdf9-0fe3-4539-9ae0-07e6c81ff683", "sighting--fe1d389f-313a-4aed-8cd0-22181fc72ccd", "sighting--47eef3be-e2e4-48f8-8b33-31f4f574ffc7", "sighting--b233cdac-f192-48aa-b69e-7d23b8f5b7e3", "sighting--56989804-8282-44f6-9e6f-2898b08d476b", "sighting--69e30eb6-fc77-40dd-9571-7547f9ae32c2", "sighting--27c00267-a393-45c8-9367-53b141d006c0", "sighting--c6af4c0f-889b-4a91-80bf-d65e5cfa35e6", "sighting--27c39caa-4fc7-4454-b908-e95ba8322f56", "sighting--40b78920-038d-4468-aa77-e12970962c46", "sighting--c86a31b8-46f3-4c80-bcab-7a8c80286a84", "sighting--82c3adad-4ae2-42d9-9042-c3304d1fc05f", "sighting--d44f5310-ae26-4fdd-9d0a-b2310d287ac3", "sighting--60156187-167e-4d71-ba3f-2973512bb6dd", "sighting--b64445e8-7053-4a32-aa6e-912e9bb788b0", "sighting--d96b08fd-6479-4d72-a121-69b92dd0c1e8", "sighting--265f8c7a-e6c2-48e0-b660-614a1131d5ed", "sighting--05711004-780d-4db2-b34d-adc437e4859c", "sighting--dbc94bf4-4915-46e6-aaff-287b54aa95d0", "sighting--915b4919-4028-4b09-a4a5-b215a2694e48", "sighting--7596bdf7-c664-4a99-808a-dc40b097499d", "sighting--882a48ef-c5cb-44b0-a919-2668035ea230", "sighting--1fc867b3-68c5-45e6-842d-3016130da349", "sighting--61fd8a0a-c9a1-4c34-84ad-395e68ab8d55", "sighting--c01bddc5-dea9-4e3b-a3ef-8ab2e68e6ae5", "sighting--d43ed6a9-51bb-460e-b0c8-3a4cd60b34e8", "sighting--50e3a2b0-5bed-408b-8631-31bb34e47fdd", "sighting--e74dd056-3a59-4be1-a7aa-bf9f9e6f365a", "sighting--3894b6f7-773b-4902-9b9c-6f2b12e270fd", "sighting--1cf9c2a5-af84-4005-bfcd-97cdfe8bc0f3", "sighting--de9bec56-f1b4-40cc-9484-9b13837740de", "sighting--4ce39f8c-fcf4-48e9-b5dc-f33862d384d4", "sighting--a6e6d364-c743-47be-8f91-364e11934df5", "sighting--86ff8a9b-bdc8-4eb0-8d24-88b04f5f0c01", "sighting--df8ebd89-0d36-484f-9204-37b02391dee3", "sighting--b9d89f0f-1dd0-4981-bcbe-1d7208d7a58a", "sighting--5ce0bf4b-b485-400e-b296-45708aa6701c", "sighting--18d35d50-eee2-4c7d-ac08-6f179c7b3c91", "sighting--8353d40e-72b7-465c-94c8-f2772fabe316", "sighting--b33831b5-d0ac-4635-aee9-7662506b6150", "sighting--0e3315e4-8181-4562-a76c-3bcd3eee13cb", "sighting--07ced39f-0628-40a8-a76d-06225538dcf2", "sighting--2efd2486-ec34-40c4-acf2-a1e8fa760b49", "sighting--ef4274f1-96fa-4ff2-a31d-a7402a1d812a", "sighting--1a7c9add-ea5c-4fdf-a2f1-edb46fc6ed99", "sighting--0fba0fb5-9c9a-47db-86ad-a1f759df8b85", "sighting--74389709-e9a5-48cf-93f1-71682c471af7", "sighting--3b7cfdda-282f-43f9-8ab6-04aa286e70b8", "sighting--42ef3b87-e33a-455c-99e8-df5f56087412", "sighting--d5991338-a3e6-47db-b16c-e96bdd87e834", "sighting--d66cdb4b-79e9-482a-97df-888773c28281", "sighting--6f749c93-aa1f-46ae-8be9-574ef54e0239", "sighting--006f8fd5-f908-4ad9-858d-d773538a6736", "sighting--68791bae-8561-4950-b8ad-154292bec87d", "sighting--654cbc46-77f2-4fe3-b9ec-c9e8053bdaec", "sighting--877e56cd-5a5e-49cb-bf22-dbc0ba17806b", "sighting--944f1c9a-6f3e-49a1-a367-f9fe2d49183f", "sighting--00e93840-f9c7-416e-a81e-79c5822cd859", "sighting--cc253662-f004-41fb-a4cb-6bf6799897ce", "sighting--bcc1599d-69b7-4740-9528-ffebe4f11a2d", "sighting--e80cdcad-69c7-459d-8015-fe493dc2d3ec", "sighting--cd208db1-c8ae-4edd-9c47-4260cbe193c5", "sighting--8586f208-3f97-4f6a-ba9f-deb2a2133523", "sighting--9c57ede8-4878-4cf9-985e-1856101b0c2d", "sighting--9d22aafc-8b1d-4815-a6ad-c787250d3889", "sighting--b6d66b97-87ce-41ab-9c36-4a3c297a1ef0", "sighting--e2fbd901-172d-48e9-9ac3-925b1d2d85a9", "sighting--5e1f7e59-282b-40b2-acfa-37a622895c17", "sighting--47c8ae90-0d2b-4b48-9c5a-b9d52ee85084", "sighting--5237dbbc-b6de-46a5-851a-439ec627c412", "sighting--c4b072f8-e224-4aeb-9c33-89c155bd7470", "sighting--f413e28f-7cb0-4106-afc5-bc40d3109e2c", "sighting--5b5c4098-f597-40be-9399-0cef105f672f", "sighting--2a461e50-7857-428c-8ffb-e4a18a8a96d1", "sighting--e964c475-b267-44c9-8328-1222ebd59ec7", "sighting--9652d811-0147-4a59-93c6-9d9f1fe4b4f1", "sighting--677bb23d-f08f-424f-85c1-93ff6d9f01d5", "sighting--4a491c2e-10ea-40b4-86a2-efed6818d9fa", "sighting--b9f4db53-6ccb-4512-9185-7dcf543f3dc1", "sighting--f88740bd-0fd4-4920-9d19-61c32992cf11", "sighting--6e6a6f6f-e04e-4909-9380-3803fa029f66", "sighting--93d448c8-23aa-4f8e-be34-2ad2cd6f42aa", "sighting--ceb20f5a-ffab-4578-bf95-372643b7cf0f", "sighting--10341f18-3f81-4403-92ea-78601363e0c7", "sighting--9381e952-cde9-4f56-b33d-c78d7dda6a6b", "sighting--2492ff55-2e22-4b4f-a381-a0b7c5a0af1d", "sighting--cc619364-6c13-4b87-bb2d-ee6039086742", "sighting--e64fda4e-b460-441b-9b8a-0522feec295a", "sighting--b34133f8-8769-4233-91f7-54a55ccd1a98", "sighting--606e3c53-363a-4ee0-acd0-db38c27768f9", "sighting--e2a66efe-03ba-4abe-b98d-e1bb79aca873", "sighting--5056cc89-8e90-4eab-bdf2-b6258c580ae7", "sighting--7c65cc41-dfea-488f-ab26-cf69ed9cee7c", "sighting--6c347194-04f8-4a15-8bcc-32a123c5f018", "sighting--805823a3-161b-403c-b2fc-6ba52b7d09f2", "sighting--09550436-9bef-4e0b-a40a-4899444af5e8", "sighting--ce5b4ff5-1337-42de-8776-68339a4d32ef", "sighting--42a04ee1-efdb-44c7-b23d-d651d4e2938d", "sighting--6527fabf-9774-4666-ba96-b530e91f9dda", "sighting--e105e7f3-8836-4686-aebe-a57492b1a89c", "sighting--ea667687-065a-4672-8608-ebcec671d2f1", "sighting--49f29a55-feb7-496e-a274-276964571ac2", "sighting--db2b2b83-956d-47c6-928a-248b5ae51395", "sighting--55d7b89e-05eb-4d22-9e81-cbc8aa895803", "sighting--c8417418-d3e5-48b6-a432-d5cfa6f2a346", "sighting--e37ab75c-d289-4d4f-a3a8-bf62af5892a6", "sighting--08e0a29c-dff6-4002-ad8c-45b63049e86b", "sighting--dfe3ed08-db70-4402-a504-9f9fd8ae7458", "sighting--f8ed19cf-2dfc-424a-9003-859d64623ad3", "sighting--1dd1bd61-9ea7-47f3-8ac3-d520e1bdbc25", "sighting--16e1242a-f37a-4ec2-a4b8-e27f5580311f", "sighting--28275d26-1b5e-4907-9d3a-f4f961f864b4", "sighting--88791e7b-97d6-4450-80d7-ac2b9f9bb9a2", "sighting--6f4d14c6-16fb-4ffb-b550-f8552996567a", "sighting--bf9ebd82-1785-46c7-a045-901c74a92dd3", "sighting--aaa360af-062d-46d5-afbe-fbad7dcc60bf", "sighting--81b1993e-b171-4bd3-a6b9-84e48c9b0c85", "sighting--a956e836-3364-4861-b58b-8be52fb617cd", "sighting--0e3c07f8-2805-4d15-a088-1e8d50f29cf6", "sighting--0e891268-7b2f-43b3-9d00-fee35065a6b6", "sighting--2669fd9f-6959-4be8-9273-68605ccc86a1", "sighting--53f53311-3f37-4663-bd02-62a541ff6e6c", "sighting--17b82474-1350-4da0-b884-e3955a22fb5e", "sighting--1017dbcc-919d-49e5-9dc1-8d6b39687319", "sighting--a79c4317-aa79-4660-bc38-7b04b18a2359", "sighting--9645f896-ef05-4b74-a0bb-22a3c4987df0", "sighting--42cc9389-e14d-4975-807d-1fa3c7f6b08d", "sighting--ff0101ce-3325-41af-8bf9-268233e44bbc", "sighting--28292f7e-fcd6-4558-a047-4d6af8906844", "sighting--adb6dd99-217d-422d-a033-339b286806f1", "sighting--9ae4e224-010f-4c7d-b289-d63187d33803", "sighting--5eefc9e0-2884-43fa-a99f-fa2421a7b44b", "sighting--029b8686-f8e6-4860-988e-8d69d269a4a3", "sighting--d38e895d-5ece-4b5e-a234-64789edac0c7", "sighting--d088caa0-2cb7-4347-a30f-17b019a1aab5", "sighting--a657a28e-52d6-4bdd-a78d-b27b38013359", "sighting--8300f2cc-db89-4c6a-be56-d1ac87c1a242", "sighting--17105109-701f-4ef7-b4e4-2447ac47c483", "sighting--6f040109-611c-4c93-a567-4b5684bbadd3", "sighting--6ff8636b-b388-4222-82c9-5bd20837e55c", "sighting--b35fa6e4-1c91-44c5-81e2-c3356a4e645d", "sighting--9a4e4acb-cdbe-4742-bf1e-e3cda7385d79", "sighting--8f6e9c8b-8aed-4233-8ad0-409f8ba807ed", "sighting--f29a3075-825c-436a-b592-ba7a5ef15ec3", "sighting--e1ad9f72-15d5-43d3-a0d3-24245e09a3e9", "sighting--19059017-7ca2-40aa-b092-5eccf771009e", "sighting--5394b9be-9db3-41a9-b41f-8a617e73f576", "sighting--2180d28e-4132-4c28-aaab-11dc6ce11e22", "sighting--a8c0f9d3-e381-4842-935e-913aaff1d556", "sighting--9e5722e9-77b5-4015-bd94-0d5ae9f613fd", "sighting--2ab846e4-9204-4dc8-b091-29ded78d4956", "sighting--277780c8-7575-4d9f-93e9-b595394f7c22", "sighting--03ffcd85-83f6-4b18-8998-2a8c69527a2e", "sighting--e6784964-db0d-45fe-a3a0-d7e2b76a8f67", "sighting--d2d09b42-2ca5-4a24-965c-5be0c99603c3", "sighting--3092eb58-40be-41b7-b921-1323b7b7dd3e", "sighting--5dd7a29c-bc66-48b0-b026-4cb9a3d92cd3", "sighting--57c97c46-b8da-4af6-91cf-e05f2586eb7d", "sighting--53d27165-ca77-4e2a-af48-372fb29c0215", "sighting--266c5c4c-dd80-4ecb-b8b3-70bc2983bbc0", "sighting--184dea58-a459-4d3e-85b4-dd21aef94334", "sighting--bfde0c4a-e320-4aa7-945d-1d7380b26116", "sighting--25bd8038-0174-45c6-98d5-15dec856f9e2", "sighting--53636870-d4d9-44cb-a7ca-dd22dd467548", "sighting--e46da1a2-9122-4f37-a087-ca1a183f5bab", "sighting--96c09851-1a36-41f6-994f-a18d42e3f0ba", "sighting--7962f6a8-7783-48d8-be6d-bfe00f99a144", "sighting--0b7e8e2f-6813-4402-93d7-3a4cd0a6830d", "sighting--da080de0-6270-4fbf-a0e6-e710b69187fe", "sighting--8711869a-ce02-408d-94bd-f29d54e936bb", "sighting--c4f65588-a8fe-4d4e-978f-79e4dd9500e9", "sighting--7a7f7ae3-85e7-4f81-a0db-2a6c1de2cc91", "sighting--93cad0fe-0ef4-45d4-90c4-a014dcce7ef7", "sighting--e251395e-b71f-460c-a923-84495a5fe19c", "sighting--5fe95492-c93b-4358-b72e-e9d2a9a9c190", "sighting--c0fae95b-0a5d-4603-b29e-a8ced2f43851", "sighting--79281a99-d77c-4f54-baa8-e7bd10e037b7", "sighting--c2d28c9e-2be0-4cb9-bec1-97a5bf0a0e0d", "sighting--7e5aae92-7b53-4652-ab05-9fc3914779cc", "sighting--8985d663-798a-443f-a899-90dec8bd8373", "sighting--c547d42d-ef36-4829-97e2-cbceb82efeca", "sighting--f4e3f902-bf94-40c0-ac09-2cdee2fb3675", "sighting--e47de698-22a0-4907-a3ab-b32a23d750c1", "sighting--32b348be-ba0a-46fc-8f11-8934c2315ed6", "sighting--1a84f003-3e69-4fa7-a54d-de516ef0b628", "sighting--a0e13936-4bc8-4397-97eb-557aa7c1f08c", "sighting--250a0179-105c-40da-bd80-7a931f0ad534", "sighting--3e5fc2a2-df96-452b-9c03-84a82d240aa2", "sighting--9fec96dc-1be3-4d68-af47-eaf1ee45125d", "sighting--d6c2987d-ff5a-49d1-a336-ff98f7656228", "sighting--3d409d6f-9ca3-46c4-ae11-2732d7b5a59d", "sighting--cf82ad9b-e0fc-498d-8c92-09d371e43028", "sighting--e7b99b5f-91a4-4154-9cbf-e1a791670827", "sighting--2078fb27-002e-4a62-a357-4615691d47f1", "sighting--f5142bee-4c8b-4db9-97ac-a269a7f2f288", "sighting--0d91889f-2a7f-43dd-baee-2a16eb3a25b4", "sighting--87df8aea-296a-47fc-8cb6-245c823b8932", "sighting--43044001-a25e-489a-93cc-ed7f0117dbdd", "sighting--9d207883-432b-4589-818e-149892e69014", "sighting--cdada231-4b85-4f69-9361-a3be8f02cc45", "sighting--75b63cce-2170-4d4c-9e14-14affa5a8c72", "sighting--981c1c64-1f48-47d3-9a54-de7d3373bacf", "sighting--0d9069ba-d605-4831-a244-ac59aaf1e49b", "sighting--9ee457f0-ee63-47b6-b4c2-430cccbf92f5", "sighting--bcd18dd5-1503-45a2-a4e3-d7313c706048", "sighting--9c94fe5e-de9e-4ee4-b5ae-5ae20fa18c9a", "sighting--73262566-d6b6-4d6e-9e74-7485bfd9fd80", "sighting--c73321af-1cb4-4a9e-9dba-d91b5da9cd34", "sighting--d1fd971b-8803-4d7e-bd34-5b7d80d67225", "sighting--dfc5af71-ce62-4f1e-bfde-252a23bd6f7a", "sighting--38de07a7-5eac-40ac-8ab4-bb4862613955", "sighting--b439231a-27f2-4a77-8581-b14c9ad6a18b", "sighting--c01d1bc8-e158-48f6-a15d-749d8e67c365", "sighting--0c640ebd-8427-44bf-9014-3bc61d8b9fe5", "sighting--bd63298b-0c0a-435e-a117-077ba375db5a", "sighting--a36c4629-a72b-4468-8b30-66218a1d7adf", "sighting--bc07244b-de3e-4261-b575-a906cd47a8ce", "sighting--0221f66b-27bc-4ce7-8c73-56088c62eb54", "sighting--4f222070-2fbc-43c5-b389-266d983c0068", "sighting--e441dd57-5a53-40f3-a158-0821344a319e", "sighting--57dc4e2b-df98-4a3e-8674-9956408fb9c7", "sighting--0b5e8544-0cd4-40c4-987f-ddc118805c86", "sighting--d8cfd07f-1157-4715-adbb-2b3458e81f8e", "sighting--56c876bc-fd46-44f6-b0dc-f0e6203335fd", "sighting--542a68fe-6a6a-4b74-b72f-3b22a8a25188", "sighting--fa70d1e8-67a8-4c55-97f3-f067bcefdf21", "sighting--bd263bf0-facb-4da3-b956-bffd6c6f3814", "sighting--26c5a343-13cf-43c8-96ec-1b73e103ff0f", "sighting--cd54465d-abc2-4325-bfbc-61da9950baf0", "sighting--cae14eb5-a67b-4148-87c2-fbeb87642f19", "sighting--2757e90d-4b3f-4a71-a631-08469c721666", "sighting--ee5abc33-baea-4749-b2dc-f2bd4f20dbda", "sighting--762a1b61-0f63-487e-8606-f1a0a200c50a", "sighting--fc99d608-9b5b-4e4c-a17f-c82bc0b69ff9", "sighting--f1273bce-c61b-4686-8bab-b9c1f549f5ce", "sighting--5c7c1dc2-8951-43c2-b524-f14eca8b26b0", "sighting--9f1a54f0-423f-4834-9034-b27c9c4f633d", "sighting--a3d37c3a-6444-47f1-ac07-49cb9cfde164", "sighting--f93d086f-9d51-4958-921e-e5010577a559", "sighting--4a9a94bd-a89d-48d4-b709-8937800445be", "sighting--4a7e6ef6-ceeb-409d-b5d6-769bf6a90119", "sighting--7840d8f4-a376-4408-82fd-51ad658de250", "sighting--0cfcd2c3-50fd-4f74-b831-167ab46b1946", "sighting--18667ded-ad3e-4b67-bcd3-b73ff6b17867", "sighting--7dd40144-20a9-40f6-ab94-2c8cd703e837", "sighting--c5b9300e-0d02-409f-8f6b-02fbf4c8f028", "sighting--dc626f9b-2d37-49d5-8ee7-e67858aa796a", "sighting--2cedefd2-a76c-438d-861e-1af205ffeabb", "sighting--09a26e27-f9a0-49f3-9fcb-132e0a95bc8e", "sighting--1125d106-6a82-43e8-9850-17a9020702e6", "sighting--0fded169-64dd-47b1-a1f7-7121368e5452", "sighting--0e56343e-e105-4b86-87e9-8a3d2a17942e", "sighting--f6806712-6c77-4739-9fd4-8956882dff60", "sighting--c562b483-3dd1-4ba5-9946-1b1baa53eda0", "sighting--bbc2b75b-05cf-4675-9d53-7a45a70bebdd", "sighting--330a0fbf-741d-4695-8d34-9f28569d2482", "sighting--b56cce4d-4252-439b-b386-1bef0e600d09", "sighting--31f2634e-db7b-48b7-b1b7-459021ab5947", "sighting--96e0d009-2be3-4ef0-89f5-3c46bbca1cf1", "sighting--8414f7c5-576c-4ed2-b7ad-d47235d45828", "sighting--53681cb4-2017-422f-9555-4e6bac5d8e59", "sighting--9e4c5d8c-2474-4945-b3b8-c68ac05f237e", "sighting--d935b6f5-88fa-49b5-a3c7-3a68eb30c3ac", "sighting--cc4af5ae-b389-4a11-b60a-457aa583c0c0", "sighting--37bf0b04-712c-4eb5-991e-6d04825244bc", "sighting--efafb13b-a56c-4796-8a6f-aaead02c47c3", "sighting--f407cfa4-21aa-44ed-8729-47101be8f496", "sighting--367b369f-76f4-463d-82c4-78f7b257c8c3", "sighting--fd594033-c2e7-46b9-8c78-c842baf93553", "sighting--0aa23494-731c-42e9-80f0-31877ff09bb1", "sighting--9e37d5e9-e81b-447a-9101-f78dd2ffc180", "sighting--3b284e3b-27ae-42ef-b8d7-aab7af10d5bf", "sighting--cf4bcb99-1a02-41de-a200-74cbdbec085c", "sighting--8ec60cef-337c-4ee8-8d61-95eee9ba4b4a", "sighting--0ad52f78-94cb-46aa-9f49-53484efd7723", "sighting--62a03188-b6d1-4884-9c6b-7c26b661fa6a", "sighting--286aeb18-c560-4b10-a950-4005c5a138dd", "sighting--d5552b87-5d50-4c7e-adf0-ba8fd1be71b6", "sighting--60485a9c-e246-4603-b0d3-82c28b11c21c", "sighting--d2252306-d3ab-40db-9b87-c98a12f6349a", "sighting--d6a79a7b-1cad-4655-8be6-3676bd6d66df", "sighting--d6fe31df-779f-4702-8b49-ff883106252e", "sighting--a0c43200-89d3-4c81-b0e5-4852aa55c8d2", "sighting--b93aec42-b27f-40d5-8012-b619fd2884b9", "sighting--892c9232-53d3-44b9-bf1d-0ca33bfd7c9a", "sighting--358e491e-957e-47a5-8070-e1b0fcaf810e", "sighting--dd536df1-d54b-4e5e-9250-30c2b3022854", "sighting--9ba903a0-1d94-4eb4-88c6-32d65712c222", "sighting--5c54777d-1d83-418b-bcb9-b74f7a714a44", "sighting--3ac5c704-1bcb-481a-820f-92cf96e7ca6d", "sighting--cca7f1f2-a25b-4760-8f43-05a837b28e4c", "sighting--dd7c8fd4-b7ff-47d2-98ff-2e49b351ee19", "sighting--ddfced4a-5bf2-4e0b-86b9-420dd768e01d", "sighting--8de7f8f7-7c36-4349-a2f1-77fea69b8702", "sighting--c544892e-cfc6-4ca6-8341-6a5e92805dea", "sighting--7b710496-5b77-4923-ad98-69061584215f", "sighting--6678cc32-bc93-45c8-9a6a-75b5f66e2d95", "sighting--a154fff1-33a4-47e3-9c4b-2e34c4692b5b", "sighting--825c4efc-6d97-4ff2-baa5-24d4e00f0a8c", "sighting--a60ee79a-f6d6-492d-8346-f5ce3b6a862e", "sighting--60b2448f-a728-4fd6-8cba-68a10463ec99", "sighting--20f2a5c9-edc4-401e-8f3b-cff979fcda34", "sighting--c60b3e82-efb0-4831-abbf-a55ed1382e2e", "sighting--98cbccc6-a574-4fed-a62c-70583a55d012", "sighting--bcd6886b-9e80-488f-94a5-bbf771eb80a9", "sighting--ca67a2d0-ae3a-44e3-af66-c9f36de6075a", "sighting--b66476f6-9b31-4e33-a588-bbc4b20118e8", "sighting--eddc99b4-1130-44f9-8018-f9500770fcf5", "sighting--f2d17a12-7a24-48da-a7ba-0b2255627561", "sighting--647efae1-045b-4a7b-b452-4d9add24a52a", "sighting--024ca719-5c14-44a0-b16e-10c20f7798be", "sighting--2c979e71-03ef-4b0d-84b6-5282e5edbea2", "sighting--415b9928-1934-4341-bd20-6230e15153f1", "sighting--75384905-fa01-4fe8-b546-dc9b3c890f29", "sighting--99df8416-b718-42b1-9d2c-e97d693e1ee9", "sighting--1b624d44-e9b4-4149-8289-abe719ceeb8b", "sighting--07704df0-e865-4b9c-add0-790efb5c5744", "sighting--8f8339a4-7a78-48b6-9658-67b80770d03a", "sighting--064b8dff-02d9-4c0c-8830-7bd1e5398221", "sighting--95102aba-fbcc-47dc-94d6-eba67b7eed9f", "sighting--d5890937-1611-44b4-9fd5-0384083a1ed3", "sighting--e41b9e7d-5d7c-4c68-bc20-69616213f9a4", "sighting--6dac2cad-5a87-4472-923c-7f53c8ca0313", "sighting--0ac0cb85-320c-490e-8743-5a700abd6d8c", "sighting--2dd955c6-52ef-4cce-94fe-3aeb42baaa7a", "sighting--8642ab1b-6e24-4e1b-bb9f-85ec5e44909f", "sighting--5a80337a-5da9-44c3-af48-785542c38534", "sighting--989e057a-6365-4ffa-a54b-4f7594623855", "sighting--637b8121-28cc-490f-96f5-23c48ae2d416", "sighting--d900226d-be37-42fc-9840-3bcc5a5399a2", "sighting--c4668f1b-c7c5-4f49-ad94-36941b8ea646", "sighting--82f86961-e8c2-4cea-89e1-1a16613f7e8a", "sighting--c134690f-455c-4ad0-bf3f-e56d9d84db8f", "sighting--a75af689-51b4-4e44-844b-a5ef22c34ca1", "sighting--8aa70bfa-9a56-43f5-98b2-aa6fa7055f4a", "sighting--1f32e1e3-834d-4393-8e5c-eafdad89e2ec", "sighting--7cfb2793-c69f-4bf1-969e-2aa3f8af530b", "sighting--b6012afb-6dfa-40af-8325-ead1f0e9ab04", "sighting--de098008-3e56-404e-9a2b-f2c2c2bbc0bf", "sighting--949510ac-01d2-4400-a10f-9d8f416275c7", "sighting--74bce75d-b577-4c95-9c6b-75546656d1aa", "sighting--f8350412-c8c8-47a6-b9a8-e44a408b7a48", "sighting--c2ba4bc6-d87c-4944-bfef-91d804c2503a", "sighting--eb9d0f9e-6192-4f68-a8d2-2e2fc453e2f8", "sighting--1e8853f4-97b9-4513-8328-8bece2753f1f", "sighting--2e2fdae2-c157-44fc-a295-809b5a7cddcf", "sighting--7c9ad738-63ef-46ae-a06e-87374eef8069", "sighting--c14e4299-6931-4cc6-a3e7-8023f70dc32d", "sighting--58985eef-1ea8-475b-85a3-6d35d1825360", "sighting--ac3647d3-c9ed-4209-b8ff-7fa4b44cd7c5", "sighting--99abbb32-d2e9-4ce3-990a-0499be770569", "sighting--6fcdaac8-6699-472c-85e7-40052b71736b", "sighting--2b97d61b-23a6-4556-9d12-c78a29404418", "sighting--feb7b89e-be2c-44f2-9469-6e405c43a874", "sighting--1f717823-f9de-4680-a94a-7a25f24bb641", "sighting--8f0944e6-13f5-4903-b11c-fe6f5dd93dcc", "sighting--325d3674-0088-4993-904b-61b24df1fc44", "sighting--fed219fe-aabb-4d60-a793-3aca248fa76a", "sighting--049e294e-4235-421f-a085-7a238305eda7", "sighting--a6417eed-44de-42e6-b54e-41a27605210f", "sighting--94bb1299-fdad-4eec-9c9b-e74777610294", "sighting--05e78cda-f555-48b1-b07e-39346b8c4d1f", "sighting--3ea32c46-56a8-49c3-93b3-7c50bf59795d", "sighting--9c12a548-11d5-40b4-a899-cdad52b3e276", "sighting--04d47a84-94b3-4916-8cf5-345d9836a535", "sighting--f05b8c37-ca3a-4b22-8638-52b45fb5a35d", "sighting--d6b7e372-363f-407c-923e-e2bf3e593260", "sighting--ce7e3761-96b0-4be0-982b-713b669b80f9", "sighting--93260dfe-08a7-40aa-9fd6-4d8593e00972", "sighting--772d991c-aa01-4aec-8cde-24e01d3534c0", "sighting--c385e30a-2151-499e-8d5a-92b535166522", "sighting--4298d07a-699b-42ff-8086-64cc85a9b2ff", "sighting--3499f8eb-34c2-443f-a6b0-76c1d6578054", "sighting--3ad1be9f-5bae-4e3f-9e74-728f77252ef9", "sighting--51a3790d-b379-4636-82cc-4b60b57ca0ac", "sighting--a6c93476-131f-40b6-8e45-d20a527b91ca", "sighting--a851c992-d7cb-4617-9668-ed6f10379ab9", "sighting--0090d3f2-6512-4538-b584-b032c2bea1ea", "sighting--d03242f0-a70e-4187-bd77-7f1659c5a10e", "sighting--5b786cdc-3285-45ff-858e-8bf007e39741", "sighting--05901fc5-61fe-4d88-a10e-15e221b2dff7", "sighting--a1c0fa93-782a-4651-bf21-4227b1a17ec9", "sighting--2173ac08-093b-4cb2-b263-44324a68b3d5", "sighting--dc6e11af-1838-45e8-9e29-3338b60d69a8", "sighting--644a120b-f91b-4be9-9067-1bb35b6d20a2", "sighting--12baf7d1-6626-42b6-9f47-b32aa44545ef", "sighting--98d0ad47-75c5-4a65-a24d-57d3437c9f32", "sighting--52164acf-290a-4a9e-966f-9c68c8766bba", "sighting--0347564b-4a23-453e-8546-a757f8a38fd9", "sighting--e01200b4-fdd9-4ecf-bece-bb2e5ef24ca6", "sighting--e395a00f-6ede-428a-ab9f-89f81d34fb46", "sighting--ccf4ff6e-942f-437e-aef1-2e7981850fe1", "sighting--33326bd0-6d99-4cf2-8da2-7024931f568f", "sighting--16d881da-2b2f-4c78-a643-cb8ca4770b27", "sighting--1643cb88-8a99-42f9-8b16-3e77f0258a42", "sighting--d73459d0-8ad1-4a88-a08f-a6e591701e66", "sighting--c0e7aa5c-d7b9-4a27-869c-d82f7fed298e", "sighting--f61f553b-608a-4e77-869d-374eeec6aad8", "sighting--4fd14f71-0071-4c9d-ab01-c3906f8def70", "sighting--cf58e8f0-44c8-4136-9ce1-854b156dd300", "sighting--89c2b25f-e489-43bd-b628-ee8afb59247e", "sighting--ff3b525c-5cd8-4c99-8b3f-fd1710d00ac2", "sighting--08f03124-f35c-414c-b07c-a97856ccd20f", "sighting--26ccc7d6-5d5b-4e7e-a8f0-1762e514155b", "sighting--ae778e58-7690-4a82-9a7b-c98a6dea3254", "sighting--7bd94dea-6ba0-405a-ab91-79e0a080ae54", "sighting--11e14264-f30a-4c7d-8c25-a828124c27ee", "sighting--21fad1da-dd20-451f-93cd-d34ae2dd7e7c", "sighting--2e96414a-1c38-4f7f-823f-bf7cd6fa7926", "sighting--939c038c-6e30-4dbd-880f-98ec3c2f19f6", "sighting--3dfc7f8b-b61b-4bb6-8b6e-89948f89f2f8", "sighting--968e511d-4b3a-4cb4-b6c1-8ab22aec5014", "sighting--6a62b243-ec4f-4ac2-9be4-75237d27afa6", "sighting--8ab4bac9-dfdd-4f6d-8a78-50c6fe7ad5ff", "sighting--a3458f75-6776-45ff-9f75-7021f3b1d08b", "sighting--31560f06-8f46-428b-b4d6-38c54d21c2f7", "sighting--bcc2fb7b-6cc1-4505-a11d-cd6202243925", "sighting--9790e767-e0b4-4a74-9f1e-a70dff6efdeb", "sighting--b08d20f1-2fe5-45c0-b4d2-e0a2daef89a5", "sighting--9d03e381-b562-4cbd-be53-5087879b42e6", "sighting--e1f06219-bc3f-47c4-848d-b85115107a0b", "sighting--4706c9ba-ccb7-4a8b-8459-bfd0462d9cfe", "sighting--7e75bc67-892c-4fa8-8c02-14a7b0130238", "sighting--193c1c59-9f58-4a8a-a00c-d35ca61608e8", "sighting--88e37998-a9ce-4966-b33f-a58b5baedb88", "sighting--c7965773-cff3-4bfd-b154-32f1dd4c6bc4", "sighting--a1fd1591-382d-40b2-999b-cdca068982a8", "sighting--69519ebe-2d9e-4790-96bf-4286e94334b3", "sighting--826f1288-a1e3-4420-b1cc-2c4eec8dbf08", "sighting--9f77c368-d122-4ffa-8c3b-ce43203d6681", "sighting--58906aa1-e07c-47be-a632-ac93e7de8540", "sighting--d8e8c687-188a-420d-b790-8b4a82abab17", "sighting--b1f1f834-f5c1-4813-8d23-853284a727c3", "sighting--789dbb67-ffd4-401a-9a3a-1f0fbebc12e8", "sighting--d3130327-72a4-410a-a018-f613921246d2", "sighting--b731838a-ef75-427f-86ff-a621fef4927c", "sighting--aa46c248-1390-4c8b-86ba-5d60feb6797d", "sighting--229b71d2-b5fb-4123-a5b1-495680151fd4", "sighting--1c861a75-ab41-4b6b-ac3f-a8c5fba17a37", "sighting--fa80d5d4-323b-4a87-9a88-57e71c9280d5", "sighting--d4872a41-5e9e-46b4-8998-44cb139edf8d", "sighting--c1520a3e-eaf1-48b6-ac24-bbf9c7ffc432", "sighting--5afa3263-6b88-47ce-bbc5-a55d98abfd2f", "sighting--8ec3aa36-2d17-4f36-859b-6bdcb9ce5ce5", "sighting--dcdd7fd9-5c0d-45b0-abc7-6d34286c252a", "sighting--cf113d49-c52e-498b-9eff-9fb906d2ec62", "sighting--dbf1538d-34a0-4af2-8139-9b940789e753", "sighting--54680b85-c200-4de5-84f0-6c4dec9b28bc", "sighting--ab7fdab4-dd19-4fea-a933-29117118c4a1", "sighting--366ee1b1-d42f-40aa-8943-9fe42b1ba7ec", "sighting--1685440a-973c-407a-be9d-3c4443770f37", "sighting--8c17a4e2-4013-43f9-83ec-8b6c451b2827", "sighting--55b185b5-8010-4ab1-830f-15ee9f491a44", "sighting--0c866045-aa33-4d7c-ba3e-c1a5e48c7186", "sighting--86a39881-33f6-43d9-820f-2ef549a3c495", "sighting--22851e72-5daa-4e52-b2b4-ba5cc43de3b8", "sighting--c884ba8a-1022-4ae9-adb0-9b68285b6b4a", "sighting--5f3df35a-f7fb-41af-ade9-e95be780de8d", "sighting--9db49988-2fef-4196-befb-fbe742ec58ce", "sighting--f86ea41c-7777-405f-b9a7-8ce9da528c38", "sighting--2a61840f-44d1-4738-9d83-7b177dba188d", "sighting--1b25d109-c07c-4a92-a256-f4782c439d45", "sighting--e3574f2a-a192-4130-be33-70900da433fd", "sighting--93b5ed3d-7ed2-412a-98f5-90e6b1d11508", "sighting--0b5fdc56-a40b-434e-9279-f7d2381cd759", "sighting--d8f78c22-67b4-45a5-a752-9de43ee15158", "sighting--2e185f71-2a76-40c0-a261-7bc099f01e22", "sighting--92cbcb4b-d56a-4e91-9586-9edc4ad55e64", "sighting--a75f33fc-22fd-481b-9897-f16330bb9391", "sighting--c2b2895b-f823-4f84-94fb-227ddb0fae52", "sighting--149238cc-c232-4f9f-9102-99a39851cee3", "sighting--cc85e716-9016-4b46-b730-63770de0c4a3", "sighting--0720289b-a5a4-4b84-8e95-da592bc807e9", "sighting--22d81fb5-c7c4-4963-8a26-98b231c39a2a", "sighting--4716717e-99e0-467a-9cd9-34ebf83a67d8", "sighting--571b6495-f2e9-4f2f-8945-0b1f05f0b92b", "sighting--9e491881-acd0-4a4f-aaa6-a4012579ff82", "sighting--add7aee5-e8f2-49f7-8325-98e4a7850a00", "sighting--0009ecb0-4d0c-4701-8c98-15f514bfa776", "sighting--19bc6bc3-2bda-4d39-8dd7-913ccc4d41c8", "sighting--1a3fb8b6-2e07-4323-b21a-829710661c6a", "sighting--35383f1f-406b-4f28-8e88-bdcda1aa0de2", "sighting--9e305ee1-1014-41e0-80d8-181070e3cbd0", "sighting--81900a82-2dbd-4504-95cd-13af3bfe242f", "sighting--deb95842-66ee-415f-92d9-9f55b21e5c92", "sighting--523a8c30-b706-408d-95b1-359c42355089", "sighting--e7fcb477-f15b-48ac-9ee0-29f8c3d47fa6", "sighting--48db099f-5ba1-4423-9693-2e453ee10b1b", "sighting--307c88d4-5be8-4cab-b3ac-59ab0d3f37fa", "sighting--884f9c54-3a4a-4e36-9224-f316f7575137", "sighting--0666ba86-864c-44fb-9b48-57e3551f3890", "sighting--9a2e9c87-9554-4a86-8875-d2ce3bb1f165", "sighting--c9c5eb35-c531-48a1-998a-08722570349e", "sighting--3db9c5db-fe8e-4725-8b73-396d0d3a1388", "sighting--b955b7c1-332f-4a3c-9e3d-494bce5d73c7", "sighting--7c7040e3-c9ff-4fd1-91a7-77a802df72ed", "sighting--f277da9a-a40a-44c0-9cfb-bd419d508584", "sighting--138db144-959f-4b67-8f02-5246929a1a58", "sighting--621c82de-5b7e-4d4f-b526-dce6de628833", "sighting--cbd54772-76fd-4033-8f52-3468e42a2448", "sighting--b345fb13-b869-43e1-84aa-637e53e8c23f", "sighting--12a48a29-e41b-4478-9d5a-2a56ee417ccd", "sighting--f1ae5dc9-327e-48d6-9da9-2a533643422d", "sighting--47ceb453-a0e0-44fa-858a-418845259bf9", "sighting--2cfcf9d8-b0bb-4ce3-9286-129cff071ae6", "sighting--68067b65-eaa8-48bd-80bc-6dedb9c073a5", "sighting--78715331-ad21-434a-aa71-68e914890250", "sighting--2a71e4aa-5364-48a0-a26c-64ce356f2de6", "sighting--1fc43a67-fb35-4c15-9934-1cc2fd762994", "sighting--503bf668-f6ca-410b-a52b-0c5d04732901", "sighting--96ac8e14-6979-49b6-844f-316ac523d2db", "sighting--d0adeb1f-79d5-4060-9720-3667bacbc887", "sighting--9dcd2614-bf36-4fae-8b44-9e32b29f0536", "sighting--bb922815-c65e-4862-8ed0-83884eb7c019", "sighting--73cf8da9-2cd3-42cb-a52d-a81f6782dcd6", "sighting--20baa9bd-9c22-4684-9b7f-0a83fdd39348", "sighting--f5bb417e-764a-4295-ae51-00fe2744c656", "sighting--86847203-9a3a-4c00-903a-241cb6d39b21", "sighting--623b1efa-4542-445a-87e2-a1deb59cbf70", "sighting--0c7c4ce8-d94f-400a-b224-a943d1599d3d", "sighting--88e736fe-f406-4e1c-a996-5abffbb2efb6", "sighting--1abcf9d4-a577-445f-a358-8b7aa0adc8ff", "sighting--5f57ca44-107a-4724-8244-bbab64c5df73", "sighting--a09e2fdc-7977-4b1b-b879-8ee09d35ede4", "sighting--41ab5a27-dbd0-4007-8829-09dd7d5150c5", "sighting--a1f846e1-d47e-4336-ae5d-dc5edb7bcee0", "sighting--20b08a7e-ca48-4059-aa2d-d16d3406e0df", "sighting--9a902cc8-18a5-41c9-8ab3-b84aea015066", "sighting--f365c289-20d1-4e39-ac77-a2ce47e1a420", "sighting--73957d54-c982-4e2b-b921-bbc96499caac", "sighting--169256bf-b30e-41bb-b528-d65523eb9ea7", "sighting--1bc65780-9952-4565-8dd4-335f06db6b28", "sighting--6d536f65-31fc-4371-9655-353f7696a229", "sighting--c33f24cc-c078-43f7-b307-517603172339", "sighting--4a751bf5-5087-4158-bd25-b5674cc758cf", "sighting--b75915e3-a79c-40d4-bc53-cd06b32db619", "sighting--707afb5a-15d2-4be1-8597-141342ae29f3", "sighting--3adc6c1b-79c6-4013-87c9-5f9460fa1b80", "sighting--2d3aa4ae-f760-4907-91d7-af7fa7ff5949", "sighting--430a9f8d-7408-4054-9f34-e9180391220c", "sighting--34e8c493-62a4-44b2-a598-a5d98eabe8ab", "sighting--3757f51b-0f35-4ad3-aaa0-e65278d03bbb", "sighting--e6009dc4-9588-451e-b768-ca10c98541b2", "sighting--31e254ed-ac55-47c2-bcde-447c547f1579", "sighting--12b5bb47-f426-4fdd-b677-e3de4aa5555b", "sighting--fce6be73-c48f-4354-8b9f-f46e9d32214a", "sighting--03cd6982-4bf3-4297-a92d-defc495eb425", "sighting--36d9a17a-c89a-4c25-980d-05459c814153", "sighting--05cdf5e7-3cc4-4787-a497-b7975f025d6b", "sighting--42fc05ec-795b-4231-a766-0b0127ab68e7", "sighting--3c62e501-afc7-4e9a-b29b-f50b491dea4f", "sighting--073f9d85-469a-4756-8654-b5ad79407cb4", "sighting--a3bff7a3-8e40-4644-a0e4-ac74ba8b2ae5", "sighting--8a62b76a-ae23-42fd-a048-04e5a3e00be7", "sighting--a5933f85-a7e5-49ba-ae13-6e1d18eec198", "sighting--81a28ea7-2c0f-480b-bb94-6ef425c3a644", "sighting--3af0717d-24c8-4cab-91c8-03552ae32d49", "sighting--1d3653c4-0311-4d8d-9814-3e6efac84953", "sighting--e168f14d-5ed8-4c95-ae67-2a53b53137a2", "sighting--92ec3933-b942-4f21-9be7-b3de1394f33b", "sighting--aee9d80a-54b1-4a00-83d1-76a63233afd0", "sighting--1024d1b3-7b45-435d-94dc-05c6e99aa842", "sighting--ebd823b2-d2dc-4917-9f1c-e0aafad9be7a", "sighting--d691c2c8-a1d8-4f23-b417-45c808cee44e", "sighting--00a4b8a6-0330-4ce2-96fa-994e48dfcef9", "sighting--92e39fc9-3b0f-4f75-9e98-ec16cce7b8bb", "sighting--8615b060-9608-43df-971f-69df7b0d02f8", "sighting--f0921fbe-8239-435f-9e41-7b53be2e2cbc", "sighting--cbe86d25-2b1b-4c53-99b0-48c5b680b9ef", "sighting--a2c6b7b4-78d9-4b53-9c76-b40b7ceb32b3", "sighting--96020eb3-9e68-4c85-af1f-317dc4d53f53", "sighting--0e9a5aef-5e07-43b1-95ed-acce055db312", "sighting--1197af10-d747-40ef-b24f-1fd0f7119e42", "sighting--a7158797-a3d1-4019-be1a-f2a43c4694b2", "sighting--47fdfc5f-17f5-4441-b722-be26e2e64ca6", "sighting--cdeb26c4-c81e-4407-a15e-18240ff3b662", "sighting--9b27d955-f853-4358-8fa6-dc566e5deffb", "sighting--aa1be479-2edc-4605-85be-130523388a73", "sighting--75047884-88b3-4aa0-935f-98eea1044bdf", "sighting--324fd3cf-7d45-47b3-bcc1-1d7bfda1e95e", "sighting--bde98104-c616-4e40-9a05-f18919d3310e", "sighting--f6ed7565-e3e1-4063-8f41-2db338b056eb", "sighting--63c0a86c-29d1-4fc6-8a00-b0eee7a52cfb", "sighting--2267c9db-75c6-4cd1-94e8-02b437148724", "sighting--1ec3a8cd-295c-4fd2-892c-6aadcf424037", "sighting--cd0415cf-8a4b-4536-bdd5-8bb677be326b", "sighting--4c32dd64-e12d-481f-9bf5-076d640fe5f7", "sighting--442e3b4f-eab4-4f45-bc90-d9a28bb0e039", "sighting--9b685871-2783-45c0-8d8a-de254ab1ffa4", "sighting--6c62b228-141f-47d3-9348-4df929b1a893", "sighting--f99833bd-8808-49b3-93f8-66f2b0458e83", "sighting--d17205b4-0f5a-4342-8838-4ae8dea7fc0f", "sighting--4c8b8dd9-cfac-45dc-bbca-811d6de10459", "sighting--98e51e5b-4b49-4eaf-ad6f-0d37c7c33993", "sighting--9650383f-57cb-4595-b605-f573119af400", "sighting--a1be01aa-a889-4a54-8c08-f0f8680e95ab", "sighting--b3145faf-374e-44a3-9a86-42e21cc043cb", "sighting--cae4fbb2-00fe-483e-81c8-16981ea1794d", "sighting--21184d2a-4f0a-4536-adc5-dd03e0961e0d", "sighting--01fba5b8-dbf3-4dd6-84a9-7519980d6a3b", "sighting--ad6b59c3-5fac-4356-a240-5f8171203d34", "sighting--faed08d2-965f-4864-b3de-860a7f47d36c", "sighting--70618466-acbc-40f4-837d-dc278851b86a", "sighting--62c29d7f-f2da-4d5e-842d-c58c42a723bb", "sighting--095f0c6b-0c35-4cef-9ee1-82aef0c19224", "sighting--bd3cd0a5-c59a-4b03-a681-5e96da8d71b7", "sighting--e5104293-7d41-4899-a4a9-ca07f5ac2db4", "sighting--87b4a482-9086-44e3-826e-dd33271dbc2b", "sighting--54755897-ff94-4bac-ae2a-730ef1798cd2", "sighting--b278f452-6d01-4f5e-8d8a-07faf9579446", "sighting--188f1512-2fc0-48bd-bf8f-e4db11f335e1", "sighting--6ccff8c6-0dac-4737-8793-abcfac367854", "sighting--744808fb-aa4d-491d-86b5-d7e91cc8a4a8", "sighting--16e13e1a-b67d-4558-856d-dbcf81944d47", "sighting--cf13f6ed-6657-4ccb-abd2-c4e9e1ad7659", "sighting--981d9278-1853-4844-9236-271378ab896e", "sighting--4aaaa5f8-0b36-43d4-b999-f2dcf93eb101", "sighting--b9e7ec28-14b5-431b-8e53-194f0dad8bfd", "sighting--28b64e2d-c988-4d14-a5ae-db5142ee32d0", "sighting--b76f5a8f-5588-476d-8577-eb0536441831", "sighting--cc66c665-7e2c-4ccc-9769-a129d9caf8f5", "sighting--3cd33db5-6a7c-458c-98ad-971e3692f962", "sighting--5eb33680-e777-467f-8b00-8a814c92d346", "sighting--ddd44a19-c180-4de7-b7a3-5f3ffbbcccff", "sighting--9721e874-cd48-4309-a42a-6f54ad93d014", "sighting--6eb2d5de-f1ac-4442-aee2-2d8d635a168a", "sighting--84a9a075-e66b-4116-8d61-7500d79ffcd1", "sighting--8ea08ea8-705a-40b2-8196-994745f6fbe6", "sighting--e0ca8a5a-0ca7-4680-80f7-c08e317a8da4", "sighting--3ffa946f-4a9d-43f0-9041-251690272bfa", "sighting--a89141b7-4b46-4283-9783-7b53e944d7d7", "sighting--7f23af56-c6f6-41f5-969c-fc458550745f", "sighting--38d8b644-a0eb-4e2f-97d0-d8b035f8032e", "sighting--7f280912-36f7-4a6f-b057-ab5201ae7c7f", "sighting--990e52f4-e224-482b-9e08-853c3cab8903", "sighting--40627649-01b8-4be4-8a35-f064aec1b026", "sighting--6a4a2181-5fb2-4f43-a96d-b2a8703d34b8", "sighting--e6235be8-b212-4613-8c61-df97043a0db2", "sighting--7ec933b4-0f8b-4e98-9146-d64bde427d42", "sighting--42731e2c-2732-4b94-b84c-e7f64bf8ea03", "sighting--299aa0c1-0e66-4d60-a7ef-687c9d630f6a", "sighting--3ce184b0-45da-4f1c-812d-a868e47caeb2", "sighting--60fb92b7-2a99-4acf-a295-4ef5de5dedb7", "sighting--6a5d6aee-3afa-4a65-b310-78aabb1627d4", "sighting--4ef8dbe9-3492-4870-a224-93450cee4257", "sighting--61ad5fd6-95ca-4e93-976d-9255678cffc9", "sighting--bf7727ad-2c71-4bca-8398-384bad05fdcd", "sighting--0eed6dbb-daee-440d-905b-f653067eb788", "sighting--a6435565-40df-4d6c-bbf6-f391e1890089", "sighting--f4c1791f-f90c-4451-b6f1-70370473d317", "sighting--1599e093-74ed-4de9-ad2e-9e8bcd2a8759", "sighting--6a630fd6-d796-4f1f-9071-8b27a9818268", "sighting--634841ce-e8a6-4ea9-88b4-abacd48bc49d", "sighting--c9362e71-5426-407b-9e10-2769ab0e7c5e", "sighting--eef688fb-60eb-433d-8286-a71dcad45f77", "sighting--b25180ba-c097-469e-a03c-047bd9ea1c74", "sighting--9e4ae0a0-56d9-470a-b881-6a428a6a7a64", "sighting--c6214e7f-ecdb-4247-ae50-230dddb12d48", "sighting--9b83b6fd-ceb4-4ace-968a-a0c159b30cd3", "sighting--b591a7fd-134d-43f5-86b0-c618c8470c2d", "sighting--9c623227-8699-45e6-8e2f-7f71bb3e6751", "sighting--e4c793ad-20b8-40d9-be5e-4be890c05b7a", "sighting--1b3b5e25-dff5-4032-9def-75e337f64d5b", "sighting--2d397564-7d5b-4161-ad91-9375fab6fe28", "sighting--4c38829e-fd17-43a5-9530-b5942a549fc9", "sighting--c1e468ff-9642-4676-ac45-0aabf9c83837", "sighting--db134652-f264-472c-8ff9-3b932152430c", "sighting--3cbf7a5c-6ef4-44b3-a113-3edec6c81161", "sighting--62859f98-210d-474b-8707-50d941590471", "sighting--9ae36ebd-548a-4b27-988b-0e613f3cc683", "sighting--6762a0d3-5475-44bc-af8c-a05a8abb2916", "sighting--fb609051-6972-4ea1-8825-bf3b2855c597", "sighting--1e1d4bee-54f6-44c1-821d-3c67e424d594", "sighting--42b320c1-2414-47db-ba1e-6bc8bca71132", "sighting--8f2c53fa-5d9c-49d8-a828-8c8391dfe0e7", "sighting--d18302c3-2aaf-4723-8697-61b92dc9de18", "sighting--eb508d3b-e100-4300-ac70-5d63166da9e5", "sighting--b9219e78-5d8a-4758-9438-7ff91d66520e", "sighting--017d2f55-2e8f-4190-80f9-2255b5aede9f", "sighting--22bbbebf-7c32-4890-9f6a-14ad66e6a404", "sighting--8dddbbef-35e9-4631-a1a7-e470dd223e83", "sighting--70cc90c7-642a-41d3-9fef-0be1fa101acc", "sighting--0142ef9a-6694-4aef-a9db-53a2efdef171", "sighting--b5ebbf78-88c8-4612-b5d3-9f698d3b2245", "sighting--ce4e178d-69b5-4908-b267-28dd271b76d7", "sighting--e97b0e77-9c11-4a40-99af-8dcec0b5c252", "sighting--51606d1b-8dae-4963-b474-8deecb5468ab", "sighting--606ef38b-3793-4aca-bb80-f57e02a49a7f", "sighting--4636a30b-3b4e-4a10-86d2-1c73010d636e", "sighting--e01b0012-bfc0-43ee-9807-8160f831092b", "sighting--aaa5dc9a-4f30-4892-8330-22d97e1ed592", "sighting--14532e46-9d68-448a-9839-4f27a4ef1776", "sighting--39d727de-028b-4b7d-bccb-56eb0f17455e", "sighting--6710f483-5346-4c6b-b7a6-2d308d7bcd75", "sighting--a9254ec1-d402-444d-b16c-c67df593c62c", "sighting--ffe4223a-8ea9-4cbb-a419-8fe3a2176aa9", "sighting--645bf515-7e51-48fe-9ca4-e9c51217b0fb", "sighting--4767f4d8-5132-44b2-bafd-50cf0a70ca8e", "sighting--058ba47c-2465-4af5-b795-d21d5decc1d1", "sighting--359544e4-3309-4644-b83b-f3b629a72e9a", "sighting--524559d9-f485-41c7-bb57-6b6c93a64180", "sighting--b1c2323d-b0fc-4433-b10f-414b9f7be0a1", "sighting--1776bb36-2826-4fbc-b0e3-80e0ca3858bd", "sighting--331db6c5-50c7-45d5-bff8-4766d8d6b15f", "sighting--c92c056a-b00a-4189-b30b-18472834dc07", "sighting--2a7e38a5-a2a1-4d43-a63d-78db61e473a6", "sighting--fe7c6864-ead1-42b1-97f1-beab10eb6ee2", "sighting--47158001-6444-4b58-a512-eb0351cae719", "sighting--a0202b0d-e4b7-43f8-80d4-40b64df10b49", "sighting--313c229f-ecfd-4b64-a4c2-153409744cc4", "sighting--e63ec524-5b96-426a-a1f5-72c153894160", "sighting--1b0cedbd-3c44-4872-8ace-f3e723db595f", "sighting--8687dcd4-b26b-4d4c-b0f6-80186b69ecc1", "sighting--e130f6a4-327d-4234-b3b4-d1802d3cf90f", "sighting--490ba130-5844-4ebb-be35-c3ae216eba3b", "sighting--1ab72a2a-1337-4da9-a0dd-708b2598fefc", "sighting--65fd83ef-ac5e-4f91-aec3-25e6b7f2df99", "sighting--9485c653-f433-4fbd-99e6-cddc38461daa", "sighting--8c431fbc-1a32-4b56-8802-392800a11034", "sighting--b054f130-a523-48ef-9cf3-177e118ebb6f", "sighting--f8f994ba-890e-4c4a-9b93-5198b8f596ec", "sighting--a3594764-a324-4589-9d55-e5b39a42bfa2", "sighting--682eec33-0132-43cb-be5b-299b4005c259", "sighting--03e22b1d-9957-41e9-8e61-efe56d303fbe", "sighting--5c525c00-4dc6-4bcb-b14d-2a14fac6053c", "sighting--bb7413d8-9b23-4e31-b11b-9ec195c41810", "sighting--b260b194-9d3e-48e2-aaa2-286c602ef816", "sighting--8ba2b018-ad18-404d-8583-bcde905767ba", "sighting--3e9e4196-a18d-4ffd-b30c-3175fc0fdbc5", "sighting--63313b62-d685-4d59-bdda-9fb80dbba246", "sighting--204ba4f7-0ecd-401d-8460-ad2ddec4232a", "sighting--e770aa53-71c5-46e2-bd06-cf516cea4226", "sighting--032a04e8-d80a-46a0-bb28-432efba612c0", "sighting--f49d5a3d-417f-4ddf-ba18-4a6743ee8523", "sighting--cbef2f07-dfd0-431f-9d09-2b314310fd2d", "sighting--7d76e441-a785-4cfc-8296-9a153e3dc402", "sighting--3371ff0b-6750-4bd6-a922-1ab7b94f0f82", "sighting--0789e852-c0e7-49ee-85ed-0b6aee772c33", "sighting--61d340ef-6460-4d0f-b8b2-2c29d264c622", "sighting--a82c463e-f771-4b80-9fb9-49c2dd4a99e5", "sighting--512252cc-92cc-465b-88a9-579bf8f0f941", "sighting--f125dba3-77fc-4c2c-8c65-b58ddc807390", "sighting--485cea7d-a9bc-4130-af00-10c3f7ea9cfa", "sighting--1c2a41c3-7540-4c47-bb6e-35232363ff71", "sighting--5ae0878a-1f6f-4ef6-9359-0ba678452261", "sighting--c35c8623-adf8-4bcf-8010-4faf13fbf5e8", "sighting--88087daa-9ba2-48b1-a09b-b7f27dda690a", "sighting--795333a3-ee0d-4dcf-affd-7dbe80e5e728", "sighting--475d453f-4621-4a05-935a-1537fee6c85f", "sighting--d6a68817-d68c-4109-a21d-80d1805e1c38", "sighting--6d67096f-936d-4d7b-bdd1-c9eada333ace", "sighting--3b71a435-b786-4d5e-acb9-a216bf3aadcb", "sighting--3eb19d13-c1dc-40db-a27d-186e5fc20320", "sighting--22442264-c3cc-49cb-8f5c-2488547fa865", "sighting--2a99f119-8eae-4f4b-9c3c-f96de6f1e675", "sighting--2012211f-8bf4-4e7a-b4c4-af2e0cb80c13", "sighting--24f29bfc-7bb7-4a5d-bb40-ee0365d4f106", "sighting--ef3ac0c8-ce14-4ad1-84ef-f83f2bd54662", "sighting--b11eb18b-e440-4a6d-88f3-fd2fd5ce9d91", "sighting--728ece83-0c43-41fd-8c48-0729297726bc", "sighting--dfa1e35d-9e58-4919-a10b-78035586fb12", "sighting--d3f6295a-2560-46fa-a9c4-d3188398b784", "sighting--8f777326-0b16-46bb-81ef-1c85edf737cd", "sighting--56cc9921-7cf5-4770-b0f3-c61e018d9b89", "sighting--db2237d8-d3f1-44e6-8450-1235022ee39b", "sighting--20a8d350-0f13-4f1c-b447-04eec36aea8c", "sighting--408626b7-4dd0-41f3-a4f8-371d2a6215e5", "sighting--87fcb26c-8816-4915-adaa-a274c06173e5", "sighting--b10d3f5b-bee9-4202-988c-05681552edaa", "sighting--cd9c3992-ec18-4b69-ad82-01c2dd9db407", "sighting--cb21e141-e9f5-405c-b680-4dc308226bc5", "sighting--33868745-0a61-41a9-835b-9f3b563f8802", "sighting--78a4dc47-9b49-4368-bb78-e4b69e3b9ef6", "sighting--c4182005-70d8-46c8-b8fc-0f636b41e107", "sighting--b53d314c-421c-4c95-8ecd-510788ffb5eb", "sighting--ebb21a46-964f-42bd-9044-9baa2591c51f", "sighting--50bb4111-0dfc-49c0-9252-bd9c00ffd053", "sighting--5cd228df-258a-464f-b821-4a0f698d1aee", "sighting--35a51381-de8b-45ca-ac1d-6c101dd1ab5e", "sighting--11014287-9560-46e2-8dd0-920d8881ddb6", "sighting--1094c708-4fa3-4281-85ef-afab03984d5a", "sighting--64ff0efc-a323-41a5-b429-fd0014aea2e2", "sighting--eaafb744-b1a3-4255-b5e2-fa3929d248af", "sighting--03f2b79d-c492-448b-9032-ec23b5f9bfaa", "sighting--0cfbc596-bee1-46f1-a2ae-12b83f61dbe9", "sighting--1769a7b8-3821-4edb-9b31-6e22a08b0675", "sighting--e65fcf91-a1db-46b9-aad4-2e8cf1507278", "sighting--0b918260-314c-4862-a05d-4926cecb92f8", "sighting--4615f9d9-9122-4910-93ca-cf57a8707be9", "sighting--fc4e2cab-c9ce-47bd-bd8c-57e8772f3c71", "sighting--309fafdf-cff3-48d5-8dcc-9f11ddc816ba", "sighting--8eced7f1-5bb3-47d8-8baf-19a832fabfcc", "sighting--503bad97-a8e1-4627-a6ed-a13455cf3d08", "sighting--20c0a340-e699-4a7e-b559-68ad7c1a4739", "sighting--c1cd7cff-aaaa-4574-b52e-e7559ea2c7d4", "sighting--1222ff4d-6eb3-46ba-83bc-fdf57f1b3f12", "sighting--9720ae46-ad2d-4c1c-a65e-49be99402280", "sighting--e436359c-35ba-45cf-ae9c-528397d28e34", "sighting--48783e1c-29f0-46d8-a2ec-de582b0d4ce8", "sighting--33c07e74-65dc-4a55-821f-0cfbfbd77622", "sighting--51d37804-94e7-48f8-9fb0-753302875ac8", "sighting--7ca26b63-268e-41ad-92fd-96808eee0516", "sighting--4a33ca11-8918-4ae7-85f2-97593cb77507", "sighting--12a6ab72-8f31-451d-b03c-0f6f917bedcb", "sighting--24980091-e3ea-478b-8069-c12c9d1812ca", "sighting--a7a89bb8-8cac-4322-a804-d612befc5116", "sighting--cf5afee4-344f-4df8-9f15-477d937f27d2", "sighting--f8c521df-91f8-4bc6-9bbe-0495da91926b", "sighting--a4cb8e50-61bb-497b-b66c-8e6fd8655032", "sighting--95f660c6-2dbb-4ca8-a899-1102006eb089", "sighting--39b16b7b-1bb5-41f0-806d-0203c718032b", "sighting--498545bb-68c2-4268-965f-73274f9815c0", "sighting--97555a09-d9fc-4787-97fd-0043521aa27e", "sighting--80b2544b-7a0b-444c-8e47-ea25820de448", "sighting--3593e75c-a470-4daa-bc5f-11364a44221a", "sighting--8cdeecda-d2ec-4624-8d38-e8365e438afe", "sighting--71dfce65-f233-4d8a-81b1-9c36b0dd58be", "sighting--dfcb19fd-4f66-4ede-a2d4-829e4d97768a", "sighting--df79088c-7c6e-4a45-9a49-d8a83813beec", "sighting--96615aeb-182c-4608-97b2-b5f229cfe2f0", "sighting--2d519500-73e9-4d9b-839e-7dd5340efb0a", "sighting--3acbd01a-7ae5-4f01-a255-74cb796e501a", "sighting--772dd09f-72b2-4769-91ce-993f56c11dfa", "sighting--f5446deb-53cd-45a1-b355-7e67de4f9aee", "sighting--3e7849c1-fc15-4fed-910b-54cfa02d657c", "sighting--f0de559f-f6c8-45ee-b650-786ee54a0f13", "sighting--fa8c7e94-31a5-4c4e-9f63-33588036e2ff", "sighting--d0ed44cd-392a-45bc-92eb-aa7f32b80bdf", "sighting--e7eb4033-7e9e-4d1f-b21f-7a06194f8a11", "sighting--9c11d6fa-9e9f-4aba-87f9-752851a8a039", "sighting--1bf47603-f6d3-4a6d-9e65-705cdef9ee3c", "sighting--4c2d28f3-1fc4-4c49-a326-c8de54d05d85", "sighting--d5d3c03d-2bdb-4026-81d6-b30b17fcbac4", "sighting--b35be49a-8d30-4a55-a630-50a571cad90e", "sighting--4bc48bd4-91d9-4323-8799-e362f08f6fe6", "sighting--9d29f388-5406-41b5-96ce-942a20d50d40", "sighting--8b0c5430-dc31-4555-9508-c54d2ae3ff8d", "sighting--b3cb6664-0f91-46e7-8e4c-4be9b81aa9d0", "sighting--2f87ca1f-b86c-4859-94f0-dde6244bfbd2", "sighting--068db310-66bd-44d5-ae18-4854009c1002", "sighting--6ee3d0cc-875c-43c6-b611-eff11589c9d4", "sighting--7e9eb41a-6995-4bb5-9724-5b94b7c3a485", "sighting--dc64a0b4-4c59-4487-8ffa-2d7b0dcc48ea", "sighting--a1094208-7773-4eb6-9871-a555baf46e3e", "sighting--2cef3c57-8201-4b9b-8a72-4c555f42f439", "sighting--8cf331fe-beae-4b97-9a5e-a203521164e5", "sighting--de0d9dc0-f398-4862-8686-beb04e271e91", "sighting--7291c67e-e204-41f5-910f-864dbb3c3d92", "sighting--84daa7b3-c395-4670-9daa-27c0438aed9b", "sighting--c1b03d62-a86e-4c16-aa13-df4f65184995", "sighting--1835c185-e975-46f1-a555-99d877fa1f0b", "sighting--9c301aee-6a9c-483f-8a27-94482f3915d7", "sighting--98e5eecd-1d2b-44f0-96b0-0184b86dd763", "sighting--23d125f7-f536-431b-8634-d704b67cc024", "sighting--f6f38776-de7c-4e37-a41e-4004c097f3a5", "sighting--800875d5-8af5-49bb-b1e8-9f2bf1ea836c", "sighting--e118bc66-b987-4e1b-ab4a-8e5a6456cbba", "sighting--6a9c57e4-800c-4ff0-bfb2-894797a683ed", "sighting--172dc499-dc2b-42f2-b5bd-90e467a24a14", "sighting--1cc77438-5eca-4804-80dc-0c5448f2c2ca", "sighting--dd7ecef1-4639-4e58-b74a-412072841d2a", "sighting--728a5db2-7ea2-4989-89de-774faf7f70ad", "sighting--1b0c1824-3d1f-4843-9ec0-1290b1369583", "sighting--9578d333-5747-46a0-af2f-f4101284c4b9", "sighting--7d5c7bee-e3b4-4a43-8ebc-394cf12ea1ef", "sighting--62a3406a-94c8-435a-99f8-9424cb44f5e5", "sighting--ae48012e-582c-41a8-95ce-53a2133f2718", "sighting--4d2f9b08-cf52-4efb-89ea-a7ffe3ea87a1", "sighting--2d7d10a3-fb26-4f59-a06d-c848ca7d5d7c", "sighting--a58f89f1-7f84-4afb-b55d-d7ff61cfa83f", "sighting--e122eccf-a6a2-4b8b-b393-22ab40f8e5af", "sighting--a65e15ed-92e9-4b23-946c-a7cc3077a3de", "sighting--80b1c4d0-958f-41b9-9dfa-3255404ded5a", "sighting--588d3735-bf90-4d90-9f91-8577b26f07a0", "sighting--7e776ece-6e11-4f2e-84e8-cabc3b5af73e", "sighting--ca0fd71b-b5ca-41a1-9ac7-b056d0d814f0", "sighting--4a713dd9-8fc5-4fa1-8ee5-368d34acc3f1", "sighting--f47e47af-516b-4c04-9eac-8ccb1dde8a23", "sighting--c91cf41b-c9cb-437a-9f61-fbcc14911e0f", "sighting--00640c21-7be6-49cd-a4d1-b504077d0f62", "sighting--413bc73a-1e60-4f47-a3f8-9568b832779d", "sighting--c82abb08-10da-4ac4-862b-5491cfb0ee63", "sighting--44a928b0-6c28-4ef2-8950-0e8b6ea979f8", "sighting--7903cf96-f0df-41bd-9249-fbeef2e8967f", "sighting--4abb78f0-fad2-4108-94e4-ef0b5831827b", "sighting--b92bc947-fbc0-49ea-926a-59bba6e7274a", "sighting--84fbea93-5615-41c8-b3b0-7e4b8ce3d8f1", "sighting--c0b04615-2d68-4c67-853b-fde1b1d14566", "sighting--51f28013-28d6-4d7f-b53f-b6d7eba5de26", "sighting--eab2650b-228d-456b-8152-7354df0b36a0", "sighting--c746d62d-af86-4f54-a552-8b584437ab00", "sighting--ce18d54c-4adf-473a-a1dc-065f2439b2b1", "sighting--67c2c574-2d7c-415d-832f-cc5145e595cf", "sighting--06c62560-3eec-47f3-abfa-bfd2e009a807", "sighting--e3490b50-e098-4e4b-9bd5-cd2546646d19", "sighting--67a67966-f24e-4058-ab6a-fd15c9ee943a", "sighting--7aefc11c-7521-4068-b1d6-5c22a0335a92", "sighting--6967d078-3d23-427b-9aab-38be9f0369fc", "sighting--d06da585-6dcb-480e-8f89-12f8ba60991f", "sighting--d3218bfa-4f6d-45fc-a60c-e44d55b0d3c7", "sighting--8f65f1b2-9de5-410d-9935-37a176d723ff", "sighting--146dba7b-5d89-4a2c-a005-17379746ef7a", "sighting--91001a91-dd45-45c8-9b70-dc66556e207e", "sighting--e7fa29da-f2a0-4ce2-8ddc-fb72a6955a0a", "sighting--2a573d7b-e8f9-4107-a7bb-1a2c06329bd2", "sighting--836250c5-572c-4f3e-88a2-0efbb2d333bf", "sighting--8e3e6637-4147-445d-92e1-7e2991c5a71d", "sighting--d4c25488-8a55-4db2-aeec-ba299c9f7dba", "sighting--073e7d53-d72e-4c92-8085-b4bcb9787eb8", "sighting--bf87618d-175f-467f-97a1-51befb0a10c7", "sighting--a6e356eb-f096-4138-a4c4-8b298f0567d4", "sighting--535c7917-2b89-472f-bcc3-39dfa850f5e5", "sighting--b0899d00-7929-4119-918a-6706adf6dfdf", "sighting--da78a7c5-652f-4d7b-affa-33824be74d03", "sighting--ace6180b-0964-4fbe-bc97-b180cbea178c", "sighting--904d9fce-1371-49fd-8de1-fa6720239288", "sighting--bc7f7100-a2a7-4f87-84fd-cbaca52c2bad", "sighting--c6a0fb08-a416-4d69-8528-f452309b19dc", "sighting--c21e0c35-6067-46a8-9adc-6c3714642416", "sighting--f01a3bff-6782-4aff-a4d1-c29ac4c4a52b", "sighting--d5bff527-bf43-477c-a106-e6b0eef93ccf", "sighting--124108fc-fc48-44ee-9580-674c29d61ca4", "sighting--e831a5a5-8d1a-4ae2-bee1-669393e4a3cd", "sighting--ddb1c187-c7c8-423a-a021-237263dfad80", "sighting--51c80fae-c26a-4d8e-94e3-2b83b3aaa417", "sighting--1b647f37-45bd-419a-80a7-6c08390bc194", "sighting--e8fdd484-82ba-43c3-bfdc-a6a9437242f3", "sighting--97ed8cad-67d5-43cb-9f1b-0e9cca5d7385", "sighting--269b9488-f889-4d9a-a1c0-a6e45669744e", "sighting--eedf5d0d-bed0-4565-b58b-3ab8720a2123", "sighting--3f7b5c8d-18d8-4c04-b50d-d9612dc8e8cf", "sighting--2f1480d0-d244-4398-9507-6adbf95b3137", "sighting--03e681a3-d974-439a-9405-7f4b29b58b4c", "sighting--eca7b77b-e186-42b2-93f5-0a3d4b4f3dcf", "sighting--800400fa-2215-45f2-9f84-2d0701fb988f", "sighting--1841e8bf-73fc-4dff-bb42-ce8e05a8e1e4", "sighting--0c883ca5-0218-4744-96c9-5270f5215c48", "sighting--09343865-2394-4379-b7b8-d345d6af407c", "sighting--bee7a93f-fca3-42ce-8fef-d489fca3d722", "sighting--d0db1d34-7250-4b7e-8553-43df0fb8217d", "sighting--8d9409d1-2067-4843-8b5f-83a06a5e2154", "sighting--f2b76724-326e-4fc8-96ae-4034a519d146", "sighting--a065df75-dc97-4900-a5cc-80768a2cc5c8", "sighting--aac5ee16-3fae-4cb1-8ff8-d5a1dcaba0e7", "sighting--ac94493c-9232-47db-89e8-f441fdf2fa14", "sighting--985925a7-5de3-44fe-b54e-c8619f7ead2e", "sighting--59c77b94-c21a-4a03-97bd-a5a03cf24591", "sighting--591cd739-1074-489e-8111-e8c2e0744cc3", "sighting--097fd9c3-9a6d-4a2f-931e-cfbdd7f7ac83", "sighting--be57abdb-f67d-427a-a44e-6787cec59459", "sighting--cc3521df-d866-439d-9602-7a14cdd921e8", "sighting--2875d5aa-9ece-4874-8bc2-9e0f6259e6ae", "sighting--8ba7475a-c8b5-46fd-9fed-6e0e34277fd4", "sighting--7bfc14bf-3e6d-41d6-b1b2-7ff282af5715", "sighting--58142448-f3e2-44a9-b7fc-0a531d50746e", "sighting--40b82694-fe3a-44f3-b59e-7bcf68323c66", "sighting--0f1e462a-d152-4ad1-913c-cdeb2ec6416a", "sighting--89089ddf-43fd-417e-b954-4b311b10a056", "sighting--771f2e2d-e4d6-4190-95e8-214ec1cd2ad8", "sighting--3baaecfc-e1a5-40e6-923c-b3fc99c26044", "sighting--622a9dca-6486-4635-9397-8fa0658d1cdf", "sighting--37bc5873-6e05-4be3-b199-b8ca83dfdc7c", "sighting--881b5298-a7a2-4fc3-b3ca-7b3670258d85", "sighting--789fc451-26d7-4d72-afcf-aeff5a428502", "sighting--f0b003f8-a785-43a0-9cc8-5a5ca32fd6a5", "sighting--2262356d-bf3d-4dcc-9ed2-8fcb258c1ab5", "sighting--6048ca47-928c-4f7a-a931-7dcf40f2f65e", "sighting--d365f822-5fa1-46ba-966c-fa32933118bc", "sighting--9fc6e7bd-8578-422a-a95b-9d7bffad6a85", "sighting--21334bca-3a99-48e3-9623-0fd9e1169a33", "sighting--ec4f7639-3788-46d5-bd64-4789229a9163", "sighting--a37633c6-a303-4d30-bc9a-0a23af4f51ce", "sighting--7767422f-e5dc-4970-ad51-bce27aa09993", "sighting--991b56ad-4834-4e75-904d-55a5d9ca997b", "sighting--83e901d2-c912-40d5-867c-a2a2ea725a91", "sighting--0701b26e-99e5-43ba-aec7-6811da23997a", "sighting--5444b88d-415e-4aae-92dd-c39bf8044645", "sighting--baadb2cd-6b3c-4ab9-837b-1adf8436b881", "sighting--3ed0b80c-c510-4554-9ff2-38b6a4ed8f11", "sighting--6a3c09cc-5932-4b98-ac36-272372229ebb", "sighting--eee68e1b-1624-473e-92ec-8d48034344c9", "sighting--68148fda-e19c-4893-b540-730a5ec9535c", "sighting--5aed6898-dcaa-49c2-8fd6-b2e7e16a9d00", "sighting--8da59fac-02e1-4dcc-a1c7-18fcd13908cb", "sighting--4c9126cc-697c-4f85-b186-3b5b1a70d1e0", "sighting--084b89ee-3a89-43d5-af02-50444962587b", "sighting--fcfdbcfe-7255-457b-bbfd-99e7d4861ca9", "sighting--097dd8ee-8da2-4054-a250-d014875d7b22", "sighting--2d5cae13-9096-4697-b2b0-3972fbdd6deb", "sighting--5669bc2d-9806-4417-880a-2d69f2da2174", "sighting--b1f12e26-600c-42a5-bb10-9da0d6478a2c", "sighting--59f8b991-f0bc-4262-91c5-a7fea0c2d7d3", "sighting--d5467565-7365-49a0-ad4a-a87503d766cd", "sighting--4310fba4-ef07-4f95-8511-8bb88a99cf52", "sighting--5a6c5c9d-575f-4674-95d3-729851a3c76f", "sighting--12f046c8-8f2f-4778-9267-2ea98a475508", "sighting--e2adc334-1071-437a-b1da-bc6e27ba1256", "sighting--612e8759-70d4-4303-bb57-8cc49dfdb19e", "sighting--e12b9caa-1dab-47d1-a15c-e3eafe0a7ec4", "sighting--3adac4c5-b2de-4ea0-ae7d-968abd0ca4ee", "sighting--8f9b42e8-477e-48b7-a665-d22cbdb08a09", "sighting--0ef2b1e9-9ceb-4f30-ba35-f54b19a60f31", "sighting--0d352beb-3abd-4dcc-bf60-c5fd517e635c", "sighting--d240b115-a270-4819-9b65-eae6e199255c", "sighting--bc9e9506-57f6-4eee-873b-ea2f669e41bf", "sighting--2d321da9-a6a0-48ce-8557-1a9cfaec7cc3", "sighting--3a404c2a-a2b5-4dab-b974-7a0c939754cc", "sighting--3caad838-978a-4b38-aa3d-fe6373a94119", "sighting--b92f2329-3e4f-441e-aa2e-7f350b1c09e3", "sighting--9df8affc-8885-41d4-b8b1-6556f0e9b15d", "sighting--9bf6f881-d9c3-476f-bf68-553919ef7206", "sighting--c45526bd-cfd3-4a7e-8ff1-09649a66a9ad", "sighting--70160ef8-30c9-483c-9eaf-8689199d9c31", "sighting--537a4cc2-554b-4a12-98d2-05cf43c62232", "sighting--78bdd874-33ed-43b4-997c-23e3a10b1d3b", "sighting--869ed3fc-3dac-4100-b8fd-f69a774545ef", "sighting--2e3025dd-1746-415f-8a28-a0dc454f58bc", "sighting--fcde20c9-1332-482e-8b72-30079d2f3b26", "sighting--fd351525-a5de-4353-b3fd-30a0d834fc4d", "sighting--5949be60-1abe-432e-8a84-fc53f13341c3", "sighting--be5f555a-63c7-4900-99af-0581dd606a11", "sighting--9a9efd3c-675f-4ce0-adb4-171de7ad1281", "sighting--84aba300-cba8-4cd0-b9c8-4f213e5bd6a9", "sighting--3d8fdbbc-c332-4404-b26f-cac813e5a5ff", "sighting--ad4700f3-6739-456b-ae18-73e937ff8eb7", "sighting--576f85ca-2900-442f-b691-150d0862046b", "sighting--a36fa273-9bed-49ca-a38b-3a3db8661ad9", "sighting--099f9700-00a3-45b0-aed8-134623a1192d", "sighting--8740ceaa-55db-45e8-96b6-dabd8d7023c3", "sighting--aab4f8cb-8df8-440b-b4e4-5f83aedefdac", "sighting--c348fcde-1def-44e2-bafe-fd1fca85e1af", "sighting--3de989d8-d3c9-40cc-ad3d-c52bbe2554ce", "sighting--3d4bdcd1-f0e6-4d72-9ae3-03167ed0e805", "sighting--83cfb533-e1b7-4add-80d2-8afc4065182e", "sighting--1c5aec98-6eb1-4e13-a310-39da5c675aa1", "sighting--a5c46b48-a33e-44df-a6e7-aa84dcfc6435", "sighting--9ad254f0-54b5-401c-b3d5-f042c9b54b4f", "sighting--15497255-9bd8-4687-ab5b-14aa30fd0390", "sighting--bdf76278-91fd-4800-bd4e-27eee499d2b1", "sighting--c9170003-ea49-4ecc-92c1-4d0c0930afdc", "sighting--959bb06c-ffac-444e-be6f-1ce9b75f3c06", "sighting--117c90e9-e6ad-4332-af16-6c7e518de720", "sighting--dd022dce-bd25-439e-90f8-e3a42f380bc2", "sighting--60885fc9-4b8b-4ab3-b3d7-7eff4ea20f1d", "sighting--5e0d0ef0-e9a5-44be-aa26-3c5de3d6b925", "sighting--4a2a7125-c64a-4ae3-bc07-1d01104b03bc", "sighting--e5b572a1-21f0-443e-a5b9-91f18347ffc6", "sighting--ab946398-73bc-421c-958b-ed4992632ffb", "sighting--b2ef6154-f29b-4bb1-ad72-adf3255fc9bb", "sighting--f91fee73-7bae-4b3b-91bd-f15e97cffb52", "sighting--7f308769-5f4b-48a4-9434-364abf8be2bf", "sighting--3468be9e-89e5-4c87-aaa8-5014eb8a619f", "sighting--f7ba1921-c177-496d-bf40-49473e714e0a", "sighting--133349a2-4277-441c-be2f-f2bbc2dd1bf7", "sighting--d65b2fc9-ad6d-4dbe-8158-e70603fddc55", "sighting--b0233c4c-0050-4bc7-a8c3-9673f4786253", "sighting--4d91737a-c90f-42fd-95d6-73ed49b10262", "sighting--b589476e-d660-4665-b1b0-8f7e0fb88253", "sighting--ba1fe21a-ae6b-4331-8112-a7ca6b872128", "sighting--b15ee375-4ccd-4ec7-8f6b-ab70bd9e8a8d", "sighting--670f2566-dc9d-4947-b94c-2947f59195b1", "sighting--06b2c355-e7d6-4607-a0c2-3aa7e269f03a", "sighting--9776eed4-0385-454b-b5e5-72cb89672d3a", "sighting--630ff386-0546-4102-8a77-02ba0c1dd165", "sighting--49aeb810-45af-4f65-b2b4-b06f8c50691e", "sighting--66c84ef5-da63-4e6e-898f-f1a800293c37", "sighting--dfcc3e26-3d9f-4a88-a5aa-6d84a1625503", "sighting--4be240fd-27f3-4ada-bd62-b1b49d567aa2", "sighting--27488a35-ef02-49cf-8edb-3886a0dc8d65", "sighting--4061b4b6-699a-4d5d-bb1f-f4062620944c", "sighting--c78b955b-fc65-4c3a-99d9-2a8b29dc7862", "sighting--74308b47-9d52-4449-bcdc-430f40c592b3", "sighting--aa1764ef-32d2-422b-abd1-de7198bb5ac2", "sighting--f80f78e5-8b5f-4be2-8a3a-8b528a754ab7", "sighting--ad8a1f32-8b2c-498f-b82c-d7ff7e50d436", "sighting--e037ec4f-b001-4a4d-86a5-dec924c4074d", "sighting--d8745815-987c-4dd5-a436-365a6b5d28a4", "sighting--f551e26b-b1f3-43e0-930e-5ad5d1b2f093", "sighting--4c661db4-8506-4c99-84f0-d6f62023316f", "sighting--a7da406c-940e-45f2-9397-5617f3d4facf", "sighting--026e746a-3137-41c0-903b-eecc1f07ce49", "sighting--18ccc099-c626-4053-8fea-2d38b075e8aa", "sighting--996e21b9-2bb9-491b-b004-78d63a218ccb", "sighting--c44fa466-3703-4d16-bf9d-12a89e10923c", "sighting--7fc090f8-311d-4631-8708-4e284f9a6347", "sighting--db79d919-036c-4d5a-b722-626cfa5c4425", "sighting--e5d0d25c-0ee9-4be2-bf84-f23aee437b8a", "sighting--7c500f6f-e36a-47f0-984c-bf9acc657658", "sighting--f9a58a67-de70-4d96-9af1-132ba968fe3e", "sighting--35720810-3cc0-4873-9373-a5849ac2dbdc", "sighting--26ef7720-a638-4181-8f5b-7d76c534f5a1", "sighting--6da01885-5f9b-4201-b381-ed86e3f2b71b", "sighting--de200227-b626-4158-a583-24a2bcfb1100", "sighting--93ca4a42-cb21-43ab-b6cc-51d01972782b", "sighting--0f5cfded-8d49-4e7a-9cb4-9a210c47abee", "sighting--e1d72a78-2fef-4af7-97ef-49b7a3e7c6e2", "sighting--dc86606b-00d9-4bad-8445-d9a52fd9472c", "sighting--02aa9f8c-de80-4fc9-abe0-d8dcfa9c337b", "sighting--9f4294c3-6e6e-450d-9fca-7c9834b1834d", "sighting--c38e5de7-54ec-445c-8518-48419c0e3304", "sighting--4e28217c-4709-4daa-9136-ade5d4a6c2fc", "sighting--58b72234-d0f2-42a7-9373-3772a8437907", "sighting--ca2db99d-ffa4-43ee-ab9d-61840bcda915", "sighting--e7ff1113-e2a3-467b-b2f6-953390389929", "sighting--6759bd80-8580-4d80-8f88-0570ddb8a307", "sighting--4186f9b7-5ab5-42c2-937a-4262273a1082", "sighting--d090f69c-3994-47a8-a811-505365083e31", "sighting--56d4797a-f426-4f03-816a-0938431f8f97", "sighting--4dd73126-0274-4d81-8458-12ab934efd4d", "sighting--78bd3540-d67b-41aa-ab86-f56906316e30", "sighting--8279ffe2-252d-427f-95cc-0b45300129fd", "sighting--2c082318-b27c-4bc4-a2b0-3d874985af59", "sighting--81dce424-47e4-42c3-988e-59d6613c0760", "sighting--e9978b40-7596-4b5e-9877-97e8c38807da", "sighting--f4f8afdc-3212-4dc5-9ed9-4e8cb7e964a7", "sighting--16321d4d-cc29-464a-9166-227ed6aa5281", "sighting--5a26105d-2b29-4406-86bd-2d20d1691b91", "sighting--0a861413-f273-48a7-8462-d1d212986624", "sighting--ba3a6c34-bc3d-4421-8afb-60a86fcd0906", "sighting--80c0fdda-0c39-4405-8349-a58101caecf7", "sighting--edfa55dc-9acd-4412-8ad7-87c2f7b52d53", "sighting--bc3dd87f-fe66-4b8d-a09c-01b75114a173", "sighting--6c6325db-2df3-4721-889f-7f45553b8b5e", "sighting--bc76e930-625c-421f-9e46-e8cc64b6e266", "sighting--2cb09a3d-cb58-4369-92b8-e2919f983cf7", "sighting--b53b46d7-62e2-4a75-9df4-f7860eb2daa9", "sighting--95bb194b-3176-41f7-b5d8-8cfe206b7b7d", "sighting--1cac509e-377b-4bba-8ed4-5458147a767d", "sighting--603b5691-0b2f-4d6c-a41f-33514adcecdc", "sighting--45ff8172-4a04-4e3b-a5a9-4b7046d955fe", "sighting--3e62f3e2-b3fe-40c2-a5a5-b99742679717", "sighting--e7caf7b8-3e07-4484-88e1-8510fa647c38", "sighting--c7659fa6-fca7-48ca-9537-1da08d274166", "sighting--b02f8c1d-0c16-4630-9663-7931352ac5e6", "sighting--65591cc7-3fc4-42c4-aba1-966301ccbffa", "sighting--e5dfa72d-db9a-4d3b-9d83-e13f65b46ea9", "sighting--9e121f1c-07a3-428d-9f18-f90621188617", "sighting--dd6f579b-6726-4cd5-b62f-6195afef1b29", "sighting--4b3cbb4d-4eed-4c70-921f-ca675182c699", "sighting--18952765-b1f5-412c-aaf4-3d6d77667949", "sighting--89bdf09a-6558-42e1-b451-5089f3caf48f", "sighting--57330958-0fbd-4e08-9b00-30dd09e44324", "sighting--d69feabe-2255-44d9-ae1c-4c1e4b0f0d1e", "sighting--01e8de47-72b3-435c-91ae-d25a4cf0a1f8", "sighting--7cdcb976-a7f0-4691-8ef0-db4c38189a63", "sighting--97dc64aa-4f9f-4d1a-af1e-4b33be6ddd51", "sighting--fa67f7f3-d313-4051-ad71-c0fe8ae247b1", "sighting--c2242825-229b-409e-befc-0b1732a5db9e", "sighting--45115311-3e2e-4eba-acb7-8a5ff620a9d9", "sighting--4e01e243-d0eb-4caf-b120-d85b53bb2d61", "sighting--60f0203e-0e52-4529-9714-b390aa86e8fd", "sighting--c5cc1917-a34e-4b62-bedc-20e96aac3eaf", "sighting--a54fac57-b899-43eb-a0fa-94cd581242aa", "sighting--7a8c7401-e6dc-4612-9005-478513ba5bb0", "sighting--69315d63-0d6a-4a1a-92f0-8075f50ebe3f", "sighting--c7c3febe-bb12-44e8-b6b3-dd2d5bbd6047", "sighting--bab55d3c-e9f2-483c-be7d-3208e84ce7d6", "sighting--b8a17ea3-b5fb-47b9-820f-9b85f568e6e9", "sighting--0d817d8e-4f37-4d1c-9f4a-d51416359123", "sighting--83b5609b-045e-474d-847f-52a6d0a86d37", "sighting--4c5b1314-e690-49aa-9740-69723f398c22", "sighting--dada775d-a1f1-4f20-a534-a3b6de4f7d3e", "sighting--de9faa9a-33e1-4860-bc9d-2572b0658174", "sighting--3cb1921d-c33d-4bad-bc9f-f671b9203cfe", "sighting--d78abd6b-2f5e-4111-92a9-c863360db80b", "sighting--3a435bc4-b69f-4d27-b73a-25bd63de2405", "sighting--c308fa10-38cd-4adb-9ec3-952acdadef2f", "sighting--49fc5eaf-d776-47fd-b8ce-99702c1510e3", "sighting--dfb6e5d5-a5e3-4481-94fe-a38b8de66ba7", "sighting--c453ec60-409f-43d3-9aa5-44e13da50ba8", "sighting--1bafa303-d8b2-48ee-ae69-0fe10c26756c", "sighting--a69b04fd-3524-4f60-a41e-6df2a529c7ee", "sighting--6c1131c4-5297-4544-b39d-063ccc198ba6", "sighting--3eaa12f7-e477-450d-a262-a9cc705f9a36", "sighting--2d323ff0-e13e-486d-9130-b3320022d70d", "sighting--d921172b-c1e5-4972-9ceb-259d796b5a78", "sighting--29828070-7ad1-4381-900d-a4a8e2a04d5f", "sighting--2e0459f1-cc32-4ccf-8153-fb7315aa6620", "sighting--3a3de781-5b3f-4f3e-9f62-ef4b33d4fa62", "sighting--af31106c-a1e5-43eb-8287-2d67137abaee", "sighting--d25cb81b-8140-47a3-91f5-675c8f7bb7f9", "sighting--6d1e5c4b-8a5c-4fc9-8e0e-dc95d3570f0c", "sighting--c12c13ae-716b-4dd4-89de-7e8bd97f2e2a", "sighting--e28ff936-b3c0-406f-b800-d0d5a823f403", "sighting--7cf3f6bb-7d93-425e-940a-add8dbe130ab", "sighting--9be79e98-056e-4ebf-8f40-ba24abd92738", "sighting--e815c4b4-3781-40be-b8ff-14841ea4bcaf", "sighting--7c34b6c4-25e0-4720-b572-6c01a4bdef76", "sighting--1eea82f4-98ab-4c8c-b596-2ab1aaf2ea57", "sighting--c097f9b4-c785-4830-b8ed-ee1461be0407", "sighting--7e665ba7-0c7c-4541-ba2b-d5ccf0ca52a4", "sighting--cb56c370-9bdc-4f8f-913f-25676f0da624", "sighting--7a8477ce-2d3d-4c1f-aa90-6ff954839dd9", "sighting--e2c8fcf2-60f9-4a76-8fca-2567bb6b66a4", "sighting--e4b18667-ffac-4990-b475-11e3d43809ac", "sighting--7f4d3828-5ab2-4097-8c2c-6c0c6bfb22f1", "sighting--20f2774c-a0ad-4481-9c9d-1f6ef1f641f9", "sighting--4ac5182e-140c-4230-a324-ef0688dabf8c", "sighting--5c77f902-74d6-4ed2-a510-cf7d382c8b36", "sighting--d2063474-04c9-43f8-b67d-1c1f050f91d8", "sighting--8a75982d-9db0-4e2b-8ab0-bd3a1ce4e26a", "sighting--a8b7d69b-522b-43a8-b6d6-63522b3316b3", "sighting--b53ad1a3-69ef-44c9-b7e1-604fa05ed42d", "sighting--a9db686b-5dd7-434a-890f-617a7124102a", "sighting--84006b9b-ea5f-4734-9b4a-41a34760436e", "sighting--6c888db7-beb3-4403-a608-1933239acc3b", "sighting--432321f8-37a0-4475-b7e5-6efc205703d3", "sighting--538c072d-8a87-437d-b37c-ebcc3856a15b", "sighting--1c94e835-8c9b-4379-a09e-6757810e18d1", "sighting--0b7978e5-1595-4c9f-a35f-83e8cd919bda", "sighting--7c2c034a-7505-4351-ba14-1c248a2844d9", "sighting--fec3ef01-5804-41af-9971-835e0f488125", "sighting--3bb0201e-2f9d-405c-a76e-380fa694b172", "sighting--d964231d-6126-42ab-952c-8309f2e7baee", "sighting--749769fc-d47e-46ab-b70a-49fd6af81b25", "sighting--6033aa05-c403-4767-a669-d2bcdd98e279", "sighting--d92b22e3-9191-404c-9dc0-b3164d8a0c9f", "sighting--99083785-559a-46cd-8471-fc3861de4282", "sighting--7ea2aa9b-dd39-4788-9f76-b5be45956a4b", "sighting--562fb310-53c0-46fb-86ad-3dad4755ae46", "sighting--f16361f6-958e-4af8-8a76-c5e9445f7cb5", "sighting--b74d90e2-360f-4cd8-94d2-7ef728987f29", "sighting--cf617593-2729-4f6f-81ae-10f811277282", "sighting--b1063a85-4161-4f7d-9bb5-1d93517c2b59", "sighting--b4e71e12-c185-4666-baa0-9346f86b880d", "sighting--1b8a9cb5-c601-454a-a70b-cb2c391bd606", "sighting--fc9cde6d-eb6e-4849-9be1-b24bd74d3d6d", "sighting--b508059c-7f6f-4f68-96c0-347662651dec", "sighting--87030df2-fe20-49bc-91f0-29864cc52bb5", "sighting--ee3e4043-5183-4ded-938d-2ec520665240", "sighting--c55807d9-f31f-49de-867b-3f32cba6a11f", "sighting--f27b151e-2cbf-4b59-8747-93d341f9cd8f", "sighting--2cfacd05-8295-4fdd-813f-b4f45adaffa1", "sighting--9795b2b0-b01c-40a8-9dd2-2927358386db", "sighting--50ab4a54-8db3-4e18-9614-dc3166f66c09", "sighting--a4a40953-7ff5-497d-9e26-c7495ee0e2ec", "sighting--b6305580-170c-47a9-a54a-a054819aa102", "sighting--8f85cfb4-82a5-4dbf-a591-d459d9921d87", "sighting--79f0ac2d-cd1d-4ef1-928f-337d2404307f", "sighting--9e3112ec-eb81-48d7-9fb2-9d51741f6b36", "sighting--52466509-ac43-4b6f-a13f-369479269dd3", "sighting--2c148e8a-c496-4836-9fe5-b9c1459e6ee2", "sighting--77b4799d-2ede-446a-9917-17801a91d783", "sighting--fc6d090d-046b-45d7-8c39-831cf6329e6b", "sighting--43a2e0fb-db9e-40dc-9d57-249797268ae4", "sighting--f7cc48be-9569-4e54-917c-e0b62057ee86", "sighting--e64251c6-428c-4dda-ae58-b0e4fdae96a7", "sighting--7e7086f2-66fe-4c6d-8c76-6a7ac9dee3ca", "sighting--7004adb1-a558-4587-bce2-4bd11f009d20", "sighting--4de99ca3-ad57-44c4-9031-d5f25276312b", "sighting--8e1ccba4-2bb9-4c7f-8431-167d5c35caff", "sighting--55480490-0d08-488d-92bd-40b44d898109", "sighting--f925e1ab-df7b-4e1b-94c0-c693e3361045", "sighting--3f2750f7-ee43-4e4e-bc8e-09b21372d609", "sighting--4d12297e-14a3-4289-8f7e-ae35eccd4ea4", "sighting--5b0b1f76-7522-4fec-a4ae-bd54a53b1af8", "sighting--f5e7911e-6d15-442a-8d60-e5e500c1d9b9", "sighting--988d1a83-836e-4c72-b18d-530619778a9b", "sighting--d5b0f6d9-4036-42a7-83ad-ca9e58a2fa5b", "sighting--f3297181-af39-433e-b2a6-10a5e1941df9", "sighting--96abdb6c-3b26-4c01-9152-c56a7540e5f4", "sighting--63d837b5-6c83-4318-bdba-b0f0c9dc4880", "sighting--d385d6fe-f6af-4061-94b0-6d6b5d2bd7b5", "sighting--eda126f1-881c-4bba-a331-f575c8bff89c", "sighting--4d1e80e5-8030-4369-adf2-ec4a83f959f9", "sighting--76c4e7fd-bad3-4821-a225-7a4fe950b9f5", "sighting--101cc3d9-cf6d-4dc9-b991-7ad0d6d48042", "sighting--9fd36dc7-213f-4ce3-9e0c-10ff10544fda", "sighting--cb969158-6c6f-4a31-b944-6d82ec37a086", "sighting--a741e22b-31f2-4abb-b639-55189ed090af", "sighting--22461a78-9728-4312-898a-173214ed451c", "sighting--fa313217-661b-462a-aaba-f4178b794b0d", "sighting--fdf4725d-564d-4287-8fd3-f31222c8e09f", "sighting--f5456b40-2e39-4e11-a78b-73185f42824a", "sighting--3726fe91-44d4-43d1-af65-8da5e3a5fa78", "sighting--5828149c-000d-4716-96e5-4d47a84aa299", "sighting--897581c0-c35a-4a2c-b056-bc3fdc093ef0", "sighting--4207088d-dc41-4b85-bedc-435700bcca43", "sighting--ba51da4c-9603-4d99-8a7e-e0289a866afb", "sighting--184bf11a-93fa-4925-b08c-f555a32eaf8d", "sighting--c76af92f-39c1-417a-8034-e28e007cb2a8", "sighting--6159f8e9-57f6-42b0-9b8a-e7fe7682b447", "sighting--be18b072-f3f7-4eb4-b551-0a66870e1479", "sighting--02b5c0a0-445e-4d3b-8c0c-638d39860555", "sighting--b5936194-dfd3-475c-95ef-d8fd36d6a5d4", "sighting--7d975c38-dcaf-4880-acf1-245b31c0e992", "sighting--c9f88325-1a3a-40c1-9442-10f6c5698c14", "sighting--f996ac16-2924-40bb-a7a5-a01713e6cd4c", "sighting--18c494da-47fb-41b4-9be9-504faa5390ed", "sighting--d6c62e75-dafd-4dac-9e17-027439f1f97a", "sighting--89c02930-38f5-46c3-9f7a-3e36c7186c57", "sighting--3e91ae6d-8127-4f80-81bf-9f3fb9c37796", "sighting--4db274a4-9b71-4a9c-a5d1-88a17118977f", "sighting--d13a0cdb-d956-414c-b8e3-d92acf776827", "sighting--a6f9cabc-a3eb-484a-950b-14107ee09437", "sighting--cb3cd082-908f-45a9-82d4-e75831895ddc", "sighting--79e793cd-2541-45b7-ae6d-7a6d0d9c432f", "sighting--e1ae3f2e-c19f-47ec-a08a-370daa8b113a", "sighting--9995b0ab-0417-4e84-90b4-600065127810", "sighting--d0ad1327-7fc4-4e31-96ce-29b7aa530f49", "sighting--74395072-c2a7-403c-9e3c-673238f88526", "sighting--29fa5527-c601-4ba9-b012-ff0c69d96ac2", "sighting--1bb91a73-7310-447d-8adf-a8b48dadd1ea", "sighting--2555bfb5-f505-4cc8-88db-959408a41c47", "sighting--7e883db2-c453-4851-a618-fd69aa368322", "sighting--a10ead05-3e58-4146-8e0d-44f309036729", "sighting--cf6d01a1-a196-41ec-a2b9-fe0141b893aa", "sighting--2e23cc51-f37c-47d1-9dc0-f80de95d6cb2", "sighting--37951a98-a9be-445a-8d7d-9739e8ed0ad3", "sighting--cc3522be-ed61-4548-8943-722e6be3bb9d", "sighting--9e23c9a6-6ff5-47b1-9c2b-47d57df4e075", "sighting--e60ffa27-7855-43e3-a48d-6a775a2302bb", "sighting--a9351636-ac8c-497e-87ea-06775926d2bf", "sighting--1a7bb26c-bddc-43c2-86e6-88c806c7f101", "sighting--9b8710e8-a6ec-4304-a1ff-b7c05baa1260", "sighting--fccb7775-3ede-4a2c-b3f3-c96c913a4aa9", "sighting--aa4c6269-3e8e-4546-bc93-f7e95c9e4b68", "sighting--7cd32527-3526-4eb9-ac1d-c5187b289b2c", "sighting--af4b6a03-f7fd-4501-99f6-c61110e96e56", "sighting--2aa109a7-5ad0-4198-8220-c9b9917fe6bf", "sighting--42afc596-bd55-49df-b270-775659d0b39a", "sighting--70926b47-0ab1-440b-9012-16a004b98f82", "sighting--66e2ebdf-db86-4ee4-8630-a5cdebfcc92c", "sighting--bee56ae3-616f-4a5b-aa90-3cca9167a7e1", "sighting--427f037c-29cf-433b-b13a-e7658f2c7485", "sighting--4d0bf0e5-0ac8-41e6-8bb1-95c1af7ecac2", "sighting--683574c8-8cc6-48a2-b1bf-80a965ad7ee1", "sighting--3a89e919-d195-424b-bd8c-316275abbf4f", "sighting--b64b849d-2d63-4068-a6e3-87766d2ab8c8", "sighting--9b77e713-ca6c-4d13-ac10-d41669c90062", "sighting--7951e41a-cbe9-49c4-b721-4f8608bd2089", "sighting--9322bcea-e92c-4d9b-9d20-12d17b2a7e3f", "sighting--6f02715b-bb21-4ad8-9fb7-6ce408db9633", "sighting--85b2517f-624a-4e77-868e-9f7afa655325", "sighting--00dd8614-8511-4fbe-a7c8-f6ff4c43e5b3", "sighting--9a1e8045-fecc-4aa4-a591-fde903d3c58a", "sighting--9c7e2059-8840-4bde-b4cd-016be8a20ab3", "sighting--cccf8952-f314-4946-8b73-dc10c127dd79", "sighting--5b677f58-06c4-4e91-920a-7bc11fdf1e65", "sighting--9b38fa7f-2432-488f-948e-82cccbefaac8", "sighting--395cd0df-d7a1-4c5c-b5d6-a5377e9b421f", "sighting--7b294b26-34cd-475d-86c3-e8ab3b5acc65", "sighting--61384a00-01a8-43b0-b948-12c3c1b26254", "sighting--de9cc680-32bc-443e-bfa1-7f06b65d4af4", "sighting--ca6ae521-7e39-4c85-959c-928b1f7b32d7", "sighting--e023f3d7-b5ab-44d6-a4e4-4d8f2bf94009", "sighting--60a251e1-4cbd-453f-8177-5529a2db80c0", "sighting--b8047ea9-a001-4990-ba70-553312cd5b51", "sighting--5e807c41-993d-4c26-b9ba-98b8202127e1", "sighting--a6896fdb-b0f9-429e-a1a7-3aaa3e72f2d3", "sighting--47ed2402-4d0b-489a-91f9-e7abb8c9bc91", "sighting--699b1d0b-7fc1-48f4-9f3e-473472d07008", "sighting--2207f922-ae58-41d9-876d-4b13df08c942", "sighting--09c510c4-5311-4424-bdf6-56966530532c", "sighting--c6b7fd1b-7c3e-4017-86b5-715b6649e7d1", "sighting--96bb5416-681e-4377-9ae1-73aba6823f71", "sighting--e9d8dd43-75d9-4885-b507-08963c6cfa79", "sighting--08fbc389-9a9a-45f2-b3d6-a6ee1f93fa7b", "sighting--7e6500fe-35c9-4d8e-a4a5-14142222cbfb", "sighting--04208920-1fc3-4ae9-8723-127185a7ce59", "sighting--08200269-96f9-4ffd-8d8e-e36346a08e4a", "sighting--ac05f612-571a-40f4-9943-8f2c060c9589", "sighting--7a81fec8-d072-448e-a268-fdff3b02c8be", "sighting--1c179350-8c79-4e03-9438-f4bd60d6aa87", "sighting--475a3b11-ac49-4db4-a44b-e1e7bbfd419c", "sighting--9c903ad8-5cb8-4350-bedf-7eafdb3692c6", "sighting--65e93641-ebf3-4ff5-8dea-0d6f79ff5813", "sighting--f3a30431-4c78-442e-9910-8e05d51d733a", "sighting--8b5dd183-81d6-4ea5-9484-a2b71c582486", "sighting--e5444ca6-1f4d-46ef-a9c2-f65d38590b89", "sighting--bc666991-e07f-4c4d-b49a-8ffa3827097d", "sighting--41db0623-15fe-4894-8c2e-5b57a6b1bf84", "sighting--ccbb1145-f17e-4bfc-8a9d-2bddb7456ef4", "sighting--f98d51ae-2d7d-48fa-9980-84b15680eb82", "sighting--9fabb6f0-60b9-467b-8cf6-0539f572ee9a", "sighting--d2cde5df-6548-4213-ab65-f6acd7ebd85b", "sighting--813f4de9-0817-4a77-8753-2b5da94ffd2e", "sighting--0ee5fead-c08b-4472-8bc7-a07a4156f8d5", "sighting--b2c14553-481d-4694-b854-5855955ee967", "sighting--f4e0049c-67c9-464a-a38d-fedb1f025d65", "sighting--02b0e358-999b-499e-909d-b8a758219001", "sighting--ea1bda36-28c8-4b69-85e8-7fa318a53bd6", "sighting--670981ef-145b-4cd9-bf63-8770ff99dd11", "sighting--0885f762-dc9d-49dc-a4b3-df9059b0d0f4", "sighting--4f6af3ca-4f2a-4ce1-ae5c-c1ee7bb3be86", "sighting--e744479d-2118-486b-8324-de3a6f022ea5", "sighting--06b937e3-5a52-44f6-87a0-ce122cb217ac", "sighting--29d1dc08-7b62-4200-ad00-5dc878398c92", "sighting--99b2f36d-7b06-416e-8a9b-da3e3ae81e21", "sighting--73266943-a40e-4c2e-9a4f-00110f3e7f2c", "sighting--83d52fcd-41de-4ca0-8eeb-4e71366f6273", "sighting--85264115-6867-493b-a692-1745c291e98d", "sighting--e5975d9f-2a1e-4aee-a179-a6e808806411", "sighting--f0ba2b00-bce0-4a30-8df2-ba6da95b2dc9", "sighting--6290caca-9140-4e5c-a834-403e9b8feead", "sighting--75075066-cd69-402e-a9c7-aeff5e09644a", "sighting--97c809f0-c7df-44ce-adc5-c077074b1e07", "sighting--1247fe0d-71ea-47a4-afcf-7993e6634fd0", "sighting--bd905b00-c18c-408c-b51c-3b585abcaf5f", "sighting--45da6cf6-0283-4d3b-94be-52385b38fd0e", "sighting--197b0c6b-5912-40d4-a4db-e5a9d6757924", "sighting--977eae7a-9a0d-4131-904f-620f9a56b224", "sighting--f6f4666c-5f8c-4802-a7fe-5e6238fd3604", "sighting--7ba811e9-8afe-4857-b089-3aad2ac92255", "sighting--47454130-23e6-4635-a3c0-c8662a2250f1", "sighting--93d57386-07d8-420a-92c4-c589bd9b8671", "sighting--d45868ad-db74-4faa-b1f4-ac32b06e738f", "sighting--84cd9411-6be5-4733-ada0-d206c9a533fd", "sighting--a41fac06-a846-4126-b5a0-02d94027759e", "sighting--ce37d3a9-9985-4f77-aef1-27e19d354461", "sighting--f3e80a63-c097-44a7-a2b6-f77a5457cc7a", "sighting--6b568e84-0144-41bc-9b0b-1c77ad363419", "sighting--5c987eda-22c0-4205-ae6d-52c295190336", "sighting--bd232a21-7d97-4d0c-994e-e50e483cf855", "sighting--a54c92da-24aa-460f-8b88-b3b9cc8ac7f0", "sighting--813dfd0a-bb5b-412b-ac17-77cb2a1e00cb", "sighting--c9bc7289-8648-41e5-b355-04bd1dcbf687", "sighting--5ff1da63-8ee0-4453-bbb5-b02389178c6d", "sighting--6fefb21c-d5c9-44d3-8547-ba848e4ddcc6", "sighting--45c577dc-13d1-4148-8e51-4df7ca2d9faa", "sighting--2a953d01-4a7e-4a54-8d90-151ce2b2512c", "sighting--4d050665-26fb-415b-9144-be7442229021", "sighting--b56d971c-22d9-46e4-893f-b040b6116c03", "sighting--acd88dbb-c66c-4ea1-8f91-46ebd2f891e3", "sighting--f8b614f0-232b-4eba-a0db-66e960244f0c", "sighting--1027146b-2ebf-47c4-815a-6e8a6561bf42", "sighting--c3348a0a-4ad1-4dff-ba0d-3bd321632bd6", "sighting--3ffbeaae-c5de-48bd-b6ac-3b409facfbb7", "sighting--8d511d48-3e81-4a67-b62c-886dd05dc74e", "sighting--d2a4056d-500f-48d1-a5ab-285a78670583", "sighting--fa245525-d2d3-4552-9f25-c4271b264223", "sighting--59c9509f-6c91-47a2-ba97-82ee1e4e7d16", "sighting--08d6530e-56d8-418e-b00e-aea2470c9236", "sighting--b468710a-9f8e-41d7-91f4-5b9abacc888c", "sighting--51c80b15-fa17-498f-b066-55d72f41e15a", "sighting--3712fd37-4162-420a-87c6-232915c49e79", "sighting--e111d9ef-1422-49e7-b019-1742e3b65a9c", "sighting--89a10c18-ac11-4183-ad02-8fbb67f3bd5d", "sighting--1fdeaa6f-5a1e-4a1a-875c-ec904deecd1d", "sighting--72f6e249-6a8c-41bd-9ca8-a72971c324c8", "sighting--2adf2450-db38-4c75-9f28-feb5d3a93999", "sighting--d61f40f3-4e16-4c4b-9029-3c9e93fec04e", "sighting--a8f4f75b-104c-44b1-b8ef-8f8d6cf270e7", "sighting--ac98c5fa-9089-44ba-bbdf-01cf43461dfc", "sighting--5d9f1838-0aa3-4386-b238-f1a48fe11c3f", "sighting--581c46f4-a480-4607-ad20-177b943aca88", "sighting--a5abd7ca-7a0a-4706-84bc-3ebf19b952b0", "sighting--1cc87c22-5271-4ebc-994e-bfe521a84cc3", "sighting--8cf7b8eb-7d4a-4fb0-a561-7c17fa779f56", "sighting--012ebee9-dd56-4e61-83d9-8b989efc3cde", "sighting--539a540e-610f-49c4-a75e-2b3e5ea66c00", "sighting--465db930-31f4-461d-8fe9-80afdb1cef94", "sighting--ca04f85e-068d-4a87-bfaf-6dee6f8460fd", "sighting--328d751f-e395-499b-a4fc-804274c1b347", "sighting--ed96b41b-7f00-4c49-aa21-112e3984714f", "sighting--07db5783-ae3f-4566-8926-2d5f0da79a0e", "sighting--dd695c01-0b7e-4af1-a718-af413551ac65", "sighting--64e2b8d8-b94c-43e4-b38e-1e1538642209", "sighting--05c78a99-b214-44ba-a2f0-d977c0d31b0c", "sighting--228a2bbd-2c4b-4d07-919f-847193f70b6e", "sighting--645fd94f-9642-461a-82b5-86c0c2ec2f32", "sighting--efee7b3a-8564-4bc7-92ea-fbb830d2f655", "sighting--7f6f8f4b-e760-463c-9f88-a2f574babb34", "sighting--4ce22a7d-2f2e-423d-8562-7744f9cb576a", "sighting--f9eeab17-6abc-48b0-b55d-e51b5721a0b2", "sighting--cfddcd41-a3e8-4f5f-b58c-5ae3dfd7ddbb", "sighting--fed7486c-a018-44e9-bf6a-07d5d93f67cb", "sighting--4e6565aa-6cb1-497e-8d9e-a0887db044c8", "sighting--2d0aa08f-69a9-4a3a-bb10-f184ae0148b3", "sighting--d8fb31ae-802e-492f-9a57-60f8809f4522", "sighting--91a9a1da-a8d2-4ae2-afdf-d2f5020cf806", "sighting--4eb60058-0d00-4cd3-ade4-00e4c8dc6add", "sighting--5e5a31ba-1822-42d6-becc-290110e13ae2", "sighting--3315f3c2-4777-4dd4-955f-02484dd467a1", "sighting--ec6ac16a-2271-4b03-a0ba-9eab13c05f82", "sighting--13146bbc-a823-451b-8412-c2de04deb8c9", "sighting--0baebbe2-f4c5-4893-806a-1ee60fab3708", "sighting--d1fcf827-2af8-48ef-8f57-32be57bbfe7d", "sighting--942f237d-2f6d-4bb7-9ab8-7ff270bf17d6", "sighting--7efb3c5f-4e27-4141-b2d5-ae1a2a19ea1e", "sighting--2ebd3211-41d4-4f03-8706-db17ec3b7d5a", "sighting--5830aedd-db14-449d-a4cd-296b3c6e49c2", "sighting--6dce8b89-8b95-4419-907a-44c31b057c78", "sighting--3a400773-3215-4808-be9b-524633bc6259", "sighting--2a16b563-f606-4a20-b388-30ec6734e6d8", "sighting--a62c4814-d93f-4b01-b078-d661a2057f1a", "sighting--dac0e573-e86a-4c04-9777-025dc8f8d322", "sighting--aefd0e31-f03d-4a13-adc0-49ceeeea75e1", "sighting--4f79645d-f864-40c6-9cdf-f8ad66864245", "sighting--354a67b4-4756-40da-a912-3c8b62561a6b", "sighting--087e26ab-832d-40e3-8ddd-49cdcf199e39", "sighting--baa226d5-9ab1-44ea-94d1-b17ff484db84", "sighting--66f7f929-5951-4b7c-8c44-38dd54505705", "sighting--7b3c4efe-ee7c-417c-8367-74fa65943855", "sighting--0a42eb5f-ca3c-4b37-a383-a64c2b3ec7e9", "sighting--46d4b0e7-2f30-4b99-8a6e-3c6207f5efb8", "sighting--8838571f-027f-48fb-909f-b4c5980506f2", "sighting--039475b5-be50-426e-9f41-3bf26c84a77f", "sighting--a7e18db6-1d58-4c99-bcee-9ba3e633a667", "sighting--c8ca74c4-0a57-4fd2-8147-a12527868184", "sighting--8a621101-fb86-462f-a468-b73d46521589", "sighting--53debbbf-3c31-4593-bdae-2ad6860b108d", "sighting--b8e926c3-8abb-485e-884a-8e873e2105ca", "sighting--79e252b7-27a7-4623-ba2f-a42f93e8b9b8", "sighting--8e883223-4f15-4bb7-94d5-164c75d9c031", "sighting--5e3582f9-62d6-478c-9e37-65b8b8cd562f", "sighting--fb2bbeb4-065c-475c-8d67-89cc30274033", "sighting--e308c041-9db7-452b-ada2-75ed01b5085c", "sighting--880da2a4-0efc-4ee0-8823-56240dd34bba", "sighting--eb0bf234-87bc-4bbd-a060-4ef8013770d2", "sighting--23de87a4-f667-40c9-bceb-8bb79f9399cb", "sighting--e9b71f86-828f-4e66-bdb2-4f3c1a6564c6", "sighting--41846123-b1ca-4311-ad34-d45de2af7efb", "sighting--b0f8f9fe-4a0a-4070-b443-9684dfc2c04c", "sighting--0b53caf1-649e-4850-86e0-b5ab3d4924dd", "sighting--14959a62-98da-410c-ba67-765231a10978", "sighting--dae74016-f588-4276-8cd9-fbf393e7275f", "sighting--51b38669-a5b9-4ced-9382-90bc9db485da", "sighting--9f4764f7-2fa9-45f1-8281-251f408bfd0e", "sighting--0e9d1927-2353-4597-890d-ba9bb8c2f3d2", "sighting--e3e41e39-536a-46ea-8aab-51c3b85ffdea", "sighting--64752590-4c04-4c61-89d8-fb388397166e", "sighting--a2aaabc6-b0d8-46d2-a00f-eca3ea5cb773", "sighting--39f71d58-523b-486a-9114-3243ed92f18b", "sighting--4bca1a22-a08a-4c43-bcb7-9892afbac789", "sighting--62b47815-6730-46d0-8c77-b2068bfcf3fd", "sighting--b874d3e8-b5eb-4269-97a3-7d868ad0ad14", "sighting--4033c7fb-abe8-41da-80c4-16cf780c39c0", "sighting--1af5afb3-208d-42ee-9229-12358655214b", "sighting--7dd850e4-f9ec-4235-b649-8e98a25c4232", "sighting--f8c7bfe8-c961-4dd1-afda-bc2cbd3a1fbe", "sighting--2cf31bf4-9cc7-4827-a660-441ba5e94cda", "sighting--b26f7b48-717e-4f6d-822c-9f8a39d0f7bc", "sighting--0e49a1a9-efec-4190-b010-697a223e9835", "sighting--c2aca5ee-fc99-4cda-bbf0-fa12630e9fae", "sighting--534406cf-8783-49af-8ea8-05b088fffa09", "sighting--bf7f9e2e-21c8-49f8-bcf9-38d5d851ff08", "sighting--c2785ecf-830e-4957-bdfb-1db986c5ae51", "sighting--bc58983b-c6bf-4887-853e-164ed6c43e95", "sighting--6551be5d-2f4a-4e18-9d24-9e8b523b612f", "sighting--65dfa857-bed2-4936-86ba-78dbf45fff32", "sighting--b5b93043-ad01-4321-bf26-b2c7ec3f775a", "sighting--d19c9391-7507-4fac-a7a5-e23cc9b8ea2c", "sighting--bc0f9b67-df8d-4385-a2ab-07002aa4bfb6", "sighting--a98697be-eeed-4598-ac2b-56d331115e13", "sighting--bc6891af-0bf7-4607-ba1d-c21509372862", "sighting--db6488ca-bfc2-4dd5-adbe-8b952948bd2c", "sighting--47f99157-6f02-4409-b81f-739f60361e2f", "sighting--b5c9a820-c5a3-4bfa-b08e-180a82c8fc09", "sighting--93c9fc4e-9ffa-49b5-bb1f-c4a938ef4ef9", "sighting--e42cb609-79a3-44ec-98ee-ed9bf40a1ecf", "sighting--042f1474-00c8-415b-a11b-0ba7907e02f1", "sighting--8ec6529d-b0be-4068-8bf1-41fbbfd8b366", "sighting--976e5897-342a-4221-8ee5-6ece086c8d97", "sighting--af07c9b6-137d-451a-a831-1c2cdd09f26f", "sighting--08f055d7-df25-4329-8527-0b7f2fcb1ed3", "sighting--f865f713-3d81-4de8-89a5-5cfb05d8edce", "sighting--703d73e7-2d23-4c07-9639-88dcf8dde01d", "sighting--618a2452-3932-4e26-b9aa-c0b70b478c54", "sighting--34ab4ff1-3bf6-46ab-b819-051f72aa58d4", "sighting--97ffb000-bb4d-49d3-a3c5-041ce7241e97", "sighting--0a4a695b-bddf-4168-ac99-6b42baa40fab", "sighting--d408321d-41c9-4d32-a411-460d83ab4a40", "sighting--184566b7-92d1-4363-a0ef-1c0b89910230", "sighting--f20c5a61-963f-4374-9442-0e378568dd58", "sighting--f6e2d194-98c6-4aac-89b6-83fb569f78b0", "sighting--48c6112e-2d87-44f0-8e4f-cb2e94ab44ad", "sighting--615d5a12-b929-4ad2-a49f-72b29ff34635", "sighting--a0afda06-07ba-4949-8f55-24cf808c135a", "sighting--a4175ef7-3d89-45da-9a4a-998e6dd8e93e", "sighting--c798c4d8-b6b1-499d-bad9-789b9c2376ea", "sighting--5183d66f-328a-4757-b4fb-7f4a3787c2e4", "sighting--b0ff8e93-63b9-4318-9d9a-fe4c1566d563", "sighting--0b4e44e8-68c6-426d-9405-17324192a93f", "sighting--f6fb0644-076e-4d9b-b926-183097bec77c", "sighting--59712942-8ada-419e-8416-317193478078", "sighting--af64b45b-8bd7-4732-af1a-b0e9411f2ae7", "sighting--eeac18ca-7d4c-4db4-b935-43850c034b2d", "sighting--ce373359-4d65-4d02-9963-17da35445855", "sighting--21311412-36ae-4178-9009-ac23757f559c", "sighting--122f2030-7c49-4d60-83e7-7a4fd4373e46", "sighting--58db7d25-0e8f-437c-84ba-4d9073e45b30", "sighting--32dc30c6-4aab-43fe-aaa2-d6b2f201904e", "sighting--70d13eb3-547c-47ef-af0f-ecaf1f80ba7a", "sighting--978b7d8e-8491-4da8-832d-9522f7a4dfd1", "sighting--c9c126f9-5190-4312-9244-28392445092c", "sighting--9e78619b-2a73-4f49-b579-c687e3831ec5", "sighting--506b4cba-fffa-41b1-8dc8-63839b17f25e", "sighting--25e84ced-f803-4dd0-bf37-742da472c9db", "sighting--49388115-00ba-4d4f-86b3-b4600ad3a68d", "sighting--588270af-2621-4747-bbf4-099ce6b15cb4", "sighting--fd85c0f4-14b6-4814-b1d8-18a3add26971", "sighting--616c43bb-7d57-4d13-a365-2e06bdfa9a4b", "sighting--da71a5f2-8442-489c-aee9-f1276a099dc7", "sighting--6831f11b-dede-48e0-abac-73b746f0f75a", "sighting--7a3bdf07-1a0c-4b72-88b8-4c6cfff8ad45", "sighting--8fdab6d0-58b3-48a5-88b3-1feaac718276", "sighting--f32d792f-5579-47b7-8ab5-d89ffd345326", "sighting--d9cb4cf3-7396-4f58-bd17-78e65fe95ff9", "sighting--3dbdccbf-c8c7-47fe-a5a3-cde8ecdbd6f2", "sighting--d0413530-4335-48b6-bb94-a934f1321c4f", "sighting--1717eaf5-c1ff-47e5-9d0b-87efd968f8ce", "sighting--397562d7-9c35-4347-921d-005e94bf372d", "sighting--24d1e7e7-7ba5-4a12-8fba-ddadf2874457", "sighting--0a324167-f1f9-4e45-8092-2f4decf64539", "sighting--0928f149-4b22-4b44-9b1a-e059de75c10f", "sighting--9168fcae-baee-47c2-99e3-7be657ef78cb", "sighting--47f85361-9fc6-43da-8c95-1bf298299d4b", "sighting--11c42ce1-0ca3-4b4d-af9c-8a5455bf23a0", "sighting--ff12e85d-05d9-41a5-a658-ad52c9f99e65", "sighting--2ac19ac4-2799-4381-9426-80d0592eed61", "sighting--71605e01-b7bf-44bc-a2e3-2129c81106f4", "sighting--5719f345-02ac-4de6-9f8a-29777720db0d", "sighting--33efceb4-4d2e-4379-bb77-fe0372dcfb71", "sighting--ae7edde6-36d4-4431-bd76-ef2c6c431b6f", "sighting--756bebed-b4c1-47d7-b993-325f414786da", "sighting--5b00750b-7ad8-4fc7-b35e-5a952f87d932", "sighting--7517eee6-a22d-4810-9687-3d2afb827383", "sighting--f0550475-0ce7-4a43-8c87-4b52baf28249", "sighting--c7dd98c3-c526-475c-baba-fe73aaec7a73", "sighting--4c6bf953-6b53-4e77-a786-7c818e9d4e53", "sighting--4c7fd886-98ef-44d8-af5b-f5dbb676b314", "sighting--f492ccf1-111c-4db7-9cc7-af7b52df24d2", "sighting--6684f565-c636-48bf-b0dc-d10c0ecf8e73", "sighting--e0d3f8d9-eece-478c-bf07-c47a330e460c", "sighting--76bb2e83-2ed0-4016-8bef-6a7c06486e20", "sighting--46163d04-579b-4e16-ac0e-4449d2e5a694", "sighting--791302e5-5a59-4489-8e44-e3facc925456", "sighting--b7c38f32-a6d1-4618-bff3-921edf60112b", "sighting--9ad77191-d084-4bf5-b06e-4854f9b11b1b", "sighting--3cf7c970-7ddd-46d1-895b-4165c5f8e84e", "sighting--36779ea2-37a4-414c-98c9-ac11f3c3cbec", "sighting--90f282e7-f19a-43a2-9c4f-ccbd0d8d7089", "sighting--c04c3ac2-d4d6-4748-93a0-c1e3fbd59d6e", "sighting--eccf6331-006a-4bc7-b358-1c5affa85bda", "sighting--69d53bb4-c9c0-41e3-988f-b7cd4901cd99", "sighting--6f66ac7b-8768-477e-9461-78ff4b16ec91", "sighting--37713377-a7e9-4b29-a63d-9decb0654ded", "sighting--46efb57f-1b7d-474d-999d-1d928a29aeab", "sighting--20f72e37-9102-40d5-95a5-1651cb21c08e", "sighting--d6d26d71-20ec-4c9c-92db-6ce5af969589", "sighting--e46073c2-f034-49cb-ae35-2d68873ca55f", "sighting--3e04cb7d-a1c7-4db8-8ee3-44883ae1c88e", "sighting--c552c32f-ed27-494a-bf6e-a46bd43df991", "sighting--5754811c-f1ff-4896-91f5-f3096eb99af6", "sighting--4ca3702c-2956-47b4-8dd4-76dc130b9f7a", "sighting--4f5287a1-ab72-4e10-a00e-99ccbdd731f3", "sighting--1e42b3e1-5f66-4f06-ae76-3f02940c2dab", "sighting--c1f7587b-0dcb-47c4-9c98-7afa4db0d3e9", "sighting--e7d4f485-edce-4e39-948b-f293ab153dc3", "sighting--829bcf37-c079-4dac-ba72-968ef9faacda", "sighting--291526ed-00e0-4787-a351-dbd6fc64b9bc", "sighting--460e29c7-c2b0-4ade-a8ff-1e8bed89da57", "sighting--8751a621-9a1b-4d40-8932-efcfdfa71862", "sighting--d833b782-706c-4439-a200-56f53c182356", "sighting--d30d9648-20ec-4861-a8c4-820fe01572b0", "sighting--9f807c4d-3015-4ada-a5ca-8946035b1713", "sighting--51d50c70-5124-40b8-b763-0fc2a54296a3", "sighting--5637cf29-ee68-4a82-9e04-4721e07b477f", "sighting--64cc3c06-bf87-406a-9a04-6611c2ebb930", "sighting--dcb31bae-4195-4676-a537-170c53a4dfd1", "sighting--9682d699-90a4-4b9a-84fd-efbb1f7e85e0", "sighting--5a9243d2-b2c3-4d92-9bca-9979524a9ba8", "sighting--7497e5a3-87fc-4e36-8cf6-28530d408aff", "sighting--02f2013e-abd2-4575-9548-f345b7b4277f", "sighting--9bd0ad44-2a9d-4c5e-9379-8b127bff9c73", "sighting--25bf53d9-f71b-4db7-a0cf-69ca5c639ca0", "sighting--48e0fbab-0cc9-4e5d-8c0b-b78685501830", "sighting--ad3caf9b-b429-4a18-8205-f063a687a622", "sighting--f6ebb6f6-fc27-4be8-b287-369f35b2a5bf", "sighting--e9a9860d-f964-48d6-89e3-d9df8d119597", "sighting--b3a89624-6213-4599-99b1-b4746ee49f75", "sighting--e5df5934-07d6-4f1c-839b-a0e1160ca5f3", "sighting--cdab3ff7-a26c-4b13-8530-ba14b90d6304", "sighting--69515b27-1559-40a1-bf60-de99ac896425", "sighting--80baf938-5523-4f89-b8d2-f76f7a03cf97", "sighting--c88d6424-373d-4369-bae6-314772fdd5ce", "sighting--d24df841-8ecd-486d-a503-4fdba63b35e1", "sighting--bbf7415f-8f32-4200-a63a-4405471c1f94", "sighting--a6428f2d-9c86-4e68-baaf-15aa62fa4149", "sighting--9e29989f-db09-4522-928a-4d3d3bb48027", "sighting--e80c0fe4-51d2-4562-92db-951fdf9fea0a", "sighting--b7cfd25a-02e0-4017-9dbb-cb11a0436d37", "sighting--a07582a1-3527-4117-be05-622d09695df5", "sighting--330a7158-55fc-4a6b-aa80-14de80384d38", "sighting--67b1edee-edf4-4473-84b3-e4254fc8da65", "sighting--67b39408-027f-47bc-b930-05a172ada10a", "sighting--efbe6f21-fbb0-44bd-be7e-25460209425f", "sighting--87b6e714-b19f-4d98-b4dd-e39587ad6100", "sighting--185faa1d-4a21-4cc7-bd64-3560a9d966b1", "sighting--0f97a9e3-0d81-4d1f-beb0-4905baac073f", "sighting--750a1afe-d329-44ab-bcd6-b087a29975c1", "sighting--a299af2d-a1df-432b-bd62-e67a0fb29c56", "sighting--db89ffa1-4a07-4968-a390-cd34b70a404b", "sighting--24b3f4c2-3ab5-4203-ae77-b82b84e39d93", "sighting--a8c34c08-5168-484e-ba6b-d018db7a3da6", "sighting--0ec7d5b0-3fff-4022-b310-3f1bd0b72ee8", "sighting--fbfea543-4dda-4bfb-888b-fd020ee711bd", "sighting--3cfd80a2-a2d9-417e-a79c-793363068c6d", "sighting--948a57e0-1a32-4dc5-9942-a016fc588be8", "sighting--554d22e3-4da9-47fd-840a-559a92764e20", "sighting--18f757a1-abd7-48ac-a7d1-8851c86df11d", "sighting--a3a5cb9c-1875-4bbd-8525-87dc347dcb57", "sighting--54440ee5-090a-4533-a6a4-a0d47b19e398", "sighting--726f5571-1790-41fe-bd18-135a7cf98841", "sighting--f973ff47-30b9-48c3-81a8-b6046cac2606", "sighting--aa66c566-066e-41cf-a443-09275f37632a", "sighting--85b3c4b3-3ba3-49f9-a306-47729d8ddae3", "sighting--5dee4643-a49b-4c8a-9eee-599ed94a1f31", "sighting--4ef5ba9d-b305-4572-8a62-670a44da62c8", "sighting--69ba06f2-8e8f-4d47-b0a6-aac874c77884", "sighting--b01bbfdf-b4a3-4936-a429-30ddee4467e4", "sighting--4b19b3f1-05dc-4543-b8e6-c98ad346b3b8", "sighting--2194935b-4cf0-4aa9-b218-81213963725d", "sighting--e250cde3-f7b3-4836-9397-790c976aa327", "sighting--4a699372-37f9-461a-b482-cb2b4aa14576", "sighting--c9ee43fa-88f6-4b1e-82e9-7359f6f10ed4", "sighting--cab1fab0-4c59-4ef3-90ba-153f823596d5", "sighting--7f160ec4-d509-49f2-8df2-23738b375e54", "sighting--a31559a5-fa94-4111-87fb-32cde7f37d60", "sighting--84b793dd-8245-4c5c-afcd-d69fd6664a94", "sighting--b74a0275-7437-4319-b0de-87d609a36c18", "sighting--34e88236-58de-4493-9de2-c0ce110432e5", "sighting--5b73f5ab-f6a9-429f-8d36-0c1c5b56a3e7", "sighting--7f6d9dee-d1a5-46e6-aff7-7161cfb2d5b7", "sighting--300dc987-f64f-45b2-a56c-0491e6aedffd", "sighting--6e6e973f-0231-4750-839a-99b50731a832", "sighting--809ae9ca-e6fc-4a7a-b382-24b1a68b65d9", "sighting--edc8ca2e-5ee6-4759-9693-b1b2c5a03c22", "sighting--0d39d201-a3be-4b43-9ff5-6edc0a870337", "sighting--cf73b648-c082-422a-a4ee-7f8ebe66c313", "sighting--583df654-8eab-4eb2-a8c9-7c2a2fd75aec", "sighting--37d61a54-ccff-4126-8203-b79f0c29bb99", "sighting--2423fc1c-7848-46c2-a9e2-9ebc2184bb85", "sighting--514be787-92db-481d-8a79-eaad0c946506", "sighting--06359ad5-d584-4d9b-a0a5-42d455689bcc", "sighting--862fa99f-21e9-4682-adc0-3ba6b9558ea3", "sighting--75adfdf8-b810-4d15-8003-2c2653256f6d", "sighting--f94bdc74-71e2-4991-be88-4bbc54a902cf", "sighting--585889fe-7812-48a2-bbf8-584eb1e9888e", "sighting--7f296859-be26-4f91-bdef-a3eb880df6a9", "sighting--a84927d6-2095-4e7f-b46e-c0107036d6cc", "sighting--819f052c-f2d0-4034-84db-6e5a31934c4e", "sighting--8cea0135-f26b-44b6-aa25-546b62d058dd", "sighting--9112972a-d812-40df-9f06-983abccdbf74", "sighting--8072f904-c61e-45c3-b123-19a8c095136f", "sighting--4350dc34-58fa-4db4-b2fd-4d0f589a9093", "sighting--25f06b3d-ae80-40d0-aa36-197d10da9523", "sighting--f1c7caec-9024-4989-9ba3-e5fb9919535d", "sighting--51484225-73dc-4e1c-9b4f-f0b472acfa29", "sighting--8b2a4cce-120e-44fe-8abf-382f992a9d06", "sighting--957529d3-f0cd-45c0-8862-2bad9d882afb", "sighting--5a43355f-9bde-4bb6-9e62-bb14adccdfca", "sighting--591c37ce-a3aa-494b-9e4e-4eb16ef84668", "sighting--8a0f4cea-faca-4834-88c7-89241bd7e5d1", "sighting--111efd1a-0e6b-435d-a498-a39a3e0060bc", "sighting--d709951c-8ab1-40f9-a122-3554df3137d5", "sighting--ecb51c08-82d5-413d-aee7-10c99be7a674", "sighting--beabca2e-8c63-47bb-98b3-8847289b493c", "sighting--ba48c298-0add-453d-82f1-a70428678d3c", "sighting--2daf4010-8c79-4fcf-9fe4-5cffa77b59d1", "sighting--734ad4af-d0ff-481d-8eec-1b61d1710d99", "sighting--f8f49e2a-21f0-49c4-90b2-f039add19c2b", "sighting--19d81dfd-029d-4912-bde3-c657b188be77", "sighting--b4c24b70-41f3-48f8-a0f2-4f0c055c5335", "sighting--1586627b-9139-4cc8-b7da-69fab54dde91", "sighting--b0337f14-971c-4c27-a7a0-22540c8f75b6", "sighting--67cc2ed8-5c69-48b5-aaa6-8224b4cc534d", "sighting--0393c12c-cd70-4d0a-bc93-72ed96a5191b", "sighting--4cedcfdc-bef4-4622-904c-ea076644d743", "sighting--17193e85-4724-47f1-9454-17175011913e", "sighting--6109f11f-2375-4336-a146-e45e85f8ca46", "sighting--8e396421-ccf2-4a09-9d6b-8f2c22d9ef87", "sighting--17dcccf7-d2fd-46d8-ab05-18e59167a52b", "sighting--dfd89e86-209b-4f17-a57f-3abf14e784c5", "sighting--ba6d0ea7-ce06-4896-bef9-749be1957824", "sighting--40096bbd-66cb-4fe7-9b00-2ace55516901", "sighting--bba09bf7-e4bc-4027-a784-0b9baeb52f15", "sighting--541bf1af-9319-4c4c-949e-5a59e5a864b3", "sighting--d9cc569c-2f99-4290-be1e-2d321b4f0f65", "sighting--a6d11f41-42d2-4651-9ce1-042d6b050c71", "sighting--6e735b80-e1ea-438f-a74e-288c4e1b5865", "sighting--f56a3098-88d6-4885-8e66-164fa8d77a81", "sighting--acee2eea-e838-4a9d-b197-b4750e792f09", "sighting--62ca69f3-b4e8-430c-b9da-4957b8657395", "sighting--c770b4bb-6264-4d3a-9374-ce5e14933852", "sighting--1b9cc069-c24c-431c-8e57-4afe39d57926", "sighting--3c33036f-1028-4c71-8899-fb2d9c3c5e8d", "sighting--45ef2abe-69c9-42d6-ab98-c6c02f83c815", "sighting--9a69949d-dde6-4339-b995-1655aa6859c8", "sighting--1de11eaa-c871-444f-b2b4-41e20ef07fc2", "sighting--bab3e129-9d6f-449f-bf6f-c77888815e43", "sighting--5b68eb59-69ff-4c73-94a7-945ffc1d15e0", "sighting--2585faa1-791f-4513-93c7-eee3486c28ba", "sighting--b853ff8d-a1db-4929-8890-1bba4293aefe", "sighting--abfdf2fd-21e3-4ca6-b885-8ed90c0eca69", "sighting--da4daccc-346d-477b-9482-f35f42a16faf", "sighting--bb905ddb-c98f-4a48-a7bb-54a48aad7586", "sighting--009e134a-ac26-4f3f-bbd0-b7e482f27c4c", "sighting--b5f830a4-8308-46c5-86ca-d5bf768d7f46", "sighting--1368c138-921a-4b0d-bba4-4f2dbdeeb394", "sighting--7a312f07-46c6-4b2d-afef-c2d65565201b", "sighting--7d8881e7-596a-4dcc-a926-fcb1305fbfdb", "sighting--9a1046e6-7f10-49b1-97c6-bee1fc7823ed", "sighting--83fcc567-d4d7-41a7-bcd4-08180a9ac98a", "sighting--15215bea-a5e9-445c-ae08-09df6cb38d16", "sighting--16c7fbad-a429-4d68-a13a-f1791f455864", "sighting--80e0fd0c-4d32-4fe6-aba5-d08d50d04cd6", "sighting--396aa927-f4d3-4928-a793-1b8e56c9d39b", "sighting--c0b335f5-bdbe-499d-b443-5295f2976d92", "sighting--54493d28-cc85-4761-bdce-834521370d98", "sighting--ce926ef7-2ded-499a-b430-e34b088abcf5", "sighting--886adbbf-5a7c-4bf3-897c-074b612bab51", "sighting--9f9390b7-73e7-4fa3-bbdc-e24c7318c4e7", "sighting--dbf4c6eb-a529-4542-b073-c43c83b4e693", "sighting--fa2ea706-8d1e-45b3-bc31-e14ed5a92bc1", "sighting--1240eada-12b6-4e5e-adad-d4efa4ac76f6", "sighting--0fec8320-c07a-453e-acc7-c691be8bcdeb", "sighting--1d92c730-8245-4161-a49e-bc3f05642ad6", "sighting--022774da-2d89-4140-8b30-fc5c76b3237d", "sighting--e86c9ca3-1956-4656-a3b5-1c994e25a66b", "sighting--9fd63016-711b-48e5-ad96-2a12cc66ceb1", "sighting--d6d4bf32-fded-4afd-aff9-49762e3a1531", "sighting--62ece9b8-99b4-401d-8bb0-150dcdb7d34c", "sighting--e95c4140-4c49-4261-8415-bceea3da6df1", "sighting--aca2d099-b34d-466a-ad3e-9049d2c7abf0", "sighting--5b841168-dccd-461e-8dd9-2f9bc6464bbd", "sighting--4602245f-3720-43e2-957a-cdb61738b4b6", "sighting--c4b314e5-0fda-4d89-a24d-a57a7efa4891", "sighting--69bf873e-a738-46a6-a241-7b8d75f8783c", "sighting--a8efb409-7d10-4758-a845-df7ef9ed2775", "sighting--c3f1d1cd-57f2-4100-9581-2d08d48399d7", "sighting--830698e6-da58-4c55-86f8-b53bb87f9231", "sighting--177ad42a-2811-4fa8-b153-da03cc5310dd", "sighting--638e956d-226f-48b3-b4ba-0286644fb4b0", "sighting--7b11fa55-1806-4e7f-a9d6-bf8dbe135443", "sighting--f803bbd6-69da-457e-bf00-e2a3e6fe7cf9", "sighting--c444b2b4-8c8a-4cbd-9401-c475f9fc184b", "sighting--14033df2-2ee1-49fc-aa00-ae8fd46910ce", "sighting--0545be88-24f0-4ce9-a26b-84e37cd36ee5", "sighting--e5ea7d9e-5b4c-47b0-af5c-793844545911", "sighting--7faac38b-4f50-4f60-8618-1ad6beb9c590", "sighting--d33885e9-ee3c-4310-adee-578986fe21e0", "sighting--97e94fac-abbe-4aca-aa06-e37363246365", "sighting--c069eeca-d6be-4ba1-b269-dffb1448a3aa", "sighting--b67be52c-7211-4fca-8fc5-19d68e66d080", "sighting--f850d8e9-b66d-4eb6-a3e3-2cf4b8ef1527", "sighting--58b28dda-9e67-4f7f-920c-d6a6f10ceda9", "sighting--7c1a80a5-5f33-4e18-a472-29a257243d83", "sighting--885cb813-3647-4631-bdfe-21642c6b6ec3", "sighting--a049b055-f390-4f41-91c4-7d5d11b9c00f", "sighting--fda91a75-b4bb-4f0d-a980-de1e646cc537", "sighting--c20fc889-62dd-47ac-b3e7-94d9142ef9d2", "sighting--fcaf6063-5355-4457-806c-2f6efd1b88ab", "sighting--1313fde0-e12c-478c-b7db-3e912587dd26", "sighting--7c63f187-b2e5-4f4f-8488-eb321645edf7", "sighting--e2464b78-6c40-4eff-b99b-182cea41bbae", "sighting--a4b70872-4258-4af9-9654-baa911fb69c2", "sighting--912426ef-9f39-4877-a24a-893be48abd87", "sighting--576e04bf-6f74-4e27-982d-ad80194f6469", "sighting--32986de2-b4b5-4ac9-be0a-d251ea703289", "sighting--ad795a62-d352-41de-9ed6-77058b277a90", "sighting--8fae7f4f-8ea0-4298-bd2a-cc2243d83f5e", "sighting--e080d705-73cc-4399-a853-76f409838d8b", "sighting--5f2129d0-4a64-4655-ac91-dcef6b4e313f", "sighting--9ba598ba-2fe0-4592-a789-824a50f839ee", "sighting--4e323089-b4b8-4c36-8a7c-507f6f88e4ac", "sighting--4fb8cb17-a97d-4e14-986e-429fb2c0ae66", "sighting--57aad5b9-b5c2-49d0-9bcf-a5150697084e", "sighting--9ee367e8-f3bb-4891-ae23-386e41ba291f", "sighting--f834c152-7ae1-451b-8de3-dbbeef8d27ec", "sighting--8c9c33e1-a672-4245-b287-0640f2d03151", "sighting--181778dc-eef3-4a56-88c5-fc48463f1311", "sighting--72cc3c88-acca-45ec-aed1-8e569a89563e", "sighting--ac4dd3a2-5663-40b7-9304-4b893d7d905e", "sighting--7d047108-0573-4883-a86d-228a9c81ad57", "sighting--e87318ce-10b0-4c53-8ad0-e80781d488e5", "sighting--0fec6822-b5b7-4ebb-a50d-7d017264ba3c", "sighting--922a2f95-1d33-4492-84f4-e44a1c40a9b7", "sighting--9831e2f0-40ba-411f-896a-952d9c0ff817", "sighting--801b1916-7dcf-46cd-9ac5-bf63cbd7ad36", "sighting--afb46e90-3082-4944-93b0-5e63393bf3d3", "sighting--862d1164-cb1f-4bcd-9923-1d064de13af0", "sighting--120ce6ec-8973-4269-84f3-dcc3cf456963", "sighting--b03f49eb-f12b-43d9-b679-ca04c1a949cd", "sighting--82dae58a-b206-448d-ac84-3cb2eb07947f", "sighting--be9a1bf2-0fb1-4573-af3b-a3e2e1604175", "sighting--fd56b25c-073f-43fb-83c9-91865532bd90", "sighting--4b33353b-3a5d-42e7-bf6c-1730fd58c638", "sighting--394f2783-62ea-4f97-831f-29f72bff54df", "sighting--01f4fbdc-d6e3-41ba-af75-d699043145de", "sighting--cb303414-0a23-4be2-98d3-b0808a05e1a4", "sighting--2936b3cd-61b0-4165-82af-0693752ef746", "sighting--18a84362-c11f-4dd3-a9f5-ac21b50c5a89", "sighting--3c099037-4834-4aa7-bf6b-915454d3c89b", "sighting--de4271bf-5d6f-4f06-b3e9-82aba00cc37d", "sighting--03fab891-5157-4416-bf81-0d6382bffea5", "sighting--70659ccb-3cbb-4734-8d5b-dd66100d0f7a", "sighting--74b83ff8-7447-41aa-a6ca-56febd84c834", "sighting--02c2a2a4-02a4-4559-a14c-e5b7fbf49c16", "sighting--a8e9e917-c0da-4d9b-b48f-ca04f46b888f", "sighting--61b835c1-9a0a-411d-aced-fe131e69d03d", "sighting--8605dcc9-bb5b-45fb-8526-a251f3b053c9", "sighting--1d28ef09-c55f-4909-8934-f60182eac0c9", "sighting--754ba873-1ecc-44f7-a33d-64f35ea40fce", "sighting--6fc991d5-6a95-439f-88fe-e1b818bb3aa5", "sighting--9f0f5223-c248-4c1d-8cca-d34162df6aed", "sighting--fa1d6562-c9bf-470d-9d6a-b6a746b2bbf6", "sighting--b7ad98b5-cb22-4a69-817e-1410fb8bf499", "sighting--11a06bc8-5876-4af9-87be-0f080e0b30bc", "sighting--6f2f8f87-d581-43c3-b44f-c67dcba64b23", "sighting--00a162a2-519f-471d-a3d9-b8a4eca46f4c", "sighting--e045d1dc-500e-4886-8432-a3b531fc57bc", "sighting--fca437d8-f125-485a-a5a4-c33e22ea1da2", "sighting--eabb785d-5981-4aec-99a0-0e95567c90d4", "sighting--ddfff48f-17c5-4604-bf18-8e1df0758fbf", "sighting--88064fc3-dafe-4b66-a6b0-6575fc7b4cc3", "sighting--13bcabc6-a5ec-44a5-9339-f7b4050aeecf", "sighting--8870f006-c6aa-4062-b2fe-85d532da985e", "sighting--0d704384-52db-4df5-8c33-519732f641bf", "sighting--4e7c3d39-f816-4f23-a8bb-fe748ea63441", "sighting--47aff8bf-2e6e-473a-82f7-a8992bec3d48", "sighting--abbcf709-54ad-4c32-a8b0-b599eac7c4b9", "sighting--5a423357-1d05-4ab5-9d1c-73b9931f84d0", "sighting--234590bb-af27-42fb-b217-cc73c745ba35", "sighting--f1d6daf0-31a0-4ac3-8985-b52644465381", "sighting--6a8bdcd6-dcfb-4f53-a0bb-b92f15e0e63b", "sighting--7335177e-f681-4cd0-80e5-f66c69199008", "sighting--b7f47fa0-8314-4877-a3df-d46ff06eaf02", "sighting--81fb8277-c070-485d-a4c2-6c48307fb74b", "sighting--a487e5be-aaad-4692-a79f-1c42bd2f2a29", "sighting--35daa293-0e1a-4709-af94-d840344fea9a", "sighting--bc491617-ba97-4a15-84a1-acef2d019227", "sighting--00ba19c1-0846-4144-8404-8927275fd396", "sighting--d5cd207f-cd33-469f-8ab6-2b79347fb78a", "sighting--2f5de4c2-1958-48c6-9c3d-c42c1f33df35", "sighting--96f2da52-dba0-4b85-8b30-ef03921af2f4", "sighting--24d18cc6-afde-40c3-a2a5-577db5b3c4a3", "sighting--918379f1-1d29-4976-943f-2d5906af67b9", "sighting--1b523590-9d66-4a31-8218-6c0e7bc24fdd", "sighting--333159e5-79b8-4c6a-8fa3-dabd6850f921", "sighting--d6e85803-b939-4afd-8265-a9bf2a315a5e", "sighting--26d311f1-6100-4be7-a988-719b851edc70", "sighting--c1afb0ca-c44c-43e4-ba19-f47cc52e2862", "sighting--523a6197-c53f-47ee-8efa-080a3d92e0e0", "sighting--1e526848-4001-47be-9ae1-f93d5e55b719", "sighting--95c7ddde-af6a-4c82-8e6f-d0384ee90e94", "sighting--095a7fa1-01af-436a-9299-6cd5061f1e47", "sighting--e073b512-2084-410f-a539-fea6e9d121f4", "sighting--01f11dff-927c-4eb5-97aa-73a9eb345301", "sighting--12092744-886c-437b-b239-c8d186037082", "sighting--c8ae94b2-3c82-4d71-bba9-9ba08c0239fb", "sighting--62ec82ab-34e0-409e-bd3b-db9da66d6a49", "sighting--fe8c0726-99af-445f-b106-892ddb3ddebb", "sighting--39f4cc54-8685-4bc0-a0e5-5a862aee645a", "sighting--5f18cb75-7109-4add-a84b-2ba228444777", "sighting--37707744-c955-493b-8f8e-f72b7868cb95", "sighting--15eaed05-568b-4f6b-ad2a-cc01685755db", "sighting--5b2c3742-643f-4cd4-9f65-96c74ac63263", "sighting--8aad3956-5006-43f6-b9c0-7f78106ef15f", "sighting--166020a1-85b9-4d23-ae4a-5048bb9e00ae", "sighting--e42ac12c-de41-4b51-9ed2-49a2f222f130", "sighting--926655df-07a5-4fb4-9231-338850c8ad58", "sighting--b80f6fcc-fe0a-4289-99ca-044b8aefbb6e", "sighting--5cb2cf6e-ef6e-48b3-bbd0-59b8e61d244b", "sighting--f677193c-9a81-45e9-8a1a-5594e00e285f", "sighting--c9d0a5d6-281e-4577-a251-598122e25cdd", "sighting--a68e5746-2488-422d-b4eb-fa9dd1c49dd3", "sighting--2b43b003-b9c6-4a75-9aa1-1f3b54b567fc", "sighting--6ef33289-5334-4809-a342-d37eca5f9682", "sighting--27355500-a048-4844-908e-304f25d8624f", "sighting--d3082804-473a-4f97-b52f-3074e3293c3f", "sighting--6d077e30-c61e-48fd-9a69-c3c7b5b3b4fd", "sighting--bbc9e7c7-2de1-449a-8e69-58799d20b7a9", "sighting--141e6765-9e9f-4b3e-be7a-4d6ad11478aa", "sighting--09b2602c-5062-4812-b490-a0f8d62b6123", "sighting--2d8e68e4-68b2-4cbf-a185-3ff693c68d6f", "sighting--2b42a624-748c-4291-9096-88bb45b5b46b", "sighting--59c51bf3-1795-4b7e-bf44-27036c57093b", "sighting--db001b6a-64a5-4520-9280-ef014bc0d2a7", "sighting--4105f11f-03f4-4c87-8ae2-b2073c67f05b", "sighting--73bb4a31-b3e1-4e0c-82e5-bf1405f8f250", "sighting--b4036911-31b9-424d-a1e5-ade0201c00c8", "sighting--a9a365e2-a4ef-4666-b3e9-d02467ec2928", "sighting--0319f3df-248c-4ba5-9600-bc4c01a35987", "sighting--f35ebd82-7339-4691-b2c5-736f783003ab", "sighting--1f3c8ca2-1fdb-48e8-823e-e6602b1a557f", "sighting--47776a6d-2538-4db0-8a5a-262cf1f7d85e", "sighting--a51902d0-1318-499d-97d3-925a8fcb75de", "sighting--bfc5f26d-9aa7-481d-be83-55b9ddfbd812", "sighting--6713c951-8a79-4830-8444-b2a8743c4489", "sighting--3f4643c4-dcec-48b5-a86c-310c3066e379", "sighting--7c64ce58-11a5-4807-a3c1-f0156fc0ba3e", "sighting--c6395cf1-a104-4cc9-9c03-cae77298dde7", "sighting--b0c9de7b-2392-492d-8e0f-ea8d0cc67541", "sighting--3e5b97e5-df11-4af1-85d7-fd90fda7d4fd", "sighting--ec477575-5a77-4545-8d0c-64d53cd23073", "sighting--88910e23-2b34-447f-8cd2-694ac834e233", "sighting--9fc20bf4-9dca-45ec-8e51-1e464f977a8d", "sighting--4bf63f62-38d2-4b81-9d5b-ae8ff2f19637", "sighting--48c8f9f9-cfe9-456a-9123-63f4d9ed2534", "sighting--7b174ea5-1830-45c8-9639-8240403d596f", "sighting--ba5d8319-5810-40ca-b5fb-1cf363333602", "sighting--1d78848c-c0cc-4a96-8a24-0bfde7cf998b", "sighting--16153df4-0c6e-43a8-a2b9-7e1ccb084a6a", "sighting--e64694bd-f717-4d86-b256-9a236801d8a1", "sighting--2f06ba9e-59ab-4747-9219-9198bb58895a", "sighting--3f543ed2-3fd2-4116-91e7-76e16c424bcb", "sighting--eff9d879-3dce-407c-90c6-537cb72d2a42", "sighting--18d9866f-338a-4ca1-8a86-f233f59b1782", "sighting--fa4ca0e0-08d9-442b-b3d1-28fd34abb892", "sighting--9c242173-a662-44e1-b554-3f934b37bcf1", "sighting--3b53b940-d141-4c9b-9bb2-640f491d6633", "sighting--df7e2068-ddf5-4a3e-9edf-fec5b1d91225", "sighting--d12e60dc-ee85-4ef6-8276-0c2aabdb3832", "sighting--8c62b812-ccbb-45a8-acee-2537213a8b70", "sighting--3cbf17fe-4171-47ab-b587-2b49975bb4bc", "sighting--d1921d43-6d22-459b-8050-b904f17f2d14", "sighting--d841690e-f02e-41e0-bb1a-c064616b57fb", "sighting--fd3e6bf1-9166-4561-9e8e-6f9fc426ec99", "sighting--27ab5603-76a1-4df7-b252-bcacf86f902f", "sighting--a5d64f1e-e133-415a-a3fe-01de51cc184b", "sighting--c5be924f-7f3d-4b39-a3a4-5d4284147e1c", "sighting--23f3eb1a-96e9-425f-a17c-2fc1dd0f105b", "sighting--1b9d982d-6829-4f8b-8f56-459805eb7b98", "sighting--0b85a716-70c8-46d8-9a3e-6d0c4207e486", "sighting--cf82bc0a-b10b-4c71-a477-b55e0ac1906a", "sighting--a79376d3-59b1-4bc6-9c53-22c1ed959a60", "sighting--bf56f364-c472-48f5-a6f1-4ca672894607", "sighting--73a87fef-7ee5-4e4f-bce3-812327883f88", "sighting--3b9aca48-10cf-4ab9-87d3-988b4e722793", "sighting--98bac887-97f3-42fa-a1fb-51a588f195fb", "sighting--a510cc3c-01ca-4c8a-bc2b-768134b427a7", "sighting--4190c3cf-6f3c-41ed-be60-5fd39df85138", "sighting--7a05cd6a-7f11-4e6e-bcef-4ac9634bdf47", "sighting--3f0643c6-5617-475c-a33e-a82ca6cc3639", "sighting--2878f326-9805-4052-8061-0270fcb599a8", "sighting--8467aa8b-774c-4eb2-87a1-e8d59fd23ae3", "sighting--e05b1294-1ae6-4a57-b0ee-6dd8afafce81", "sighting--fbee2228-2ad4-4d0b-93ff-1aa1c31de9d4", "sighting--79f34d61-28b6-4b93-978c-c4e3d127feed", "sighting--fedb21e4-4a43-465a-9d73-fe23c650bea1", "sighting--91f0c0e4-9fe4-4513-8b15-ad5535627087", "sighting--d7d3b1c9-fd85-4575-8aee-9e383746e390", "sighting--aa494e59-bf11-4cdf-a337-a4e8f668fb5a", "sighting--dacf5ae5-6398-4320-ab58-396fdecb816b", "sighting--0e03ffe1-a842-4501-9578-cffe6af01a58", "sighting--2b90e64e-0377-4877-ba64-d3bc99e2bde2", "sighting--802a5826-c040-4710-9825-f8a59f959ce0", "sighting--a2f7cd61-d8a0-4522-87e3-047a62ad27f1", "sighting--c11f2340-ed22-4245-af6f-09fc3c436e0e", "sighting--2fe965f6-d0fe-4d4f-b8bf-95b0220f9539", "sighting--34c52e0e-7ca9-45f3-8087-ab704c806f33", "sighting--28fbdbe7-5898-4c97-94ca-9f1a2da3b69b", "sighting--758db077-1f04-4094-9ea3-13c4237d899e", "sighting--c50e335a-0b49-4179-a479-0716631a41eb", "sighting--b2d1abc0-2ee8-4e3a-9e8e-737be8edc1a1", "sighting--73c34ee3-caa1-4fa0-8d93-c75f50e41c2a", "sighting--b16a0c02-2542-435b-bda0-dbf1d8c83dcb", "sighting--1c1054cc-c70e-43c4-9695-3e5d92ed1189", "sighting--69ce5a77-9aab-40f2-879a-f6f0f3a05671", "sighting--b2d360f0-c8de-45bf-92b9-114f8ad6b08b", "sighting--b7618d0b-dc95-44b0-b9f4-5d83e7d4844a", "sighting--dd765279-deb2-4fcb-970e-3e95df3a9781", "sighting--8018b675-06b4-4174-88c4-803d1ca95d25", "sighting--3b666d05-769c-49e0-88a9-0e59fd0b8b47", "sighting--01955818-2ebb-45f2-8a2b-cdad053c20f1", "sighting--bc9634a1-5583-4ce7-a06d-b6634cfe490e", "sighting--25d9c62d-6ecc-41ba-8497-fe878fea1589", "sighting--d44a1ed5-26c8-45a8-b32e-44fe85ad4570", "sighting--359bdb4d-1a92-4ec1-b97a-3e681e91da96", "sighting--b0f783e2-85d7-4e89-9279-4ddd825de5ae", "sighting--b691c42a-0fbb-4f68-b820-37eaff7484af", "sighting--d036716c-4e82-4035-820b-4ce54cde82f9", "sighting--773d6e21-d637-47bd-8932-8317befae027", "sighting--5ba0d74a-1993-4e13-857e-3d874576f814", "sighting--07beabec-3f4e-4519-babd-ad5187f61fc7", "sighting--cc1f2cd3-1a09-4afa-bc9b-71ffe10e6b18", "sighting--f6762ed9-eaf2-4a6f-b89e-e70f720d5dfa", "sighting--44f8b402-ab66-435b-94ea-1c28f4cc7e39", "sighting--fa72708f-8d17-4514-817a-9cba04508d43", "sighting--59cd546d-f55e-4b69-bf11-e0ffb94f0535", "sighting--50ad64f7-d667-4411-b3a2-3089ae29d60b", "sighting--8e15c12e-08c4-4eba-8068-ceb87348ef09", "sighting--4689671b-cc91-4b06-9576-4b6b0a0d43fb", "sighting--f4e727b7-2096-4475-8386-80ccf9057971", "sighting--e63136c0-91d8-4f1a-868d-f501e97a119b", "sighting--ffcf7aca-c422-4a88-81c4-1bb4addd8d2c", "sighting--01434647-4366-4adf-aaa9-7840e49a96e0", "sighting--8482ab63-7862-4459-870d-b3d3fc398c58", "sighting--01f0d43c-ae20-43f2-b9e1-37ff4bffa490", "sighting--3843a492-025f-4aad-a82e-bcc31b2d15ba", "sighting--65d77511-460d-4416-87d7-82b2ddb4c516", "sighting--34b7815a-6d81-4fc7-a5b8-7dea81ca5f96", "sighting--cfec9a2e-496d-4985-99b8-de5658319316", "sighting--bdb4f9d2-361b-42bf-b6bb-a7cbf1d66fd5", "sighting--1a6bda3a-234b-412d-9369-26b7dbdf2926", "sighting--be4ef023-e3d6-4433-aa28-008d5f66c8ff", "sighting--a4513788-9900-41a6-839c-9821240a477f", "sighting--f99d3948-d886-48ab-9b91-89c7e7f7145f", "sighting--6f49bf87-907d-4982-aaa0-19bf3e890fb5", "sighting--bc85510c-cb2d-4453-bbf1-2ac8304f63d2", "sighting--c97fd163-490b-4471-be6f-d76ee05d60fb", "sighting--f85107dd-1806-445f-a4f9-dcf459c6f85a", "sighting--f6dc86fe-c6ff-4101-811b-ea34bb2bb226", "sighting--40b12061-65e9-4c73-ba33-5714ed6b152e", "sighting--86ea2416-a8bd-4d0d-b94e-0229f4ecc2a1", "sighting--13aa709f-80a0-4470-b041-c36ef444deda", "sighting--bd0fa813-6d12-4acc-be23-ed7946175a0f", "sighting--fe4f42d9-2232-4dff-a865-92e58201d59d", "sighting--1fcb6590-352f-4124-a152-579baf4e1a8c", "sighting--1c01d186-36bf-43d4-a884-71dbe8eb089c", "sighting--1a31ccc7-e4df-44c5-8574-2deb622d8468", "sighting--2c2603ad-e79a-4efc-b6e4-f2063b59b187", "sighting--6808074a-c929-454f-a42a-b76c4c1ddd73", "sighting--a383fa1c-ff49-4007-affc-448d2756c68d", "sighting--c9dd56af-8e10-4a67-8547-07cef43be764", "sighting--9a41bb51-da04-4c1c-87a7-e160f5947b42", "sighting--e9b7d5c7-3441-4c05-a346-e80b7d7c74f1", "sighting--716cc36e-c1f7-48ef-b977-8526d6db90ae", "sighting--74a5cbc1-648c-4fd1-a2dc-fdb2a3ba22ef", "sighting--876a5dfd-a81c-47d6-bcf4-ccf414f3ac8b", "sighting--5838fd97-211b-41b2-a2d7-8b45a6d87c8f", "sighting--6d0c5873-2f98-43d0-a4a5-b387fd027141", "sighting--49f5bc99-34b1-4e40-be52-22669c6ea731", "sighting--dc494744-7dd0-436b-b8d8-b90024ad9b45", "sighting--3f242499-7ba9-44b4-8ea9-bf5eb6db45a1", "sighting--07080867-a647-4c44-bd33-1dfe20d23226", "sighting--50ee451e-4a75-426a-ab69-4046e48c1033", "sighting--a3909260-8aab-407f-93f5-ecf7eb405cef", "sighting--ad4a316c-6faf-4366-bf96-6afe98665d6f", "sighting--d4aabe20-e25d-43d0-a313-c4d313307571", "sighting--4735db00-c210-42d0-a49e-c36946da85e3", "sighting--b5f04c15-4291-46cc-a0e5-437596fdb83a", "sighting--bc63c6eb-da53-499c-8ad7-9a873e7ca8f9", "sighting--22f5c2c8-43aa-4a6d-87fe-0ef0754390dc", "sighting--9640bcfe-84e4-4b98-82af-8d5c891289d5", "sighting--7210f1a8-50e7-46c2-8da3-24528ebac41a", "sighting--d76a715c-7f8e-43b9-9b86-225b3bf9be75", "sighting--3dfb38b6-f62d-406c-b313-376726645197", "sighting--41e409e7-6fd0-4ddb-9096-2390fdf342a4", "sighting--f8083414-4e6f-420f-8f12-c8a495c99e9e", "sighting--1dd9e1ab-a412-4858-bd2a-b29e57ea523b", "sighting--0f5cc08a-4010-43fd-a0e0-7e2050fd0a67", "sighting--161f1bbd-2211-416e-bc18-00f76ef1cb73", "sighting--6c3d70a9-ced7-450e-8396-bc0b074f359f", "sighting--15ab4439-ae5c-4c9f-b070-225c82a05060", "sighting--7a4e2b9e-339d-4940-9399-df3e23a4be59", "sighting--90800117-f8a2-4826-87e1-0ec12701a2b1", "sighting--36f62fd8-73be-4596-845c-7d6ef3b949d0", "sighting--a802da6d-8863-41b5-95c2-5819e2d02f18", "sighting--1edfe870-45c3-4d3a-ad23-3ed4c02a7a53", "sighting--be6732e5-3a1a-4225-874e-2adb3488c9c4", "sighting--58ecf95f-6660-4b0a-b379-d94637e0717c", "sighting--8d483859-014a-4f9e-b4d3-46e1e85fccbf", "sighting--24f621a3-f2bc-473e-a7f6-f89bfea44349", "sighting--b3191b77-9260-4d2f-88fa-9788d454e45c", "sighting--4ce485bc-aa76-4e1e-9c94-cc2cf40d4037", "sighting--ca8932e6-68e4-4d63-865a-201dc4ee60ee", "sighting--c4aa88ac-d832-4401-ba47-5c7269be7ce7", "sighting--02314a12-302b-49ef-839c-d6b0fcabc158", "sighting--792a3eaf-c432-4fe5-8ab1-3bd61625ae32", "sighting--61fc650d-c6d5-4e0f-a601-e4f36877cdea", "sighting--b2b41c9c-4864-4db3-b840-8ab10453bfcc", "sighting--79cd8edf-b1b3-441d-971c-3c127f9297c1", "sighting--daf2c006-e8e2-4cad-b275-48df3ce44d48", "sighting--685200b3-fdf7-4801-8f71-eac2ac0265ab", "sighting--01c00fb8-514e-4f58-9a83-87600661edd5", "sighting--5e3f3e29-f13a-4e8a-9803-5e6428083778", "sighting--172b898a-aae6-4290-ba0b-bd58aa0c05a9", "sighting--105f3de3-1fea-410a-84d2-9e66667c4724", "sighting--03de404f-dafe-4179-9cf5-88fd671d2e17", "sighting--3b095c59-9088-405f-b34c-b57d8a43e584", "sighting--0fa4d085-3ed4-4a45-8bad-3c51640af60d", "sighting--d5fa8a66-85bf-467e-a217-f4128eb3c70a", "sighting--70835cc7-870f-42c5-a981-a1a71364d57b", "sighting--e05a02d7-5801-4a7b-b7f4-1c7920511ac8", "sighting--df443efd-80cd-4dda-83d8-649294195ed2", "sighting--5624eccb-445c-4ba0-b59f-d8b11771de87", "sighting--348d92c6-0cd0-4f12-ad74-be964c98b11a", "sighting--eb8f4049-de0f-4416-888a-130e8fef8d2c", "sighting--0ff84483-27f9-4988-bcd5-599a5ee6b01c", "sighting--ab8d6f85-ca30-487d-96e1-c23fa1277362", "sighting--4e978d9a-5500-4713-819c-af043eb072e6", "sighting--a00499cf-7ab8-4cd4-b5a3-4b374546c3a4", "sighting--500fc34d-8d9f-4d73-b1f5-2a5de0ebf4b6", "sighting--5e9bb831-7baf-475e-8e37-00b70724f832", "sighting--726acce5-85b3-41b6-ba30-ef4d4162fe8a", "sighting--404868ea-6e9b-4137-9656-380d4b46d310", "sighting--9fc7a779-cd47-4113-9d42-0eb97de280aa", "sighting--18df1aea-ef43-4fff-b035-e120ea00b882", "sighting--43db5fee-89b9-4e03-8658-9a4ffe502d42", "sighting--1c63bc9d-730b-4149-85eb-4906d5201ebc", "sighting--581b952d-89d9-46ba-81f4-796c2a44e1c5", "sighting--69e3976d-ea88-408f-a81b-50ad9687e4c1", "sighting--32036e3e-511d-49e3-be79-f122d0d4e118", "sighting--e237b32b-648a-405b-a80d-ae604b06320b", "sighting--f6be58e9-d3ec-40f6-9468-31dd68eb74fc", "sighting--ab5ee85a-5bd8-41cb-8cb7-059ea338e037", "sighting--3aadcbea-f644-43a8-bb62-dc9327b647ed", "sighting--05678057-75c7-4a30-83c7-9663ec7d52c6", "sighting--6985c16c-5823-4d9a-9cd5-384bf3a83dc8", "sighting--b08594c5-783b-4777-87b7-92707f4facdc", "sighting--0426e061-373a-4cd0-becd-e1ed466c8147", "sighting--44414471-2498-4e8c-802b-19120d9f8ab4", "sighting--d7ce6648-cdb7-4436-b56c-2aa7dfc26774", "sighting--67320951-325a-466e-8322-24426119c52f", "sighting--a5f961b0-325c-4114-a3ae-1d0733ba8f8c", "sighting--e613a054-751d-4ebd-8a49-b3bf3c92ebb1", "sighting--9b6d2095-18c6-49fa-a2f5-67408cf2b274", "sighting--ee97621a-a24d-4266-bfce-931d552230f1", "sighting--00a67b18-f2df-4fe9-8544-a62310cf0037", "sighting--0946355b-e46c-448d-aca1-2b47d0260861", "sighting--e24448d6-4f57-4ff4-9745-cefcad662657", "sighting--f40c7048-53a1-46cb-9025-24142948cd61", "sighting--b4366be0-1ccd-4eb7-8c0f-ba474f744a63", "sighting--6cae6c8c-a259-4ef3-ad63-531e97bf491a", "sighting--725ec8f8-7cc7-442c-bc32-4d332c47b7e7", "sighting--fb3e5c28-c55f-41de-bd47-424b96b83dfc", "sighting--7e4fcdea-777f-41f5-b95a-f4068d660650", "sighting--581069d4-86bb-4178-8167-1bc187b2ff42", "sighting--290fbdb1-333b-4d34-b68a-f0f7d8cf957e", "sighting--dfbed664-b38f-4569-b78f-fd794d1897e7", "sighting--01adc79f-773d-4309-be3e-a25c96bb0d84", "sighting--cf6f691c-abbd-4ca7-8901-f9d960e3cd1c", "sighting--8af76852-708a-4181-b20b-f231f712220c", "sighting--89c35532-ebf8-45c7-8c7e-3e5c2b6edc2d", "sighting--e3f4efe9-cd3c-441f-a0e9-b7282610fe9f", "sighting--23a4ab72-8736-4c83-95c6-822b5d3c98c1", "sighting--d09e75db-c43f-41df-8382-6611338e2254", "sighting--1f0c505c-a2ec-469d-b6ac-18f90dd67b09", "sighting--fa6a6afa-07ff-47df-928d-6c5b03c93e0a", "sighting--9701e426-2b61-4785-9a3a-25cd966e0857", "sighting--65283676-dee7-4421-88de-eabb05a30f51", "sighting--2fec91d3-f6ed-407b-8153-f11ed5231136", "sighting--4416fb91-1bb9-43bc-bfec-95a5d9cee184", "sighting--19ad8115-45f2-4cee-9c4a-2d5099579669", "sighting--8e065ac6-bd34-41d7-823c-7da2723d8e1a", "sighting--fecb2a15-8db0-41fe-8e8f-25f3a9b5ade7", "sighting--0ca2192e-9f6e-43fe-aecb-2a8a73cc9b5a", "sighting--3cc2f67b-2484-4627-881f-0a4044893649", "sighting--4ad7057f-05e5-499c-8f72-c975561571ed", "sighting--8f9ca057-65cf-4d53-8bb7-d89396add79f", "sighting--2434cde9-c9a3-4203-9660-2b981a414bb1", "sighting--29571aab-9757-4ecb-834c-29babf11ee1b", "sighting--d89748d1-91c5-4339-8417-f816c5c12090", "sighting--91d7d601-f2e0-485f-80b6-ea252b529e3b", "sighting--285592d5-3e38-45c0-b7a5-df3011c28a21", "sighting--eed3e002-cc04-4e1f-b437-1f3a458467d9", "sighting--f4a5f7a2-db60-4b7e-a4fa-b68bf5786394", "sighting--c17305af-13cd-47b7-82c1-b1d2c70612a7", "sighting--7a355a0f-3a1b-490c-90a6-706d1ce72afe", "sighting--d04eaea8-17e9-40eb-869d-65f6dbf996b5", "sighting--a7a7b63a-3cbf-418f-aed7-62ff040fd81c", "sighting--a85a4b8b-eb85-4211-8e47-bed55967ed27", "sighting--3b9906f9-289f-4f3f-8369-db5e92866f24", "sighting--405557f3-2ac5-4a10-b896-78676eb84511", "sighting--627ccc68-9892-4638-8667-5272c580c7e6", "sighting--62701e62-6051-42d1-831d-cd292b4261b8", "sighting--18fcea7f-3e15-47d9-bd2a-0ad60e380f3e", "sighting--9c789f48-b4b2-42bc-b6bf-c56dd09b8d5a", "sighting--7bab3393-18b8-4f77-9b69-8b2e77a97ba6", "sighting--1eceea30-1be6-467f-ac3f-86c45e212669", "sighting--7776ab40-f3ee-427e-883f-9792adbc772c", "sighting--ab36efc9-1949-4898-9ea4-35198bed500d", "sighting--cb39ec09-03e9-452c-a51b-bf071c8acbc0", "sighting--f234b231-1982-444e-9533-98ce9917b5b6", "sighting--081254b5-8490-438c-8717-f6cfdc593f3a", "sighting--63b4071c-bbe0-47a0-87ce-532695d65ef6", "sighting--288a3d78-d953-440f-8c49-0dd50f6bceda", "sighting--00b9ece6-6330-4fad-a6fe-828a3f411a6b", "sighting--2e48e735-1c85-47d8-a8a6-6428da2f78ce", "sighting--d3bd57d4-ac86-428b-baa6-322bd7ede71f", "sighting--0527f8c6-389d-4b9c-85fe-be88e1919306", "sighting--cf45f56c-6eb7-47b1-8344-4fd828a6dd96", "sighting--4ca4cb28-615b-4e2e-ba1d-b32b9f750a7d", "sighting--f2425c25-c6f2-48af-ad95-4d6e119818ca", "sighting--7a376a62-9b6e-4fdf-9219-3aa4b6141baf", "sighting--3fb4c043-7ffc-4e19-a570-70c8b1294d78", "sighting--de454e83-b6b9-46ab-8780-fd981a4d57d0", "sighting--c3b8a0c1-87f0-4f14-a0b6-09527bb9b0f8", "sighting--b03a5698-45f5-4776-8d31-c2a0d99a1dce", "sighting--fa45af99-c6d5-4af1-b25c-762f47e91d06", "sighting--40a7745e-54f4-488d-94e5-065e99b76273", "sighting--8c47e62c-95df-444c-8eff-bf64bbe3ed7a", "sighting--e76a93b6-8c70-468d-8a39-35e269af1cea", "sighting--a46a1761-26db-4d52-973d-ba4fc76dca30", "sighting--b654508a-1471-435a-a617-61395fc7cb0f", "sighting--2e6674e7-9163-4325-8d5a-44b496b5da55", "sighting--8c413489-68c3-4db8-9dd5-c1693902360e", "sighting--e2785085-9efa-497a-b80a-3e982ba778c5", "sighting--15a10558-d0d9-476a-b9c9-c796b4f96bcc", "sighting--417d7bdd-fff3-4af7-8729-13710fe34106", "sighting--0aae21e9-417f-41f9-8b10-f933143be2b7", "sighting--e7114244-e4ab-4263-ba38-c731e0fcfa16", "sighting--37aca457-58ec-4a99-8572-271c3ba769fd", "sighting--f96dbe23-4f00-4726-8b7f-7a9038459ff1", "sighting--a4112a6f-0870-480c-8005-849aa9b54ea5", "sighting--f3a23cce-5309-4d1f-96ad-3d750a01698e", "sighting--d8d75bd1-5597-41f5-9977-c05bb4f6ebb8", "sighting--c1fb489a-4c25-46f3-bc5e-4a37ed347e5d", "sighting--5ed058d4-2cc2-41ae-bf05-6bb4ed80bd03", "sighting--b2f83790-5855-415f-89ac-3f9608888a08", "sighting--c1be4d8f-d1e5-41e3-b1a1-0a44d6857b52", "sighting--775b4d95-eb4c-4a39-a1d3-ee4a5f1188fc", "sighting--0be4ddce-541f-468b-83cb-2ece883c8be1", "sighting--a1e57efa-8135-412d-b894-db8357c2dbe5", "sighting--7afb2471-1fe7-4d2d-948e-66e8b5380333", "sighting--2045cb15-d21a-421a-a82e-654e25421400", "sighting--20b62392-177b-48d0-9adf-eb6e20ba487d", "sighting--ece2f550-f6fd-4fce-8b2f-fd130d0dd112", "sighting--c617d78b-da02-47b0-952d-a49b0815da19", "sighting--91eb61c9-8150-45a7-a726-b06ea079b755", "sighting--7d59eaa1-8d37-43e0-a8c5-c65029d62f85", "sighting--be24fdf8-8cca-46dd-81d8-6c7af55b796e", "sighting--eb3f1c50-b627-4c45-ae5e-f48c3d68a30c", "sighting--92b39968-5506-4183-b650-49e08203936a", "sighting--849bf23b-acce-42f3-a4b1-96683926d97f", "sighting--9b27d678-fbd0-4d3d-be9a-3dba0f947e45", "sighting--29b59201-d7f4-42c8-8cc3-49029f89abdf", "sighting--0676abd4-5a07-45d6-b2af-f2a105b459b9", "sighting--cfb99f7b-4bc5-4467-a086-24a770bdc69d", "sighting--9e22a173-3080-4cb9-b915-ac33fc88ad26", "sighting--a6fdb608-c5fd-46f0-9778-de169bf98c23", "sighting--0b6a0d30-ec70-4fcf-869a-ca7a802455c4", "sighting--6b436dea-366a-4654-aa58-1af586feb3fb", "sighting--82410aa8-f309-420a-a1ad-70d569015ff2", "sighting--45eed0fc-ded4-467a-95a8-adbf1d0ccd7c", "sighting--271de9e8-dd0f-4d0d-9de3-4174c6a5e50b", "sighting--94f4a251-a9bf-472c-8585-ccc37b80acf1", "sighting--f352fb4c-bb89-4b74-9c20-395ba67754c7", "sighting--685bc384-1080-4fd8-a9ef-15ee591e2470", "sighting--2d6112b6-5881-478f-91a5-4f120575e26d", "sighting--cfbeb159-f1e2-4dbf-bc74-d45bd0119b2f", "sighting--3ef920ef-ca69-44aa-b2de-3bbc0d209df0", "sighting--b21e91a7-d740-4a73-8c47-13bf5355797b", "sighting--1e055ec9-85b4-47d8-a9a5-5f4cfb28c9ed", "sighting--cefedf5f-fa32-4e49-9bb8-949ab39a44b1", "sighting--a38cb977-a26f-4e0f-9618-5147a83ec253", "sighting--033a9e58-b0b0-4205-b2b9-3df8745ec9b2", "sighting--1bcbec8f-5872-4e28-a88b-73c5e6e457ad", "sighting--b77b49bd-cd84-4a08-8392-7999015859ba", "sighting--582bc1f5-67bc-4522-9626-36ec4f833dd3", "sighting--63e0a108-fc62-4420-b53b-79cc2498255a", "sighting--533c564d-dcff-4375-b295-46cc56d4e895", "sighting--95a18e57-b410-4c6e-8a2f-8c15ae8c329d", "sighting--c3380239-aa16-42e9-95ea-5a99b258e355", "sighting--814aa6ff-ff69-4beb-ba4d-778b23f13929", "sighting--ec6d2a26-8acb-455a-a7de-36c7517f2164", "sighting--529098d4-b19d-4724-a9d4-91e4cdcd0b96", "sighting--08655177-8353-45e2-97b3-2a1781a69af0", "sighting--749f38c0-080d-4a1b-9e54-4f2e5518fe2c", "sighting--82a81cbf-0f75-4abd-9c78-41e9e684a2c4", "sighting--afbc6bcd-a683-42e5-beb2-b43523a82e6c", "sighting--ca97b0c1-d423-442e-946d-cd733d10ed1c", "sighting--f735b5dd-ebfb-44d4-ae6c-d746acb0c167", "sighting--7f717844-1258-4439-9a1f-b51a2401b3ba", "sighting--ad5f9d42-17ba-4659-b355-cdd3d3e3921c", "sighting--ef62a189-5aa8-4e0b-b37e-f4c2401edd03", "sighting--65bafde9-89b3-45da-ad1d-ae67583c5bd4", "sighting--5c385326-d20a-40bb-90fe-eae9e82272fc", "sighting--80594bbc-b464-4f65-b8f9-f4586d23aa9b", "sighting--33300cdf-4ef8-4a34-b5bd-4c9c25b9c153", "sighting--80d1077d-2d9b-477c-b469-2832f48ec74c", "sighting--e8a8ce11-8e63-41d3-9bba-9ace79b8cf52", "sighting--88003d84-7491-46c4-95e1-dcae150b0bb7", "sighting--4934520d-f689-4ab8-965f-4ae064a3b1c4", "sighting--9558b063-3856-4a9d-bed0-5f4de6c0ecf1", "sighting--7a15501a-4ed7-4734-975e-886b915dd5aa", "sighting--62c193b1-74e6-4013-9e87-8cd654c09f9e", "sighting--7ba4125b-47e9-42b0-848a-39b2b9dc8040", "sighting--c682d39e-a84c-487b-8041-af2df9eff055", "sighting--d308b100-e1dd-40c8-81b3-50269d04f0e3", "sighting--d6a49bd5-d741-488e-9b9b-36761bcc1aa3", "sighting--61368b8b-3624-4847-a7d6-ce8694411c75", "sighting--d2ad2ed0-351e-4661-996c-13105f9cb9ec", "sighting--77bb619d-76d5-46d6-b14e-22624c8d619f", "sighting--9325a0d6-9c18-489c-8122-564a6cabc21c", "sighting--1f6d39c5-b970-48f5-adca-089273c54313", "sighting--90fd53d8-5b63-4fca-ac32-3e43cb1d8551", "sighting--9d9e7fdd-bf8e-4653-a75c-c86750361aaf", "sighting--8981f1c7-41cd-4162-ba3b-c0b8d5b17fc4", "sighting--7b37cc73-93a0-4109-a786-1bf56bb213ad", "sighting--d0810b0f-9619-4bec-9f0d-8525ee4e9596", "sighting--a7a2cba2-fa69-49be-a22c-68c5eaceda37", "sighting--17803975-2bd5-45c6-a0df-59ce8400975e", "sighting--75d3fdea-1033-4980-8811-a6db0502998d", "sighting--4dc3fb5b-f3c1-44d8-9522-054f2b974da0", "sighting--2d832966-e18d-4c10-9418-e5d28a996b65", "sighting--987b04d3-ce6b-4c75-8224-fb3cf2b25ef4", "sighting--d7a770a4-e6f3-44a1-bff6-7fd95281bc21", "sighting--6b1786d9-16b8-44e6-8049-5e81750bf0b3", "sighting--0a58e197-2c97-4478-a8f4-b89858807842", "sighting--f68757d9-7d37-4c69-a289-950bc2ce8561", "sighting--ae3f3055-2d0e-463d-a9bc-b1a0e4b7677b", "sighting--ea275734-2ebb-4bb5-ad42-eb11ebf11199", "sighting--73ba3dc7-81d7-4864-83dd-db7776ebfb2c", "sighting--a9fbff18-2e74-415c-a6dd-9c2f77162be9", "sighting--a3f4b345-15c3-4946-bbca-ffdcd0f49e3b", "sighting--272ed61d-59a6-4b61-94a1-3c7bc4b9cdc4", "sighting--c10ed973-477f-4be7-abf5-679c646f0def", "sighting--84613951-3a4a-4815-b777-3bb209b40c75", "sighting--0bf8cbc0-2b6e-4da5-b806-eaa7675fcc0e", "sighting--24d27c19-59ae-43a8-8b5a-eebd15487947", "sighting--e64318f1-272f-4fb0-91a8-0619ff9eb6fd", "sighting--953b4e9c-0b9f-4e88-a806-e7180de7135e", "sighting--ef93295a-0b5c-497d-a938-4545dc1459f2", "sighting--1286bd7f-062e-44a4-8b0e-39cf86238342", "sighting--0c097e5f-846e-488f-b6cf-b520d813add9", "sighting--9bf2aec1-42b6-4c27-aea4-759004d83992", "sighting--459ae448-1b3c-4e84-b972-e1c79cacd18e", "sighting--e3cfc01c-f3ca-4bad-95fc-8ecd85ff744b", "sighting--4e4fd204-c04b-4e2e-bca6-b26622148460", "sighting--5aa844d1-6574-4ee9-a1b9-631dd6a4c3ff", "sighting--053f5fda-ec6b-4ff2-a03c-f0fe0278f0e2", "sighting--c6919580-137d-42d7-a17e-70fd3aaebe89", "sighting--af29f98f-8a23-49d8-afa9-096706b1a8d5", "sighting--f14eef96-66b2-4349-9996-006fd3601e7e", "sighting--4f57b41a-1065-4984-a6e1-ed4cb2261c26", "sighting--3bcd10ab-1d30-4a8f-97c3-e76e33d577ce", "sighting--d249d4dd-7248-495b-921a-4d8f07b1fe2e", "sighting--74a749de-d9cb-4b34-b659-a68ca396b60e", "sighting--72e435e9-1cae-42e2-9818-e1e5b9d48aaf", "sighting--381fa9b4-4538-467c-b948-450e12982898", "sighting--d381f235-cd4b-4062-b403-ee9f51fda618", "sighting--b0b36159-a361-4a28-9aa8-77e73ec8fe45", "sighting--fb187eaa-9c57-4133-88a9-4cd7232e7dc7", "sighting--5233e016-6644-4eec-967c-ebc709ba8bca", "sighting--b1178779-034a-401a-b957-db1a9bd233f3", "sighting--d3b9f856-062c-4823-acec-8f691098c82f", "sighting--44e3b6ea-dddd-4122-b8a6-9bf631848b65", "sighting--e4814743-12ef-4b4c-a60c-3cd2f1084051", "sighting--a2bae627-91e8-4f10-acdf-3285f0768db4", "sighting--70259fff-adcf-401c-97fc-1a10deb4eb6d", "sighting--e6cd5ab0-f05c-4f03-bbba-3b849087b684", "sighting--f60df9c3-c469-488f-a558-ab59143324f9", "sighting--88ee11c5-13b5-43c3-9328-00bc78ae3bed", "sighting--7e834ccd-1102-4ee9-93f8-6adde2189b24", "sighting--a0c1e918-c230-4994-acf6-fc427e2d03da", "sighting--6ea91d70-17a3-4611-90d6-7df2caf7ea38", "sighting--58c5b6fe-f18d-4ede-a1d9-a81faa619e17", "sighting--9e23af27-b1b2-4e18-8c85-93264d776716", "sighting--c812e5b2-3e53-43c4-9df7-33fc73a490af", "sighting--f408f11e-3e15-4b85-aa7c-b0de31cfd49f", "sighting--7d829365-98e1-4cd8-8b99-28e5b1a0cac2", "sighting--d5985f20-0982-41b1-9abf-3c34e0889756", "sighting--2b24dd91-a4b4-423e-8db0-87846096f755", "sighting--2e82006f-c967-438a-8026-794e371abdab", "sighting--b4d30993-b00a-4104-ba47-daa0524c7620", "sighting--08d0ec6f-1493-46dc-b8a2-ef6a5ed96a23", "sighting--efdd5496-a229-4fd3-ae31-c8467b8f5501", "sighting--c4b10561-492f-4775-810e-ebd999c74b92", "sighting--d690dd01-8ff5-4012-a335-b9770e240f47", "sighting--25b3e9c9-6c22-4640-b274-57c7ebfe7207", "sighting--be2eb2a3-01c9-47ba-94d1-2afd20a7be60", "sighting--582a0213-67bc-49e6-bad3-f3df607f8128", "sighting--b2b399ac-00e8-4d6e-93f0-7f415641442a", "sighting--520ab719-dc28-4015-80e3-d90f26bd5915", "sighting--3e02deaf-36b9-4f03-82f7-30a3a0a9f973", "sighting--f1d0b43b-0474-484e-9275-945900681ca5", "sighting--0d6e38f1-b97f-416f-84e6-637abdf99a5e", "sighting--6641d263-ecdd-4a16-ad9f-fd98d3418b6f", "sighting--e99af41f-9d80-4900-8d9a-10e12570c83f", "sighting--528cc3ca-75c4-4300-8ede-9f28e343cec5", "sighting--b5b43a3f-69bc-4958-bf25-910577609182", "sighting--cc7db546-775c-4f79-8b02-55ffae9eda5b", "sighting--574e849f-19b8-4f5c-9448-5f3419660105", "sighting--bd95badc-4960-4cca-b7cf-b62ab132d23a", "sighting--4bb8246e-97cd-402b-9cd2-72cf0a34b9b8", "sighting--7ddf49f4-1487-4dc1-8219-d10972c3a151", "sighting--e7822f3b-5f6d-43e4-9c6a-f20009374656", "sighting--5bb15e06-ea28-4a21-a22b-ffdef9accb4f", "sighting--a71ead0c-32c9-4a89-8384-2e129328f2d0", "sighting--38686c30-b51c-438c-9afc-47822fb37087", "sighting--339f0c3e-a973-4ff0-9907-6eb9d692b03d", "sighting--94eaa338-c77a-4f3d-b236-8e3298b68b40", "sighting--d5099ace-aa2f-42f3-8dc2-ecf78e35a5d2", "sighting--8e11997d-b2d9-483e-ad6e-521f5380d1d5", "sighting--dbf19bf2-a4f9-43a8-8125-33b166bae8b8", "sighting--de240999-cc1c-4076-b815-5e47b8e7259d", "sighting--b162ec07-5ff4-4fd4-80b6-0ae721fe2e0e", "sighting--7c445c5c-b006-4a1d-b92b-920061184d4e", "sighting--3b4635c4-2156-4d9a-a6ee-5210019d2649", "sighting--b7820d81-8013-4178-b21f-f8d3284d29fa", "sighting--6ad1854c-7746-41b9-9c29-2bc444fef6fc", "sighting--e9500535-10ee-4185-99e1-022a6d65e120", "sighting--d614faed-cf57-4d3d-9cf3-406648b576c6", "sighting--993a5557-3c08-4cc4-953e-4a00eebfe580", "sighting--61a11236-1e01-44f8-b784-36aa8208adc5", "sighting--71fe189f-4d9d-4a66-910b-04f8018cf0dc", "sighting--49a6073e-6042-4577-8b36-2c32db949a32", "sighting--0d2fed30-5d38-434e-8dbe-f4db7df41fae", "sighting--4a4ac039-8388-4b39-bece-c5a6142bd0cf", "sighting--ed141fc6-7b4d-4488-821e-10e20b69c8ff", "sighting--2c458e99-67c2-479c-8fc1-830161a50592", "sighting--dd9bb35f-4545-4b3b-8b4a-f77d3b66823f", "sighting--5a06363e-e473-4aa0-8f55-c75a2cb99bb0", "sighting--a5546e0d-2269-406a-8343-1e2e6172d22c", "sighting--679d0069-65aa-4b55-a4c8-9c78d18db170", "sighting--81b88b34-7bab-4237-a06d-2a9ffa574e85", "sighting--6bfb9469-3251-4355-a01a-fdb194c47936", "sighting--80ea9707-9281-4c1e-95b1-d5156c50a95a", "sighting--88b6b159-3de5-42b3-9be6-2f68b712ec11", "sighting--1fae2d2a-845d-41b2-8d6c-1679811ca983", "sighting--e4e54993-2ed5-4301-b3c2-2f21bbca6afd", "sighting--d2bf164a-4986-4538-b49d-17ff8019313f", "sighting--41eb2035-75a6-4a72-a219-f16989bf7776", "sighting--77f421fc-cb96-470a-b1f5-c943c6aa68ca", "sighting--933f79ef-ebbb-4c73-805b-27b5b6b2f8ce", "sighting--f7683a10-ff6d-448c-8e93-59917cc1ddf9", "sighting--b20706d1-a840-406a-88b5-8f5aa7cd9442", "sighting--4288f532-cfed-4343-91c6-53c0e77ab84c", "sighting--70822177-1ac5-483f-8642-51fe5a139264", "sighting--018aa4e3-4b55-4fdc-842f-8fdb103c6494", "sighting--88bd4c68-12d8-4556-a023-f7301d8fb7b2", "sighting--07a2f523-b9a4-4d00-8b95-05b221525bb0", "sighting--777c3bcb-b48f-43b0-9fc8-04722fbbcf2b", "sighting--17b142ad-4e48-4ccb-8f31-a21a9b81bdf1", "sighting--43c30e03-dbc8-4e6c-a37e-47e349650478", "sighting--f2d06f86-ca4c-435e-8861-ac1203da06a3", "sighting--fa503f2c-94d7-4506-bc26-194366cf6307", "sighting--9153af88-a756-46b6-a936-80937c7592f3", "sighting--88c570cd-a546-4e53-99f3-ba9e77ecdb25", "sighting--70f19be5-1c57-4967-8dcb-c3bee44721d2", "sighting--f01454f6-5417-4783-98f9-9fc0fd5070a5", "sighting--45218e3f-6460-430d-a742-d4d105c9f3df", "sighting--ff459e29-ae02-4bc1-ba07-e4d715feab3c", "sighting--edc60dbf-f90a-49d9-920a-dcdd1adf2c76", "sighting--7fb73657-fb44-4317-8a1e-dda09efc18ad", "sighting--9cff781a-d14e-4b63-87e4-2217e2bf9f30", "sighting--02d0db11-48ef-44b8-8f84-5c0828bbf7a1", "sighting--6c78be5f-a650-4aa9-9975-72f2aa8b62d4", "sighting--1090a375-98aa-4991-97a2-89fee8870e3e", "sighting--a0d1c53e-3119-4367-ac6f-c753f45e3544", "sighting--b9163a28-8f79-4708-9ab9-0c303a117463", "sighting--1ba7570f-dac7-410d-975e-61a8693caebf", "sighting--b50d90b8-7800-473f-b872-eb4e6a06617e", "sighting--6dcfbf5d-8cbf-497a-8bd1-5ceb781f668d", "sighting--47d7e09c-2d45-48e1-9cbc-2f27afa05259", "sighting--5b2a2747-884e-45b5-a898-8dff16190d3f", "sighting--5309e937-1162-449d-9334-849e059f1191", "sighting--70c02d92-eb60-4848-a7f9-68e145f2f16b", "sighting--fb2b9e9e-e642-4e0f-9abf-3d8649058bfa", "sighting--295dc6bb-7fc3-48a3-a9bc-7b2bce4bbc14", "sighting--6d06152e-cb9c-4513-a303-1e478645e342", "sighting--d733291a-43af-4ff1-8b29-ad3bdec34b83", "sighting--acfcd18f-000f-4744-b7e0-211e69019aa1", "sighting--93c2bab4-2a84-4533-889b-7dd9a41ebb96", "sighting--0ed122a3-1232-47d9-92a2-4a94bc4b7a20", "sighting--040cfe46-76eb-4762-adf3-532a8666d03f", "sighting--d4ab89f5-8bff-476a-a2fc-341effe94bd1", "sighting--1180aee7-7d9d-49c8-81a0-8c08606c80fc", "sighting--2f1e2097-bb61-44b2-ad72-756f07e1de1c", "sighting--57c7618b-4deb-4c0a-9a38-43b1ab9d5d30", "sighting--02fa7ccd-e0e9-41ea-a379-c5cce4b7cee1", "sighting--f7c27228-b032-4650-9eb5-dc253564b108", "sighting--ddb13d0a-1bd7-428f-aefb-614dbea54e28", "sighting--56807aed-8135-4bb2-b397-2e053fd0cc9a", "sighting--5ae171df-f17b-492f-95b4-e865b853aab9", "sighting--11787c71-ee24-4d98-97df-9f39ba8e6092", "sighting--e1cc8f85-487a-4e67-bf06-d442f91ce76f", "sighting--1e213e83-2eb6-44f1-b598-b1bcd3488083", "sighting--8d631812-5f5b-4faa-b75c-9646394449cb", "sighting--51c4057c-40db-4458-ab32-75eb9eccc9de", "sighting--a8e822a2-58d0-4cb5-a781-4f647ab13437", "sighting--919e67a9-a87c-47ac-a8b9-854cfd765cba", "sighting--462d5e6e-9b01-443e-904e-978e3384a2b8", "sighting--4f403315-05f4-4858-b865-c63c607a8fe3", "sighting--4002abdf-88b7-4769-a1b0-5f2785f30bed", "sighting--b84a8a56-baa1-463f-9289-7732ab3fb43d", "sighting--46a9712a-5832-4748-8708-362c6c46bc57", "sighting--c697f630-4d54-44fd-ac8a-8acbef7fbee4", "sighting--e6bbecd7-72d0-4cd0-b6f9-837dbb8f5282", "sighting--081911f4-b5c3-413f-baa6-2bc35a25287d", "sighting--4476d65f-385a-4cf8-acd1-6c24db070b53", "sighting--0b20cebb-7564-4a4a-a3c0-62bb29b4ba1e", "sighting--c5c820d8-c1cc-416c-bebb-21f5c8cce808", "sighting--dfa06ce9-479f-473f-8687-311fe533b164", "sighting--c9a27ae1-8abd-43da-8691-3dcba8e52c97", "sighting--d4f75a65-60d8-4ac4-995c-8c54722bc17c", "sighting--b5bfe9ad-f511-4a6a-9cdd-f6348b7296ef", "sighting--803c37bc-1262-414b-97d7-47a9b052f52b", "sighting--db3393d7-23d0-4fc8-a1ac-1f3430eda265", "sighting--ee1d6b3b-99d6-493c-9967-279a18868be7", "sighting--2c263177-5da4-4e1b-8da7-c84b8eef2655", "sighting--1fb7f8bb-9b1f-46bc-9567-533e38d14032", "sighting--5ecc2d0b-65fd-4f23-b265-ddaca6a018a4", "sighting--76097cb0-f97a-49e9-bef8-b237510b148d", "sighting--f733ccef-9427-4d7f-bc75-043748397536", "sighting--3c6f7b9b-42ae-4d80-86fc-4492043df254", "sighting--3e0f002b-cead-4fb7-833d-7122f7eeb272", "sighting--cbd6ac25-756c-4fba-be79-e7b19b0b21e9", "sighting--e9332263-dda2-4104-87aa-acfa781f9f24", "sighting--e6dfb4f6-8b38-48c5-8d4c-6afd1e766ecc", "sighting--e312ee84-9744-4d04-933f-0bf30308a336", "sighting--58900574-8c58-4e42-98f0-406a9aa344a4", "sighting--fe0ffcf1-7e63-4a2f-94be-deaca8a310d2", "sighting--bd215923-bdc9-4fcb-9116-3ffdde651f18", "sighting--ed626d3e-2100-426c-81ab-eda0454be880", "sighting--dcfcabf0-c256-4bb6-8036-f43b9530bfe8", "sighting--f4145e6a-d34a-4ee9-84a1-8f0b8937fe75", "sighting--4244d66b-829c-4786-9a2a-daaca8f36fc5", "sighting--4c5fd811-bdc3-441c-b939-e102f6c1e4ee", "sighting--4ae6af43-ff2e-4c0d-bd7e-8bc10c471246", "sighting--f445cce1-ceb8-4e3b-92cc-679ab3159c32", "sighting--24b8d447-0b8b-48a2-bb3f-8e818a4779eb", "sighting--5317c64b-6c6c-4e37-b674-ed4df0d781b4", "sighting--6172c7a7-d37a-4b3a-8299-7f465e23c9b0", "sighting--373ed3cb-51c6-49bf-9edd-efe058fd7989", "sighting--676baffc-d826-457c-b609-a609529783f9", "sighting--90b96602-19b3-41f5-9052-fb300b888d70", "sighting--6135e147-b175-40c0-bfad-e3ad7f479ea7", "sighting--b4929e45-b66b-421a-b0f3-f34ca228a6c1", "sighting--448afb3c-12f2-472e-994e-e8617e391f31", "sighting--48a62308-082b-401e-b364-32326f8c8ffc", "sighting--963a4ec0-e995-4eec-a645-b9ccb1111b07", "sighting--5e5c40c4-4a7e-447d-8ab7-712b91ace902", "sighting--5146f9e9-5386-432e-ba0f-6edc1e2404f7", "sighting--730e9a6d-73e6-4eea-8d9f-6c789103069b", "sighting--255c2979-2e42-42d9-98e6-1ce96e994bfa", "sighting--d1e629cf-14c8-4f78-a01e-6ff0ccb4884f", "sighting--2e2da14b-066e-4bd3-99ff-7e3bf223b4cf", "sighting--cbb4c2d1-2f4d-4950-b821-b4006bfd49ed", "sighting--d9cf5789-47a6-4cef-acc7-7230ac07a3c5", "sighting--f2f7ff6e-5913-4107-b337-cf960126f962", "sighting--2a53526f-37fb-4920-8b4a-1d3968b2d8d9", "sighting--619c190e-1ed9-4bbb-adb9-c30f84adb2b6", "sighting--4a955a40-784c-4546-8ae0-819f3b2fea2e", "sighting--d22fa786-92a6-4ecc-b45e-5701e52bb73d", "sighting--43693251-1a31-4a30-b043-7d38a068d088", "sighting--b771a99f-e1da-4d0f-9bb8-a7e8ffd2cc0b", "sighting--2016d2e7-d9c6-475d-854f-955c57430821", "sighting--f9cfba90-6c27-42d1-b333-69b50a5e992b", "sighting--c7dc3288-ac48-444c-832f-dff855ab3686", "sighting--e2f40c7e-ecea-400a-85de-a72ee760e016", "sighting--3191a9a6-1e73-4d95-8f16-021dbeb014be", "sighting--2819d491-9337-4a05-a332-76b3132b237b", "sighting--aa8a9163-c82a-4b5c-8517-cd02adfa0823", "sighting--f550581d-091b-4426-b869-0d62c3ae9985", "sighting--8a41465d-da2b-4e8a-a1c5-baf51df094a1", "sighting--cf9b5470-3f8e-4a18-9e99-8d722bc33baa", "sighting--c0f7ab5e-610e-422f-be3f-55e81ce05c6c", "sighting--b1890cf1-2217-4e3d-88d2-9d636d376825", "sighting--51a9612c-c0c9-43bc-af74-3ae9c86e87eb", "sighting--a2099aea-f1b6-444d-a863-b44469288506", "sighting--e42ad6eb-c456-498f-bd47-bc62d8bb52ad", "sighting--7f32ff60-8e97-4548-8522-eb2ca3e505ad", "sighting--472998a1-5da6-438c-ad3b-84e77158d59e", "sighting--faec6a9b-43a8-4a2f-a51f-77d3e55a2dc5", "sighting--67b3fcbd-5223-4401-a56f-7f8fea72b758", "sighting--b8757fec-7c9b-4161-9c62-bd050ea9609d", "sighting--cf2845c9-d478-48d3-aae6-b225b6f233d2", "sighting--34c6a2da-57c1-4ba2-896a-75652318b065", "sighting--a68d1bc5-1683-4b56-bce7-dca2db38cf49", "sighting--84b80bef-1ced-441b-8ffa-bc37fde8d7bb", "sighting--47e1945f-6b24-42cc-a971-aad49b94a6fb", "sighting--9693c1d3-6e9e-4fd4-9009-dd2f8eb64277", "sighting--84586e65-6fb2-4887-805e-7e27246c64d3", "sighting--cd41c947-9735-45a3-a5d4-d04045b4833c", "sighting--10b3417f-5dd1-4eec-8236-f21ec2365a97", "sighting--84ff3a92-9fa8-44f0-ad6e-b4b15558a113", "sighting--cc898a32-e276-49cf-90c8-5388ef2abacb", "sighting--532dcdfa-aa11-4e44-9906-ef7157edf53a", "sighting--89bc40a7-726a-4b24-a2c3-61b97c747e37", "sighting--955f47ca-4b9d-4493-8a2e-644c5baf59c4", "sighting--c063b948-98d5-4ed2-87c2-3ffab76ea641", "sighting--d06ddc46-32e3-483b-99e3-717151195ef7", "sighting--29395091-737d-4f88-be60-b52ce67e32f6", "sighting--2db2f78c-44dd-4de0-a4f2-7632326f9bef", "sighting--3fa2a17e-e552-4f3b-b6dc-8a55347dbe53", "sighting--69cc5a6e-bdf8-4892-bad3-fee98453c6da", "sighting--ac35781e-dcb2-4e2f-b000-995a5d73cc92", "sighting--30d73bb8-c48a-4c50-b0e5-7bd173be318c", "sighting--8b1d824d-012a-4b54-9c84-4f991a0c07e2", "sighting--9cc2de77-ac04-42d7-a37a-85d37e19cd54", "sighting--47fda2de-e133-49df-811b-a05a8212969a", "sighting--5f79dec7-53e7-4896-8381-dc124f0fc956", "sighting--ada385ab-46a1-4546-b5ff-742e63d98949", "sighting--60ba85d6-3b4d-4512-96de-510bdb4c8cb9", "sighting--d7b43b76-96b2-4330-9c1c-bb3c4fdb8ac1", "sighting--678c9324-9efa-4098-a3c9-ab4219d8df9d", "sighting--f15b6b2d-c9b1-4bff-9252-37073979cc0b", "sighting--0b9c2298-167d-4431-91b8-3b425a7e72a7", "sighting--b136d86d-d6f0-4f1d-b909-5d2cee740b99", "sighting--5678ec3b-e2d0-4022-ae6a-bb24291068e7", "sighting--4ace0cfc-3d11-4740-b2cf-a0d91f795087", "sighting--d2d8a830-5ea2-4648-9c31-fcc489583d87", "sighting--b5431dd7-8907-47a4-b9db-91228517fcb3", "sighting--2f68ef1c-faa1-46ae-9d33-c376943092b4", "sighting--0b6fccdb-266b-4580-94c7-3513d03f7b14", "sighting--b6cb7ac7-cd9b-49d9-8c3a-18e7a79994aa", "sighting--8e266d0d-f636-46ce-901c-ecce1f36ec12", "sighting--d801ded9-b5ca-4cf4-ab6b-1dbd5e0e302e", "sighting--20158345-6d91-4471-976c-650f326023f5", "sighting--ca2a66b0-68b5-4f99-a28f-8b59b8a05df6", "sighting--c3cad915-f623-4471-ad82-838d080367bc", "sighting--8b2bceeb-0e92-48c9-8af8-39adbff70b47", "sighting--4c2af8f9-ef5f-40a3-a6e8-547536dd306a", "sighting--9ea5bb86-f496-49fd-91bc-5923c8a6b6fa", "sighting--f1062484-ac9b-4ef4-ba8b-985a9f4342d7", "sighting--ca63193b-c58e-433c-8d13-163bf3de0d3d", "sighting--b77af532-93ea-4bb5-b6ee-9cf854c152e0", "sighting--219aef96-fb51-44c9-9596-905ea3cfa3e7", "sighting--698e561f-d108-4758-b649-f68022e664a4", "sighting--291299d9-ccf5-4e1d-be3c-aa77e20b9cd7", "sighting--5f0aaeed-2ade-4789-886c-de561cbbf777", "sighting--6c1b1a93-3337-457a-a0db-cc53ba3af984", "sighting--b6fa8ce3-801c-4360-a16a-555221dd85f4", "sighting--4bc71bf2-3e1c-4a86-97f2-3259ab7cf4f4", "sighting--fc458b4f-f71c-499c-8d1e-40c5886c71a4", "sighting--c1f28836-ef3c-4220-9662-886eede9a833", "sighting--d42be602-d06d-4f64-b493-9b3f60fb5c98", "sighting--887876aa-cfd3-4ebe-8a0b-c71c13eb8958", "sighting--7c2ea6df-5084-4a15-b7f1-1d651b34e685", "sighting--242a7b50-81d0-44b6-bed1-3d2260408671", "sighting--3742aac4-16ad-4d73-a751-b2f40f488ad1", "sighting--e4b794e0-9a20-4605-a3bc-abf8d8f09eab", "sighting--84bede84-47ec-4f9e-9da9-4e8941987b63", "sighting--6ec44f47-4555-4ab6-9302-090996d5f3cd", "sighting--f550f134-cdb8-4bdc-873b-631152d89507", "sighting--9a9ec63c-6b5a-4026-9658-00c50160a774", "sighting--08116002-0e0f-4c6b-af4b-8988043c3b86", "sighting--22cbf4b0-f058-42f5-89ee-5daa2a1e9fe5", "sighting--c5a620e5-93c4-470c-96a6-2294550f02d2", "sighting--07ac3aef-a60c-482b-82b9-319a2ce0e6bd", "sighting--02ccd073-c823-4425-9ad9-b89ae6f64c03", "sighting--fe45db50-c053-4679-adfd-d89961ebd933", "sighting--c295fdb9-f382-4c62-8503-fe9165172f9f", "sighting--62d99521-ee95-4d80-8800-bb3692a9c689", "sighting--1e21a8fe-42f6-4916-82a0-8e7bb1f35a3e", "sighting--b9b8bed5-f917-46de-920d-a9f4568c36e3", "sighting--0e25ff0a-e1cf-400b-9694-ae13ddd3bd50", "sighting--56580c20-f685-4009-8f96-71f4d63cb6d4", "sighting--c08d3386-7775-4b48-a3ee-429dbeef8b5e", "sighting--306b3c91-5fc2-4350-a85b-52948ec126d4", "sighting--e225a6d5-a31e-45e9-b86f-b5f921d3b7cd", "sighting--7ad29252-87b3-4c7c-9479-bc526efd192c", "sighting--fee8492e-5a0f-410f-9f87-888d0c30e331", "sighting--3a04c79e-10ff-4718-9e7a-bc5bed4506e0", "sighting--56e8f218-5398-461a-b5ea-e931939f605b", "sighting--c57a8800-c4e2-4a84-b61d-af921413f732", "sighting--240114fc-f4a1-4441-b750-fd9e5f873462", "sighting--7d1f9a3f-99e8-48bf-8f43-f0bcf7631c6f", "sighting--b5f0ee0f-e378-41ed-a9aa-066cbfcae13d", "sighting--65e58e64-f585-4c50-a282-b3afeca7d9ad", "sighting--3157f800-128d-4c89-b707-4ea57f2430e0", "sighting--295845cc-28b5-4613-8cc5-c773109612dd", "sighting--4f8bef81-f10a-41c7-8ef1-4eb3ae07d352", "sighting--c5b81b23-24e3-4966-bad0-b4d12a1c8982", "sighting--6ea1b866-3e80-4863-a40f-136061d3b19d", "sighting--720adb4b-f7f7-431c-93d5-2fb39ab1567b", "sighting--78bc9002-8eaa-492d-81b5-cbaebacaa44c", "sighting--abcaab1e-7841-4914-be64-ac8d6ad691fe", "sighting--8a328136-0472-4d24-b3d3-fc3ff8ff9787", "sighting--d7ccb29f-7397-4a64-9f07-6e446ddf1234", "sighting--c220946a-0eb9-4359-a13b-71e498f06032", "sighting--cca5eaf4-de58-46d4-9947-0f5ba74a108f", "sighting--7739acff-7e1e-4aff-a549-f8ab339c7557", "sighting--657c6e5a-e0b9-43d7-954b-592831d21b1d", "sighting--2d590b95-1154-4658-99c2-1a2a85982d75", "sighting--e9449d87-162b-4089-8700-d0f512f0c0b5", "sighting--e16a99d1-5e27-4fbd-a589-85272bb4aad4", "sighting--a72cea5d-6cd7-4f8b-84be-d7c5fe9c1d6f", "sighting--8f1074f2-d39c-40ac-b5f9-26abedd48687", "sighting--26753120-d573-42ee-8476-18f30ef90bc3", "sighting--02ccefb8-9d1c-4e0a-9c5e-2f11f404a8d9", "sighting--2aed2d48-9522-446b-a7f0-42c3d9449d04", "sighting--8388eded-95fe-4741-9826-0c6c706bc367", "sighting--30d08469-3d95-4ea8-919c-46f5105dea65", "sighting--2506aba6-3ef7-4f56-a4c4-b19cd9cd91bc", "sighting--87ff3a20-663b-49ff-8c69-bffe8719f515", "sighting--a3d65dd9-6988-4ad4-ab85-540685643f1c", "sighting--47d7f4b9-4632-47c0-849c-541c46d7d680", "sighting--d52d9fd4-010d-4ac3-b2e3-a6434c8dfeec", "sighting--9d2fdc69-5346-4d30-99d0-cb8c08ea9680", "sighting--45332d08-49d5-479c-9a63-e39ccb245f2b", "sighting--91388630-c050-4e1a-b066-a30530804f70", "sighting--5ab36199-1ea4-4efe-bbca-e621d4d41739", "sighting--ee013b35-d7ab-4cb7-9c8c-88b0843f5dbd", "sighting--5b34bccd-facf-4bb8-8876-746ec2e49ffb", "sighting--ab6402f9-67d0-44fc-b348-fd0fc2558a8f", "sighting--d683ea30-55f2-4541-91ed-6d96437630f3", "sighting--09fb03c4-e760-4a04-8b37-d8051603e166", "sighting--25bd21c7-78a0-46e5-b7ce-e0174e2ddcc9", "sighting--92d007f9-e93e-4b41-881b-592a25460df3", "sighting--d09f9334-4f85-428e-8585-559ca1355138", "sighting--751fe20e-2d51-4a1e-b600-18f9a68f7a3b", "sighting--068ff29d-7203-4972-9d8b-cc78d8904fe0", "sighting--d92a86eb-de15-4e61-945a-cc51fecf5b6c", "sighting--b5cc8923-4640-4ba4-a40d-64d5f3f8b177", "sighting--e4bf103a-d300-4a07-81af-e3e82f1b65a9", "sighting--112232c2-002d-4d69-9adc-b5c7345220d9", "sighting--956dd621-7172-46ef-84c7-6cf18d35147d", "sighting--5315ddbf-5106-4743-83e9-8931790750c0", "sighting--3463f642-723f-49cb-a1bf-8d1d1238dfaa", "sighting--7d65d1de-4936-4ff1-9bab-2747e2f7441b", "sighting--d0c5f42e-e795-41b6-bf8b-f8758f2255ed", "sighting--d24d62c6-75b2-4d5f-a831-68a111137e39", "sighting--52de5025-1a00-4a49-b85a-595dcf2b2fa3", "sighting--ee40e136-781d-4feb-923d-f30c51222f78", "sighting--15fa3c10-0352-4076-a903-a1bc7471cc83", "sighting--a5ac57ea-4003-4ca8-96d6-9f76e2e50c79", "sighting--dfdf0770-7387-4b78-9ff9-0a29c8684ba9", "sighting--af293167-3bb4-476d-9e58-cdb23db0b759", "sighting--8d15182d-97de-4cd8-93da-e6d3bcc2c701", "sighting--1f742dcc-1f60-4599-bec0-c57b2ec44067", "sighting--6eabbfde-06cc-4bed-8274-8a71576def62", "sighting--c9505e62-8a43-4989-9d2b-d072a4df5902", "sighting--7dad7d9f-d938-44b3-8b8e-39b55d0950ac", "sighting--e70995cc-64c6-45f1-bdce-bae55e004dc8", "sighting--8f05217e-b16f-44f1-a66f-6ea67fafe5aa", "sighting--a044eb49-40b0-4bb9-9390-304ced456238", "sighting--3b22c5e5-b112-4728-936c-8da19b4dacce", "sighting--8f98cd01-ca21-4450-8983-ee98dd899e93", "sighting--18a0dbff-0aa2-4d4e-8a1d-fcf9a7461b04", "sighting--4bc9d4d2-90c2-415b-8433-db37a328b0c1", "sighting--3dd9ed1d-989b-475e-a4f2-35cad2c4c2e1", "sighting--05deabdd-d7cf-41e9-a490-e59fb8f721e2", "sighting--c9fae10b-8e2d-40b4-aaa0-89c17205d1f7", "sighting--693e8e2f-9735-401b-ad76-69e7fcb25f27", "sighting--1a8a6d09-1c52-4155-ac93-2aa47e3cdabb", "sighting--528dbfd5-9b73-49aa-8c57-858ea952a62d", "sighting--a4a82ed1-1e21-4009-b93c-2d31a5645412", "sighting--0d1bf97d-13db-48d4-a10c-1c8b0a5e2a7f", "sighting--706436a6-7ddc-4f43-b20a-a989eda271a6", "sighting--a7f05c45-0b5b-43c6-bca6-5ee20c34d568", "sighting--70ade41c-f939-45bd-93cb-df607e0d5e04", "sighting--c91789ed-26c3-443d-848d-28d89bc9c666", "sighting--cfa61ea6-51da-41e8-bb1d-5c34c82d51ce", "sighting--c18bd64b-c7e0-4f88-8099-5de9d8e495a4", "sighting--6e767377-e566-4b37-9fc6-5d224b7c3c17", "sighting--bf42ee33-7174-42e1-acf2-4ab963a05274", "sighting--db34a7a7-c447-4f1a-90e4-922e3d3a62bb", "sighting--d349ce40-fbb8-40ce-a2a9-220ae484995b", "sighting--49d20df6-7b0c-495e-9c7e-d98b82ba8f73", "sighting--7f7b576c-b762-4d30-b7fb-b19894772ae8", "sighting--c0080015-de2c-4aec-acce-054410aebff7", "sighting--828e6f3d-34f7-4aab-aa4f-91630febaabd", "sighting--48502b94-ea5e-451f-a1d3-9f3c6616334f", "sighting--68bed35a-a00a-4402-8cfc-c75931a5d383", "sighting--00f198ba-10f2-4e97-972b-a36cbea79b35", "sighting--fb40202d-81be-4e89-9468-629d61abd46e", "sighting--f0242465-2110-4736-a64f-cc11f436651f", "sighting--769f28a0-a3d6-4e7c-877f-b94c9b866b35", "sighting--175a0af0-18de-437c-b770-dbed54c99eeb", "sighting--f54439de-12cc-4768-ba98-d6a0105315c6", "sighting--036a1503-7b32-452a-8f0e-422a4ca60eb6", "sighting--5d312912-18e8-4a5d-b8fb-43d0373462f9", "sighting--4665619a-b4e8-4ced-a108-5373a996a7a1", "sighting--13216310-efdf-4d81-b334-c04bbc9f6094", "sighting--d83b48dd-a6b0-448a-9cda-422cb4bb9eae", "sighting--0deede35-3a2e-46d2-a158-4361392ee37d", "sighting--477f37c2-38f8-4a8a-9b8c-f1794a323887", "sighting--c415fb03-c79c-42af-8f97-9af350a73552", "sighting--b936d55b-5504-4084-a1c8-9885e12bf06a", "sighting--263eb0f8-18ff-4c70-8d41-a65f2fe51b26", "sighting--656a6015-c5ae-445a-a689-002492b1fd8e", "sighting--4d961123-4611-42d4-b742-b69e712e27fa", "sighting--4c5d4098-2af7-48ca-be46-8b57e008dd92", "sighting--23bbd65b-1206-4ebd-b9da-6aca8476e317", "sighting--fcfe02a5-d596-44d0-a93f-42634be88e6d", "sighting--093f9e46-c27c-4092-b9ce-dcce4e55648a", "sighting--33118b88-e1c4-47ef-8219-9f1c04556703", "sighting--7e441bfe-2e3a-419d-9a58-2980919fec79", "sighting--f3955090-81f6-4682-b023-64aebfb350bf", "sighting--c5728665-c2e5-4b36-8566-7db9339cf50c", "sighting--6951ee93-57c4-418e-8a65-911cea2e8c3e", "sighting--1afbf24d-b422-4dcd-9874-8278a65385c6", "sighting--2c5bc360-73ce-4b7b-a34b-318104be33e3", "sighting--d7ef208c-f841-49bf-820c-00661a976d20", "sighting--884aa9b4-baab-4f1c-aa2d-68d13e0c19bd", "sighting--341d127c-4fad-43b1-9149-3593f29f5160", "sighting--a52157a1-b359-431d-9554-8dda080547e5", "sighting--85f65391-8b09-4867-b405-0222c2c29903", "sighting--90704df8-b1f8-4194-b999-84541c4e3120", "sighting--f2c9def4-8eb6-4573-b170-0bb6ef65f7c6", "sighting--75b8dafb-d42f-4123-b65b-ff3b0f31cefb", "sighting--59a754dd-578f-4eae-b6bb-2d3b69f41074", "sighting--8586ccd3-54ab-4e75-9cab-79d7c281cfe3", "sighting--c35b5b04-2582-4237-a542-2052a16c8df5", "sighting--e33f718d-fb19-4575-a0cb-e05514b14555", "sighting--a424b668-1588-447d-b3e4-c2b3a6c64c9d", "sighting--e1adc48c-4dda-4180-8435-9a67a9870dba", "sighting--16abbd53-8b8b-4b21-a09a-5e3d56e2be0b", "sighting--0864afd2-fa32-4279-8b95-14c0916c47e0", "sighting--d290c190-0b53-4c7f-810d-7f07e2628ce3", "sighting--d6c99a82-f2e8-4a68-b81f-676095abced9", "sighting--6ff948a0-703c-4133-a9a0-ba0d0feb6f1d", "sighting--7deecfcc-daf8-48d1-9a11-83232a8bfe60", "sighting--434ec40d-6e00-4262-abad-28cc34a25bbc", "sighting--bfa18140-e986-40b3-ad9e-152dcf137380", "sighting--60690af7-d4d2-42ec-b28d-a36116ebc050", "sighting--1f2fe70b-7dce-4398-832b-60eaf8d04106", "sighting--938c4062-07a3-467b-a10e-27f7dfc71159", "sighting--a09b8216-b7b3-459f-95d0-bd503e079f0a", "sighting--01beef95-2069-4a5e-90fe-4e3e915f8249", "sighting--1799cf0e-e0d4-403b-9c0f-6b58e9b7fefa", "sighting--dd1d26c5-e9a4-4b4c-be5c-5267d1b9bfd6", "sighting--bbcedf2b-455a-4896-b4f2-486e9a42a13e", "sighting--0cb9a20a-6661-45e0-8102-1a362d60199b", "sighting--d83b6e46-66c7-4ae4-995a-ddc342a0659d", "sighting--23586888-7f41-47c6-aa87-55b81a630d66", "sighting--8dae93d6-f494-4780-9cd4-bf62758f1246", "sighting--d72b2600-92f8-4f69-b1e7-702781ec62c0", "sighting--6d578438-ef33-4d12-b29b-f10f10a2276b", "sighting--94fd8e9c-334c-4ce8-9a4c-8619b037d72e", "sighting--57df3737-d3c5-446a-ab35-ad3b9980834d", "sighting--c264e775-d44e-4d5a-8cfa-163e19cb3dc1", "sighting--6a51169c-c525-480d-9b8e-a83ee3187a7b", "sighting--a581e41a-ad8f-41b6-ae0b-d7958756d12c", "sighting--cc3afce9-6c7b-4561-973a-a203644b3065", "sighting--c6525f7a-f169-414c-9465-41e4a6e54e52", "sighting--b390aea6-2899-4f6e-b710-e8abbd810d42", "sighting--a549599b-af4e-4c78-a25f-facf8f1ed128", "sighting--4bb4cda6-edad-4ff3-a52b-ff22bbc3ba77", "sighting--ab5487ca-3e87-4298-93ab-2422fd500f8e", "sighting--2b4d2ee6-bde1-4154-bffb-92ab53a91eb9", "sighting--11686fe6-49c8-4128-a62e-2f2a2a280cd9", "sighting--c0cc9c28-9b75-4d16-8810-77ff5eb13df5", "sighting--358d32d7-9818-4325-817f-7038f285d470", "sighting--97ddbd58-37e1-4e5a-b690-fc807587b226", "sighting--fcf2bc3f-e1f5-4412-be47-b8bd6248cc99", "sighting--17c13be9-65b0-4e78-8e13-2c2090483677", "sighting--ab5c8ccd-751c-4f63-a460-b94d666ba621", "sighting--a5722998-ffe2-456f-9cf2-c638b63e93b5", "sighting--906f256b-3553-4f6f-8552-f62906cbf587", "sighting--b50ef08f-efb6-4e29-9256-01f42a7eddc6", "sighting--feac0ec7-4618-453c-9cb3-94b9bb013f32", "sighting--fc579ecb-9662-4eff-85e6-81a307dbe4e1", "sighting--77882409-7885-4a6d-816c-cdb4aa3e005d", "sighting--bb13017b-3bf2-4517-9afd-66575869f00e", "sighting--5ce71ece-2331-42ed-8397-cbd14fd20175", "sighting--a6ba1818-8d28-4901-be90-152e2ba67c13", "sighting--8a2ea41a-4742-4386-8965-2c33196c345f", "sighting--b0a480fd-fb2c-4165-92e1-8c09d8140521", "sighting--4d069de8-f803-4437-9d43-17cdb1cc35d0", "sighting--f730806b-dbe5-4f32-86f5-2a90f0036be9", "sighting--4dc33f51-8102-48f0-9961-53f455996561", "sighting--2256e5de-ad03-4dae-bd2b-a328e2ee2e6f", "sighting--6279a4bc-467d-41f9-9cae-da7e82794a60", "sighting--79b960f9-db0c-44c2-b54c-f440fbf03ebd", "sighting--eeb5c240-b979-4b4f-96e5-73f413496bc1", "sighting--6abe75ec-7efe-4ea8-8d0c-2f03b9b591e2", "sighting--b3a51680-3213-4b12-9e3c-a1bf68cc0b7b", "sighting--828a05eb-9bcc-4227-abd1-81ae2abcd748", "sighting--fd17d67c-7ef5-4f85-971d-8472c4eaa987", "sighting--87087007-d1a5-42d0-b2dd-89c71b0eb30c", "sighting--d6080a83-7de8-418a-849b-d2c507d78177", "sighting--4a22cb37-68dd-437f-a6dc-1ae161d0036b", "sighting--39a009f5-afcb-432e-8c5a-cb946d09b21f", "sighting--e4db7ffd-160e-4b1e-8172-757dc90934ef", "sighting--492c1707-a072-461e-b88e-d2bb58363f79", "sighting--8db319e2-d52a-470a-8e30-b6ababa18801", "sighting--1837d6c0-d862-481c-90ad-eb031d456758", "sighting--0e0d3080-da6e-4669-ab28-bc67cd100caa", "sighting--959760e9-538f-4e30-8838-d92137ab6b0a", "sighting--bf0af96c-05a9-460c-a168-72b37d85e3d2", "sighting--6e51f395-c896-4dbd-910b-be962540bb8b", "sighting--56f97487-4d00-4d20-b89b-e351cf69d6fa", "sighting--3c4fc019-899b-43c7-8670-fec4023384ff", "sighting--368d3f34-860a-406d-a161-5e91d90afbf5", "sighting--5ae2f269-74a5-4551-ae02-025cab9f4692", "sighting--afbad006-91e1-4fd5-82af-f50e6ad19812", "sighting--763564ab-4f05-4e11-a68d-d9fd8950d33d", "sighting--8ea30164-58b5-4d89-8eff-4315ce6e7da5", "sighting--1f5a5869-dcd9-4cb7-9aef-54af8d731b53", "sighting--126c0af5-abdd-4d62-b023-6550c1060390", "sighting--3f69db61-e01c-4c5e-9965-c5878f524ac7", "sighting--49815b71-6ca7-4e7e-bf48-21d5ff5492c4", "sighting--e3e041f7-a479-45a6-a6ae-92f80f8030ff", "sighting--61b2cfa4-6785-494b-a445-a3452c038fd2", "sighting--4da4ec95-e2f2-4e7a-b2e4-bbab74e0a68f", "sighting--3ac75306-4d99-4e89-a83f-4e8ed46c889e", "sighting--39b0cdbd-5962-4bbc-9b56-f4ff1fc9082c", "sighting--564274c3-32b7-4d6c-9cb4-7ed863cdd7c3", "sighting--2f729464-a4ad-4ca9-9bb0-b8e3c9697da0", "sighting--e2f68752-4077-4cf7-a9d7-79a1770ed12c", "sighting--750f22b3-7b28-4798-8009-19e8b1b4029f", "sighting--1ce3d869-b6c0-4b74-9813-9bd51c9099f2", "sighting--0d7b7f4e-e8d0-4486-a595-a7d8feb9fd73", "sighting--3739c621-c2ed-443d-94b2-50a672a1c2d0", "sighting--827fc6fc-0d1d-49ef-b52e-b458e17a1879", "sighting--c10dbf12-79bc-47f2-947b-a469d43f0a44", "sighting--452853f8-07c3-4b0f-9614-565115f9606e", "sighting--62a66539-acf6-4a99-bc7b-7dc6c1845379", "sighting--7dadafeb-fc77-4fbf-ad59-89204369965c", "sighting--e226cb01-cf3a-4fe8-bf54-e81fafb4c4de", "sighting--0bcddd75-a73d-4264-9f54-896c0645e18f", "sighting--7956316c-bcaf-4ecf-80fb-ddf41b041ef0", "sighting--58c2e3c8-2153-4979-844b-8a9c619725e3", "sighting--3e6564c3-5003-4552-bcd4-1cc329a803ee", "sighting--fbe8f158-b36b-448a-9d55-6c9f74e33c56", "sighting--4df53293-d4e5-4e2a-8b87-33e3bbadc2e1", "sighting--bcc03fa2-99bc-4d97-9b56-8a6f57878d76", "sighting--4afe105e-6292-4a86-acfe-cc9fbcda1021", "sighting--974da63a-6c5b-4d8b-84c9-c91f524bc48d", "sighting--0778d16c-96df-4e93-ba1f-47e3bc5266f1", "sighting--fbd7ab59-1fac-4659-b739-3e1d905136d9", "sighting--aa58a63d-771d-47ab-9cc7-879bd85034dd", "sighting--e727c146-df18-416e-8f79-3e26464a3be5", "sighting--d8dd7bea-481b-4629-9c04-1ca80e528507", "sighting--4593f5f5-c74b-4991-b46b-fa90013a636f", "sighting--9fbf0072-c2df-4072-87f4-8e6b309e34a2", "sighting--995cc640-a198-487a-99e4-e43e65bd27fb", "sighting--ef43fc9f-e168-42af-8e51-0761ef6fa203", "sighting--5a3c6275-1524-407b-9dbd-b22e855b38c1", "sighting--54e26e81-457f-402b-88c0-9248f780f7ff", "sighting--d8ef01ef-0dfb-420d-b6e0-117c4026d527", "sighting--6fd1a31c-a27a-4742-bed8-16de4da5864b", "sighting--430ae8c2-435c-4c64-b942-3792c11813b4", "sighting--e8980a88-80fa-404c-b63c-f64b342b7431", "sighting--dafa2a50-8a5b-4133-a426-eed46a3fb1d8", "sighting--8314ffae-664c-48a5-98c0-c6d97305102f", "sighting--61beaa02-c166-4d71-bc0a-b556396b0df3", "sighting--c3c24a60-e699-4f84-bb07-3f961a86ae96", "sighting--92fb5c8c-f979-47d9-a04b-f7e32d017738", "sighting--23b28702-0566-4215-beb3-0dd03de82749", "sighting--6c60a0cf-288b-40b0-8283-b0ca143df472", "sighting--2b65e23b-ca35-40c4-b967-faaec84277d3", "sighting--8b1b94bc-ea94-488d-8fb8-2b7bfcf8be67", "sighting--df4934cf-59dd-4ba2-914e-8ae2ce24bebb", "sighting--06e93ecc-482d-4c5d-a10b-5ec714d425f5", "sighting--75eb6689-d0e9-4368-b019-3bbc104cb3d1", "sighting--6944f912-f68a-4daf-9004-c3cd2e2d8403", "sighting--ad61526c-ef93-4a0f-adea-d0612b67c171", "sighting--f62572e6-d35b-4523-9167-1d3deb6f4456", "sighting--bc909484-4165-4164-9e12-bb39e7b5cc0b", "sighting--6d75ea0c-7a26-4f15-9cfc-45f9cba4d2a4", "sighting--c9f426b9-e283-47ad-bd4c-97b7f1587a0b", "sighting--f50fff13-b47c-400b-9962-30c831e7fc40", "sighting--0d11957a-3123-458e-9945-edb13fe2930b", "sighting--4d494073-7c1b-4c88-a214-1793363a3283", "sighting--c30cacfd-b57a-4533-a5be-1b7ea0782f47", "sighting--2c3bc7c8-2734-4fa2-b71b-e3803ee209a9", "sighting--464ca918-defd-412d-b812-53686deb3da6", "sighting--2bc4e627-fca0-439c-9472-f54a399a5abf", "sighting--d5390359-00f8-4e50-91bb-387dac495fdc", "sighting--2c4f46ab-0a4d-496e-94f5-8b48cd746f5e", "sighting--e5b204f0-4291-4492-8b47-0c5709a536bf", "sighting--05c8997c-e359-4756-9259-14cfd3e7becb", "sighting--994d2063-efdc-4f42-9b5c-96db1fdaf9ec", "sighting--72427351-8d56-4235-8b7d-30b4172ff1da", "sighting--737c7f19-eb7f-478f-988b-00c27330f80f", "sighting--350f7cdd-cd56-4ae2-a26f-0af713677b68", "sighting--954ebecb-c8d0-42e9-ba40-29e1d33c2219", "sighting--64f820e9-4a32-4b51-a1ad-d6cccc7896f4", "sighting--72cac5b1-2000-42cb-8c0e-7b7cb3c06485", "sighting--0aa80f26-dcec-4f40-aafd-c30c9d1945bc", "sighting--954a05df-a86f-4d20-b19f-ef4e8c116f2d", "sighting--7897842e-b002-4f2c-813a-0266ad064b6d", "sighting--736fe431-b959-4313-84a1-20934100e5b2", "sighting--250601ee-169e-4af4-ae08-d8c7bff8b647", "sighting--838bbd72-0cc5-4130-9750-7405c088e8bc", "sighting--e8533506-20c3-4839-bb02-be92847a8864", "sighting--bae31e44-0e27-4707-92de-dfb9d7c51e8d", "sighting--9f3cdec3-5958-4afd-967c-a613736235ba", "sighting--435898c2-7f0e-4bea-ac3b-45a907337687", "sighting--a9599de9-377b-49e4-8c46-2d3d0b734c2c", "sighting--85306fff-0128-4276-bf72-480887607092", "sighting--39e9babe-acf7-4dab-9a39-4e60de6b3dbd", "sighting--9c2ae23a-3b58-49e3-9b36-cc5e3844960c", "sighting--c183cc4e-cdb5-4ebd-a5b7-1754ee132309", "sighting--ab12a8ae-f3f0-41ab-beb3-cd3476f2abfb", "sighting--dc4b2df7-f2f3-4ffa-983d-a994f55864f1", "sighting--46aaa856-9d6a-417b-90c0-a90002f3be04", "sighting--f566e83a-b79e-41f7-9c27-7d3a9d7e8a09", "sighting--7f7560b3-f944-4b3a-b227-ffb25ea973f1", "sighting--fa7f4d21-24c4-45ec-8f1e-5a4918624c7e", "sighting--ac7dcf51-0d38-4a26-a0c8-afdfc7dab54a", "sighting--b55cd490-4f9b-45af-954f-4aa7e15c4cb6", "sighting--3018933e-90b6-43f5-b718-fc6b15266009", "sighting--a5bd8609-2696-42f2-8645-063f7d32d574", "sighting--ddb56d46-4151-45da-89f5-f0a42dadff60", "sighting--949838a2-6e92-4b68-ac2a-2a339b4dbc4f", "sighting--5501f097-d986-4cd8-81bc-2476e5a55164", "sighting--1c409cc7-941a-447c-8284-91faddf95887", "sighting--3edf7d75-9dae-4cf0-8187-cfce3700ab58", "sighting--ab6e1daa-b2f9-4058-8f30-f075702e87d9", "sighting--a7030b51-6def-43e4-9df0-9c7134425635", "sighting--14103c4f-282b-4487-a6db-c4e24a2639a0", "sighting--2751ebee-f3f4-4b2e-9cd3-ae3b3d0f1aa6", "sighting--b91638c9-4ad1-42ff-873f-734cd28de739", "sighting--7df4b694-4b3e-4859-8748-a391139bd779", "sighting--2356ca98-08b4-44aa-a7ba-b18c3f21bcd1", "sighting--78aba4a0-66fb-4370-8399-8b3f57bbf3cf", "sighting--116965aa-3c5b-4f38-9df9-2a451a41a9bd", "sighting--316a26f6-190b-4862-b7af-68c6571da1b5", "sighting--0446d482-ac9f-4c54-a700-4121ac458a3c", "sighting--c536aaa1-bafe-4a5f-9434-a2b3e75a722e", "sighting--f9140b18-4658-47e9-b100-cffec3645303", "sighting--d72e10a3-30c4-4a16-8a3e-af990e6bb288", "sighting--723d22be-2db6-4aa2-9aa1-f881a03242c2", "sighting--b2a645d4-da58-4c37-8cee-f7488b68da83", "sighting--616f4dd8-8544-4503-b73c-afad8484fabb", "sighting--c9e6d6a5-4d5b-4e10-b96a-86e2c687eeac", "sighting--84b32536-c33b-4b62-b387-e31451eee66e", "sighting--43efba1e-297f-49e9-8882-d8374a7e5e7a", "sighting--c1e16eaa-9bda-4051-b263-82405adb5dbf", "sighting--8f4cb9fd-c150-49ec-849a-408ad6f73362", "sighting--bf59cef8-cc03-4003-90bb-0513f337d462", "sighting--60ffe140-6ae7-476e-a1dc-2b9ab29039b9", "sighting--d23d1d4c-0a35-4135-be7e-ed9613d36c59", "sighting--1f55e762-a4ca-47ac-b8c6-63cf5396783d", "sighting--bcce77fc-ebcf-497d-b232-50b6b89e78de", "sighting--a38f498c-ba51-490c-a3d3-d7fb06f4bab8", "sighting--2d7017ed-8783-40e6-9ea1-44d75eb92b00", "sighting--871f4c64-ecd3-4066-bda7-93159e27d4dc", "sighting--df906978-59ba-45c3-8742-f71bc6a3270e", "sighting--295faffe-580a-4d7a-bb5c-2df1e79c1c70", "sighting--51459107-6f46-48fc-8e97-0c0a15da45c8", "sighting--8bcdaaeb-25cb-4980-9e92-6301af13187f", "sighting--129d28b4-719e-41c7-9542-5c02b88fe62e", "sighting--f5630656-979a-4fb9-869e-fcca2b3200c2", "sighting--cc716ec0-fcbf-4719-9281-1b2c7b13b98c", "sighting--036fae14-4543-4b96-bb1b-c165a247f2ab", "sighting--c1b84a39-ad64-43dd-9099-18d524fa290c", "sighting--977d2962-23a6-4f67-b4ca-0f245787e953", "sighting--fe91bb8b-5d59-44cb-951b-bab4db6a98b9", "sighting--93a59b83-06f0-4b6a-aa9b-eeb0d7799c5a", "sighting--b3130f5d-7ae8-43f7-8d72-2a1d8d4e308d", "sighting--c5a60754-0834-4c88-a3e1-d42fb2e4933b", "sighting--54056fdd-0eeb-456a-8b4b-56734d01c4da", "sighting--f5808058-b5e1-4763-a84a-79c74350a9b4", "sighting--245bff63-d639-46fb-be7f-276827a49937", "sighting--42d1c729-45ed-4f36-a0fb-3d8a62eb2df5", "sighting--6b471d9a-2962-4b51-9526-f2e5ad4d6f91", "sighting--816e6fb1-9268-4da0-b0ec-929bb38e5f0f", "sighting--34373654-ddee-44ea-9c91-31166d205c3e", "sighting--db87590c-d081-4267-8570-06ff804eb3da", "sighting--338a1615-12f0-4d7a-8040-c60abac0ae71", "sighting--b83ea7dc-7ff4-42d5-b7bb-960580238c88", "sighting--32662651-e113-40a2-a29f-345284a42cef", "sighting--5d2d588d-8fa6-4dce-9ae1-0b3bbf79e54d", "sighting--51cb3f39-75f4-4d67-ab0d-9ad9dbbd7e9a", "sighting--56f38645-da97-496d-8d19-bc90b1e8da17", "sighting--b72d92be-f6ea-43c6-8c3c-9f1d4bdc6442", "sighting--6f04b6b3-1b83-40e5-9a71-e6341fbe7996", "sighting--5f418f94-ba75-4a57-a1f0-7aa2bcd22a7b", "sighting--9f9aeef7-79c1-4a43-9e1f-e33652f58f49", "sighting--cc3dd072-e56e-4cbe-8c95-4f1f2c61ad9a", "sighting--88c06534-0619-45b5-9529-865a93ca06ed", "sighting--f7425486-b5fe-4454-870f-5ce525b28af1", "sighting--05b13f22-8ba1-4a08-80f8-fc6d910fa982", "sighting--f2d07411-54e1-48e1-be29-b113ff6c6148", "sighting--ef99cde3-048c-4522-9396-190368382e7e", "sighting--6c444862-5cc6-42e8-a6de-914f3d3f4025", "sighting--5b1abd1f-5371-4af6-91ea-dd60d20c0946", "sighting--d55fd220-5884-4f69-8be7-b65e3ecac0c5", "sighting--541ffc0f-77fa-44f1-828c-f9a10e586739", "sighting--d9cff51f-bdc9-4b08-8a4f-e177fb3bfd77", "sighting--850a1be4-3958-4369-9806-8191e14ac36d", "sighting--e4ca20df-200e-4ab0-8c12-7e121e5c49f3", "sighting--4afb6a30-f2ed-470c-b143-ea2768c3e2d9", "sighting--8de50def-4fb5-47f4-887a-45df4f500572", "sighting--559a8260-e4c0-4196-b0a4-b81314202e7f", "sighting--f3a857bb-b632-4ad4-9701-54a25a9b9896", "sighting--d2387c2a-de63-459b-9a11-6492b497f119", "sighting--496fc530-46f3-48bd-8305-8ff56df48d33", "sighting--6b3ab5b9-8b8a-4e88-a6bb-7f806972f526", "sighting--5c64950b-e873-4afb-931d-56678dc3d5b6", "sighting--0fc93a52-aa23-41f1-8929-e74c6c3ff412", "sighting--88d197f1-e441-47cf-a99d-120420a59622", "sighting--25477c25-9883-46fb-82e8-7d35c1ead12d", "sighting--2cfbf3ce-de87-48c2-bc61-024a55e5fbb1", "sighting--d508d763-61ad-4b8a-9808-c5a07bfc1cb5", "sighting--cf1e1efc-1ae7-412d-8d4d-bd0a451375b7", "sighting--6a4ee0cb-3fa7-4eaf-a7fe-d5f04516e837", "sighting--62bc0207-0317-4a9f-964e-05b84bd8382a", "sighting--3a008d4f-2a9a-4bfd-9b34-79bb2b3aa153", "sighting--6c0b119a-cbe9-4645-9433-cdcdaa6c112c", "sighting--d01de22c-ae9a-4b51-bf9a-553cababac56", "sighting--38982beb-affb-423d-a3bc-5f4a4b595177", "sighting--b7f0790d-7a35-4ced-8843-09dcb36d570f", "sighting--bd61612d-41d9-465c-a910-fde40889c2c7", "sighting--61309d14-9b5f-439c-a88c-81bd9ec78959", "sighting--e6705d54-48e4-4a11-8847-b581bf071fb1", "sighting--5b1d90b0-12b7-4794-bc7f-352bf930da3f", "sighting--22c03d7b-8ca6-45d4-9ea1-7cedcea84ca9", "sighting--7ea9bb92-5290-4e1a-aada-5bb1c38f96fa", "sighting--b0ef9337-6afb-4e0e-a2eb-802891e17431", "sighting--adb01c49-1293-4f9e-95ec-34593f9495ba", "sighting--599b71cf-4807-49fb-bd42-66ceedd91e1a", "sighting--256c37c2-af56-4af1-83a6-5874154a39cc", "sighting--65236548-4094-4506-8e44-50492854bcd4", "sighting--cd1376a6-5284-4365-80e9-812073cca5f9", "sighting--dd65917c-21d7-483a-8944-aa86489ad0e7", "sighting--c94185cc-ba8d-4da4-b048-63d15e657755", "sighting--0c8b16c2-4013-4f20-822f-99e6a5dd838f", "sighting--21348ffb-fe9f-495b-a84c-7839fa70cb6e", "sighting--6481de74-3ee5-49e8-8349-9684a4545b0a", "sighting--bd0d75be-2589-445c-9e16-55fccb1f3af8", "sighting--afa8cbf1-f850-4b9b-bb93-2859f1894767", "sighting--ee4af780-f59a-4390-8654-1a86455191df", "sighting--6a62d8a8-2905-4ea4-b979-3e0b96d4d561", "sighting--b1a8afef-6b01-4f8e-925f-9dd0a4df2ff3", "sighting--ef97c462-8d2e-4132-b62c-8d86ea300a67", "sighting--bcc2ca69-2407-4091-9aea-bcffcd0694a6", "sighting--04f1576f-3301-496a-8ddd-c7625d683530", "sighting--5aea3624-d16f-41d1-a923-58d19a731caa", "sighting--d549be44-b215-403c-bffd-ca00331304af", "sighting--e3c73371-b69e-4594-8dc1-401169da911c", "sighting--eb4d9122-9b21-4377-9d8f-e02fb84e4449", "sighting--6584ef57-5c59-4e32-96f7-07b6e8d88c85", "sighting--6cb3930e-b3fd-4f2b-8378-26fcc08c1c9d", "sighting--88d29cda-43cf-42b0-b608-a30cb88b7c13", "sighting--59c17aa1-03d7-4780-a6fa-051eb2226785", "sighting--6b213fee-1a0b-43ac-a959-4cff79c389aa", "sighting--62fcabc7-e547-4a48-9306-f49dc30cdf51", "sighting--cabebe57-b555-4a22-9e22-9265f8219e93", "sighting--54ab0f16-54ea-41d0-9510-22c739a24489", "sighting--32c0b3aa-eea9-4637-baf7-26efe4390463", "sighting--af8a07d5-1484-4f4c-a7ee-0f5fa691d509", "sighting--f54795f2-2469-4c24-a5a0-a8eb94d9c556", "sighting--a38439ce-8368-47a5-afb7-f61a0e237715", "sighting--4e4dccf1-1a65-45f4-a678-3dbac3a2e5f5", "sighting--f7510b85-406e-4e52-8d5b-9f4c381d07f0", "sighting--22e11e85-c5a4-4273-8bf6-99aca949d3c0", "sighting--68cce56f-fb8c-4daf-9dd3-28198bba3e56", "sighting--7a9881ce-83b5-4540-9076-1a1dcadecedd", "sighting--b5736f68-284b-4756-ac73-3ee43c3261f5", "sighting--5deaced7-55fc-4f12-a83b-51c418b528f4", "sighting--fde0c5e1-736a-41a4-acc6-4dacd04174a6", "sighting--0ba57474-1899-4d35-92f0-afa83c38062e", "sighting--4d6fba6b-a947-4016-b352-10410da5a744", "sighting--0819b5c4-7a5a-436f-85c6-4f333446d330", "sighting--673dc872-5455-4ed6-af4f-67fe8bf9ea23", "sighting--41c0b0f2-aa33-4615-bfcc-a471376976e9", "sighting--3510987b-328a-48c3-941c-c5d359c0d5fe", "sighting--ba02b8d0-f0a6-422f-9a6d-68992155c63c", "sighting--46a3774f-a1b3-4680-8c8a-336c1f33bd24", "sighting--28e4ec22-5fb5-4f94-b17e-deb992bfe4e8", "sighting--1b3a8934-62f7-48f0-beb1-23ac61ab75d0", "sighting--504d0635-5fe3-4959-8d06-a337fb014a42", "sighting--8711da33-822c-4afd-8bed-77d10d88e8d1", "sighting--097802c7-0c4d-43a0-bf69-97d0c622efe0", "sighting--c9993218-b8d9-4bd2-ae9d-c8a19be2491a", "sighting--c33424fa-d056-40cc-afb8-3c217abcd3a7", "sighting--275487f7-b9e6-4222-8370-d8a6c21376d6", "sighting--981463f0-f152-423b-b548-97ccccbba236", "sighting--dd978adf-9ad7-4369-8f9a-dd919fe11a2c", "sighting--d3efdc96-0900-426b-b669-3354b4ac6cd0", "sighting--78243a43-aaaa-4c0b-8e22-fee5280d8e71", "sighting--5ef7c708-eb82-4111-aee1-f5803f3153a0", "sighting--2878059d-00b6-4f42-98d4-ed87447e2ed2", "sighting--8e2b7623-2b26-43ed-9f82-8982de1d4ba5", "sighting--ebcaaf10-426a-45a6-955c-d5437664f3b9", "sighting--cb5bb371-f322-49ca-ab9c-cc998f9b8a64", "sighting--b598c9f1-4450-4ba2-a40c-1d647a5663fd", "sighting--a1e501ee-5f4e-4ce9-a86c-968113555399", "sighting--6bc1deca-971e-46fb-9fa0-c62104293ece", "sighting--bfa1c255-622b-4ca7-8dd2-5c0acc9a0a52", "sighting--35130926-1319-4ec1-8ad7-4e87b176e3c4", "sighting--9c21d2b6-9580-4d93-be21-daf9027eb61b", "sighting--f81a4705-ed9d-4f3c-a62b-3956a33e9484", "sighting--a4c806a6-3a62-4051-8745-8a46791605ca", "sighting--10eba5c8-cf25-4ac8-ae80-44c68272a934", "sighting--abc221c6-fbf4-4abb-ab0d-de59953e972f", "sighting--53825b81-9a8b-4aba-9359-7d05f1a0d114", "sighting--2a176ff6-24ea-4b4a-a26c-c1424701e05e", "sighting--85d808ba-2155-497c-81f1-6290fe6c33fd", "sighting--beedced1-b336-4c68-becc-9433daefae2f", "sighting--adde4299-a0af-4cc6-b51c-fc971bf8b299", "sighting--10950372-92c7-4c28-b6b7-c9fc1f79ed84", "sighting--be97e467-4b8e-4afa-aaa7-a93b561320e4", "sighting--76dba792-f182-45d9-8aa5-dcdde02a1e90", "sighting--cd0678ff-9f4c-46d5-9ff1-625d2131b0c8", "sighting--8f5e2920-5847-44ac-9245-9de456236c63", "sighting--17a6baee-ebb6-4abc-898b-b939e2e653ba", "sighting--6aed9d3d-d281-4527-bc02-649a5dc363e0", "sighting--9d4aa4b8-c6e8-4719-afc0-43af28668b11", "sighting--64eb98e0-a40b-4718-a632-7a2847080aba", "sighting--32df3bff-0905-42ba-8ca8-8206f125f97f", "sighting--ac8f0414-f078-4902-a8fb-93e40893bb1b", "sighting--d19c1698-eb51-4cc2-aff1-c908fc3091fd", "sighting--de2787a4-cea7-4cb0-bcf3-2ebbb21645f2", "sighting--cea9622f-2a46-4b92-b2f5-c3cbeac2eb1c", "sighting--03cafa41-589d-4e6e-a6bd-38c3a4773fe6", "sighting--0f5f05ae-44cb-4799-84a3-250b9f45ad0b", "sighting--72854bff-b977-4c47-8533-433a5c90439d", "sighting--80423564-04dc-43f4-944f-f45859cacb61", "sighting--37fc73ea-45fd-4c99-80af-2b616b5e8181", "sighting--2169e78c-ab77-4dd7-acd1-f02c909006ea", "sighting--8f49b7ca-3bf3-46fa-8b3e-a3295acc9006", "sighting--c4df0d69-8430-4934-8fe3-6cb8d4887847", "sighting--477ab716-6598-4a36-9a4a-466f242bbefc", "sighting--dbb17adb-2d6c-41d9-b559-f57ce5e9684e", "sighting--d0c48180-c858-4418-81f4-3b11b55b7461", "sighting--73cff37a-c6e3-49aa-bb4e-fb525fcb3d90", "sighting--8a65c28a-d4e1-4c98-a4fb-a4ebd2f28f81", "sighting--b3fdf7c7-7401-432c-99c5-ac9c46dac70d", "sighting--66522968-f3f9-4791-95bc-082ad00d2590", "sighting--8d9abcc2-1eb4-4cb2-be60-3523f335a611", "sighting--8d364244-d947-4cd3-9e19-daa21d51f499", "sighting--bacd3056-84e7-486d-b0bf-b73ab9f99fbe", "sighting--00497b0d-ffa8-4989-bcb5-9c048b4ee2bf", "sighting--8022ea7f-0c6e-46f6-9197-bbe7dade0e6b", "sighting--67732ff8-99b8-4b4e-81c2-53aef322cbda", "sighting--7e95463c-e033-469d-901d-9e183dad7cb4", "sighting--19b52e8b-d43f-4cda-adc9-d845a802efe4", "sighting--2273f26c-7047-4411-bafd-a136c56524df", "sighting--eb2df0bc-03ed-46b2-989b-d8c8c7fdb8de", "sighting--c1a8b422-f616-4814-bfa1-5775fa43cf5c", "sighting--d2d3f44c-67be-4b30-8a22-ab203997e6d8", "sighting--cea3b86f-5e5a-425f-b1f2-f2ec7dc533d3", "sighting--9cea5c70-63b5-4f72-ba0f-d71609fa0af4", "sighting--c99008e0-5dfa-40c7-9090-7ed54848e915", "sighting--d4608fac-7315-4194-8dfa-26e34b5e6803", "sighting--2cc49e22-0db2-4e8e-8d5d-ce776e55c87a", "sighting--65cb5c22-3c7f-4fcd-9ff9-0bc5d226bf29", "sighting--be721efc-7a1d-49d1-9827-ac8ad3a440d4", "sighting--561af322-9691-4c5b-9a14-b645358392f1", "sighting--2bc87659-baf8-4a16-b4c0-b3db87f8d2bc", "sighting--7910a09b-f4db-4de0-8223-085465a2069f", "sighting--bc063adb-2c6f-4e02-9e28-99601884c00a", "sighting--6054536a-98ed-4238-85f9-9df6667921f2", "sighting--dcf85519-41a5-448b-9873-a6b25ba170df", "sighting--738e9c1a-2881-49a0-bbbe-aadcc13d4bd6", "sighting--1694a026-4549-4ad2-b7c6-94f33d1b7771", "sighting--289010e9-46d9-43b2-927e-e87f053c26c2", "sighting--c60cb848-0808-4dde-89c2-8408b731bfdc", "sighting--c61db540-150c-4118-a1d6-2a42ebc1c647", "sighting--46fea95b-adbf-49cf-93ca-79d4c518af39", "sighting--601d509e-3420-4ea5-bf61-08a627bbce4a", "sighting--e37565ed-fcff-4964-b1d9-69a1fb13b507", "sighting--b4c2c25b-1c10-43ef-a4c1-29812000d740", "sighting--0ebf95f6-4016-49f9-94bd-de1ac46598d2", "sighting--239ebfd9-fbf7-446b-bc9a-78e4cb33cc68", "sighting--6c10f728-2d8a-437f-bfb9-473394356779", "sighting--80ea0a49-bc32-4287-a3eb-7efe42eeec02", "sighting--abce9636-6e5a-4e0e-8460-b6ed64ee61f1", "sighting--63f80504-8a88-48d5-844b-0cc9251a6cd8", "sighting--6422b5c2-c2b6-4c0a-a3cf-5dd271427c2f", "sighting--a56fd791-79b2-40ed-93e3-7f0e5f555972", "sighting--995990ce-f8ec-4929-a6d7-b3e932dbb8e0", "sighting--34be2f2a-7933-49ad-ac11-7ce9bd1d1925", "sighting--b9a00264-1d37-46ee-b894-7bc4fb526512", "sighting--33fd0603-3673-4278-9562-e891f6fb1fd0", "sighting--fe3250ad-4b43-4f78-9ae0-b1cec1bbb56c", "sighting--e75f8aff-c48b-4729-aed4-0760f4c0a9d3", "sighting--e926c617-1a22-4c94-904e-91d60f4f3ac4", "sighting--1eecc63f-f847-42ba-9997-21fb3ecd259e", "sighting--325357c4-c242-4f16-bc3d-f7048a2e0a2f", "sighting--ab89ed5d-a685-42ee-934a-2b93bb40028e", "sighting--96eb0b62-bcf8-4611-98ec-8542526b8d23", "sighting--fcef0346-2276-40bb-81eb-5014ed27c031", "sighting--b7cef240-83b2-43b4-aa74-33bf463c5fc6", "sighting--f847da46-62c5-4580-b2dc-257d0cac24e4", "sighting--f691996e-81ab-49b2-a26f-42cdcec83a37", "sighting--bda69d75-7363-4ef6-a9ac-1fc8e3d0e11e", "sighting--c0250f1b-9aa6-44b3-8a96-35bc3af0b802", "sighting--45f2b46e-cdd0-4222-ad13-88571b0eda0d", "sighting--09d5df59-eb29-441d-bae5-6f6b42853438", "sighting--a613fd4e-6e71-46c2-b7ff-47ef1540197a", "sighting--36df4e6e-00c2-4cc2-8e7e-6f0a557799be", "sighting--76472ae2-4d9e-4038-8354-ddc87ae69dd0", "sighting--f03e84c6-6109-4542-b048-b98eef005e6c", "sighting--40a1a9e0-79ab-479e-a05c-272b15bf20cc", "sighting--06d265d0-4d3c-4d43-9ae6-2ce35389810d", "sighting--e2fdc5f2-35f4-4c57-9d5a-eebca6c17452", "sighting--6db98826-c2b4-4242-a476-b958cec50516", "sighting--940dfbd8-a66c-41d4-94b8-c6dae89532dd", "sighting--523e50c6-bad9-4a05-a87d-443e10dce4d9", "sighting--d07d41bc-7da6-4766-9112-04b234bacfb5", "sighting--2f4a697e-648c-43c6-9fa0-d1db15634e0f", "sighting--8e3153ce-0f3c-4e62-88a7-81e1b1ea414c", "sighting--b89995e9-70e0-4d4e-9e9f-93e5b89076d9", "sighting--dc8fe37a-440f-4f10-b3f7-eb2073cd59a2", "sighting--dbcfb48d-f736-4298-b8f2-d62d475f9de2", "sighting--96f4ff6c-902f-4d61-91ce-da22401f7fce", "sighting--559ebd8f-b572-4f9b-a7b2-8839ce770155", "sighting--bbd0759e-007a-4e91-8a52-1ca23a678b7e", "sighting--4f4efdbb-59fd-4abf-bf7e-d4a257ec76de", "sighting--798a65a3-d233-4ba2-bd26-ad446d4b6dcc", "sighting--b81d16df-25df-453f-8b83-162960a9e69f", "sighting--44f8a3db-0aee-48d6-a733-714a34715750", "sighting--0f9b3f5f-f3a3-4b79-a009-2b4526b8cedb", "sighting--f3ce5ca4-f19e-4904-8685-c538ba9a024b", "sighting--1cf7c2c0-ef84-4e50-b7d6-b6d6376c7ecb", "sighting--5f7cdea9-aa92-46d3-a722-d59e2b6a94ee", "sighting--127ddb8e-0caf-4940-ada9-2e04912b9389", "sighting--7e0b0c93-4012-434d-a7d7-72992eaab050", "sighting--0eb9a22d-3299-430e-9bfa-dd559605f5a3", "sighting--c1732383-ec80-4b07-aaf6-b6d17e9d555e", "sighting--cf98ebcc-9d0a-4001-a2f6-f163cccda62a", "sighting--3fb2ddcf-c085-43c2-96e9-cbc0db746d0a", "sighting--4abeb320-8359-40a3-a297-a228209bc5b2", "sighting--4b595f04-a504-49a6-a5ea-32fa7873568f", "sighting--57aa5fee-b212-4225-9e23-a629e086edd2", "sighting--2e265f8a-cab8-46c2-a53c-f8e64795788d", "sighting--0d3901d3-736c-4979-ac09-97c889c3433b", "sighting--09446e86-666f-4756-9b86-016abe6c327b", "sighting--b76f8519-a477-4c8b-9217-494cc9b22953", "sighting--3de33845-d716-456d-9b8a-3a723435496a", "sighting--963c7d3a-3df6-4c4e-8d5a-ea7821538360", "sighting--63b5c1fa-4d9b-4ef0-9e60-75b33f6640ad", "sighting--4f1c954a-796f-489f-9677-903ede99b26d", "sighting--1ce9b7aa-1332-42d8-af5a-afb98837d028", "sighting--298bd4de-9669-4cb3-8f26-a0b1a69a7bda", "sighting--681e4262-2cea-477e-8343-72816d486f05", "sighting--00f9f22f-1a52-428f-89da-5bf3556f4598", "sighting--4b37a4c6-8c58-497c-af59-dc7f6446cfba", "sighting--a6927610-4799-4b9c-8752-ee9b91f5670a", "sighting--58efbf85-3f4c-4c93-85e7-47332a26a220", "sighting--52c4442c-1c5b-4c8f-a845-f4a4f445caf8", "sighting--f41b632e-791b-4eee-a064-3a9b0bd40d23", "sighting--ef834677-4471-4bd6-a4fd-53f0cee0dd84", "sighting--de2a4644-bdba-4352-a015-1ebc7bebbaf2", "sighting--4b1d6b5e-bd0a-44d1-be28-2e438604b692", "sighting--7b18fdf5-839f-467b-af8a-ca9fc11f5bd9", "sighting--78ff28e8-3d05-432a-9b01-948d0f87f130", "sighting--fb98a868-21a3-4ca5-96f4-d05e074380f7", "sighting--3f753601-0e50-4c82-b3d5-5dd219e13094", "sighting--ab1104da-92ba-42d6-a112-0a67c7f864e7", "sighting--718d3e54-8402-4902-8d2c-02028b9a8b96", "sighting--8d084b7c-ac81-40e4-ac8b-b23739b5f34b", "sighting--56fce60f-c3a7-40d0-81c5-cb409ddba2d8", "sighting--4c5784ee-cc70-45eb-ab86-24efebf7d827", "sighting--922db138-8b65-4f73-85da-2779f76f8e9d", "sighting--02f50626-4ed1-41a6-8b16-64d4a5de092e", "sighting--eba7a9de-e082-417c-b9dd-a5ccdf89b0a4", "sighting--6737b7c4-ac1d-411d-80c0-3fc8a7cae3bf", "sighting--cc34a7e7-ff8e-457b-9789-2e77a8d62f45", "sighting--2b967f2d-44fc-4a14-a143-80f9b789d6da", "sighting--b0758370-63d5-4626-9673-f1e1c8c44aae", "sighting--9e25c194-669a-45d0-b5fb-7ccba964b583", "sighting--a10e7eb4-0785-47d8-9a5d-48e28d4e5fba", "sighting--4a98a39b-0c25-4cd7-9155-7acda070d060", "sighting--1dd931a7-826b-4464-bf22-84a3a6ff77b2", "sighting--2b2dcef2-ab02-4c49-b55f-ce3420424fdb", "sighting--300e4ba6-8cbc-4e77-b8f4-039858bab5a7", "sighting--962008ed-b5a6-451a-8fec-0fe791b0b765", "sighting--efeb87ec-2a52-4912-8d0f-6d876f2b1240", "sighting--61cfbdb2-5173-482f-8fe8-d392e41b5dc3", "sighting--6ef75ccf-1735-4a78-ab92-253a2183ad4a", "sighting--c89967b1-5101-4f7b-97b9-773639b75b67", "sighting--1f2543ba-984f-4ec1-9d3d-42feab278d46", "sighting--c5f7c9fe-0304-43ce-b2e0-84a72d5ff82c", "sighting--927db571-ba1c-4724-84be-9d0579916694", "sighting--c82d5f66-f882-45b5-bf23-7d236805d49f", "sighting--d0fb9de1-de0f-44b6-a91a-6f38db59f809", "sighting--b10eadf1-720d-46ac-8799-969dc1d36dd0", "sighting--177f0f33-37fb-4342-9530-214087a0a9e5", "sighting--21e565d1-a6e6-4c3a-baa5-2deb4125caaa", "sighting--87ab92de-f499-4c9a-9934-ca0d98da8e41", "sighting--ae1d2c74-21fe-44ee-a1ed-61d669836bc2", "sighting--acb0df4e-53ea-4802-8e97-8ff33a836fe3", "sighting--bbacbb18-5ec4-4b63-b4f2-d03baca79909", "sighting--67adbf9b-cede-4ecf-8dbb-a7736961b5b3", "sighting--c5321d19-5101-4a36-ac04-5310980e1e3d", "sighting--77e500ec-4124-4bd7-8ded-631c165b3a7b", "sighting--6daf776d-6a9e-493a-b9a3-4fc6865509fe", "sighting--4011a578-9f95-4933-95a4-eb379a4fa727", "sighting--9f7c139c-3827-43f4-9f0b-a2fb89e42b33", "sighting--1751b4eb-140c-45bd-a8d4-2a7980c62793", "sighting--551b2a7c-4e2e-4c79-ae41-3d711261aede", "sighting--f43a4bea-d4e6-45e8-88fc-24140725f0df", "sighting--4e8145c6-b287-45d4-91ec-c03e37c8d3dc", "sighting--78a5b657-bae5-47d6-a750-7cd64add92e2", "sighting--0141749e-8bfe-4077-a55e-3db5bb242c43", "sighting--ddb05eed-5832-4339-9710-592f07443d94", "sighting--3431a478-d16e-40b9-b8b4-e109c79f241e", "sighting--bfd956a5-8303-4644-be25-ccf70f045eba", "sighting--e4e35f9a-cc8a-42b5-8b0a-94c4820a1fbb", "sighting--be950923-cb77-406d-98d8-01e0eb0a17e2", "sighting--09f5852c-6229-4814-b61a-6c1c7f94e67c", "sighting--9eb92425-46ad-4fea-926e-8fd7451df4b4", "sighting--9987a865-f032-4e11-889f-45c976c7e991", "sighting--5ca1765a-3e93-481d-8d63-e1f1365fdc88", "sighting--6de522c7-4dba-4ba3-8495-02d1816857df", "sighting--3df72df9-1059-42d7-8eba-f670df22db08", "sighting--b8ecf1d2-3c97-4759-b6e7-c88a47d0b5ad", "sighting--854d1140-68bb-4aa7-947f-ee8ef57df315", "sighting--0a491f18-5cf1-4f5f-8553-31b7ee0ebba6", "sighting--7418d84d-1e44-4ba1-b853-8b84eaef04f9", "sighting--700e503b-f636-4b05-84b4-c8873fb797f0", "sighting--842dfad5-80f0-47af-bb45-75954bed52e0", "sighting--0a4ad920-3d4f-4041-bc2f-21637e835d9f", "sighting--b8b6f416-a654-4daa-a07f-3ed35981b8dc", "sighting--f76d316b-6d1a-4b51-a2ad-86a0422c76fb", "sighting--f668deeb-f6e9-40ce-8e75-bcc1256f85b6", "sighting--cb9abe19-c6e3-4299-a94e-4f12ae6d7eb2", "sighting--8df4f85c-f633-4353-9cb0-8a2391b31ab2", "sighting--ca4ec797-dd7e-4513-ae20-296f70fdf796", "sighting--ff087c22-1052-4b4c-a7cc-2d1b6b826528", "sighting--5d59ae8b-a7f5-4b99-854c-e1e2f4a5f497", "sighting--52b4c237-d2cf-45a3-a438-cee64da2c7cc", "sighting--02a95455-74e1-4482-9b3d-3bc0d4e010fd", "sighting--49bd93a5-2016-4c9c-bb51-5f0542034561", "sighting--b2a50f52-20c5-4822-9f75-d272409b8596", "sighting--6584819f-5d4a-4d8a-8609-c8a4e4ab09aa", "sighting--bc00a969-d263-43d7-9995-904253535f25", "sighting--b71db026-da21-4804-b59c-8636fe4e3bec", "sighting--404f422f-311a-454c-850f-a99affea6e45", "sighting--d4031e3f-e10b-4f45-8224-d73a25cbbc05", "sighting--4d600407-0cbd-46ab-a96f-5582932a0f62", "sighting--edd6bee5-dc22-42d6-866a-236f00b252e2", "sighting--741a6290-9b85-4a24-9ecd-a10c7e3c277c", "sighting--9801275e-bb11-482c-8444-4d024aff49c6", "sighting--1e887f94-8b53-40e5-a303-835a692e0b9f", "sighting--92d3e85f-28ce-40cd-9c3a-726d43ff6f36", "sighting--b76de8da-9e7a-4a8c-9158-a86a878a52e9", "sighting--7c7c7463-c4f0-4557-8b31-cabccb040f63", "sighting--135d625c-8020-436d-8383-49c6fd71e66a", "sighting--a36adaf8-d63d-46ef-969d-9919a65c4886", "sighting--868da075-7a82-4566-8eb4-ee880a6fee0a", "sighting--1440a4f6-5ee0-4a72-852b-900d164cdc13", "sighting--526fdfea-f1cd-466a-8935-c68b875b7a6b", "sighting--bd9e761d-ecf3-4966-ace6-cb3b43fa11ec", "sighting--a9f5a25a-091f-4a6f-acd7-de4a25019e73", "sighting--480ec8d0-5485-4380-8a0e-1a9b2950435e", "sighting--896554a0-2138-4dcd-ab0b-4b6423ecf0b9", "sighting--bf695a87-ddb3-4000-b912-4218146ad8d1", "sighting--30b8451b-da46-49aa-b1ac-3397428ce943", "sighting--4040e081-05f0-49f7-b190-e914d6465b30", "sighting--a83f8089-04a9-4e7f-8b19-51f13989f5fd", "sighting--6e889b92-a32e-48b2-8f49-73aaba384303", "sighting--8398397c-40cf-4473-bd5c-533bf40486b3", "sighting--61a0ec3a-4529-4d81-a4cb-29a135c165d5", "sighting--577a7dad-eb45-42f8-9bb7-99c59cc5443b", "sighting--3a391d43-e1dc-458b-9d46-d1f1431fbedd", "sighting--7f2a9870-3596-4a55-884f-fd08cae8366a", "sighting--594ec68a-aa45-49de-96f6-ad31ac5221fb", "sighting--d8b839ff-924c-44fe-ad37-75a5fe601b83", "sighting--133a1e68-476c-4787-bedb-62fcdb774d5b", "sighting--ca66fe1e-21cf-400f-91f6-3123d4a811b5", "sighting--ca62310c-74f1-4f46-835a-6c15b831c073", "sighting--a9268125-e4ec-43c6-82cd-890b2173b994", "sighting--9feef238-5cd2-4ff8-b6c2-aaef74accf0e", "sighting--a78537f1-41a4-49ae-ba3f-a41f43a57f1f", "sighting--fa3f767e-760f-49b7-9818-ca9a5909b4a5", "sighting--2a79d382-8a07-436a-b992-18be17f9ace7", "sighting--672a543f-c833-4530-87bd-3292894284b3", "sighting--faf1046c-82d2-4911-9db7-0c4869d5f21a", "sighting--3dd647df-e9ec-4988-9873-95ff035aafd7", "sighting--b2860be5-dc93-4c35-9d82-a0f0ef94b59f", "sighting--f5e7336b-6f02-4653-9fec-a7e39f926f47", "sighting--c02181d5-0969-412f-a7a3-d0d5f147088c", "sighting--9a7e4388-4b41-413c-8f51-518d9ada4dfc", "sighting--a4722059-cf4c-42fe-b0c6-23501cfd1be2", "sighting--c41bd658-567d-42be-a695-5605a2fa660b", "sighting--543d8ffd-1bc6-4334-b393-c18311c7cb44", "sighting--94eb55b7-e3af-441c-8ae0-d7889c0f653a", "sighting--bc8fe35d-144c-4318-b15a-ad36d9970c18", "sighting--def45b60-e0ff-4ef7-8e41-baf1a4022f08", "sighting--5571cfed-3cac-4346-84d5-899b70873a5b", "sighting--26f6064c-9cab-4ec8-9d20-460f64a9d9b2", "sighting--40ad6394-ec42-489c-a444-95eefb0edffc", "sighting--dd6ffeb8-097f-495f-871b-4fdcc757f879", "sighting--1bcf36f4-338d-4726-a0ce-1a6867903e83", "sighting--38913654-9152-47d1-b191-169ee389ef31", "sighting--16ad4947-cacb-46b3-b7b7-d07a5231e4ec", "sighting--670f04b6-efcd-4428-a1ed-2888118bb312", "sighting--75d3453a-300f-448b-82b2-0337a3fd5c6b", "sighting--96095c07-7e81-441f-980c-1b214b6bbac2", "sighting--66f6570a-875c-4972-ae6c-8b87a88119b6", "sighting--df69e8b5-284c-485e-999d-eb1577c5a60b", "sighting--4abe8909-895f-4f2b-bfbd-71281962720a", "sighting--d8f95298-bb71-45ca-8746-a03ab8863803", "sighting--3cdf9026-e87f-4055-8ecb-2bc07b58cb95", "sighting--6e5b9bb5-3d9a-4e90-b54e-b4af2d53b9a1", "sighting--e71476a8-8dea-45c4-8190-5304b2a6c501", "sighting--4ad4f763-9f6f-4e41-a517-f1fc909b3e1b", "sighting--0d1771ef-5cad-41ee-bd01-a6e887f0f170", "sighting--837e5e51-1af8-44a8-824d-621d54c234b2", "sighting--e9056fd3-bcee-4bd6-8aeb-4d5a07c9784e", "sighting--d76d3fb9-7db1-4a3a-8723-dc4a15618382", "sighting--5d958746-810a-4f7d-b709-f2c2b207a948", "sighting--2fd6dce3-5016-424a-839d-8e784a079a52", "sighting--8317dc1f-c709-4508-ba08-d5a4cf156e7a", "sighting--7e9416a6-ed8f-4631-a8aa-784594f827ce", "sighting--01a80e21-542d-421e-9342-f520a2bac54f", "sighting--9f0ba80a-ea64-46b4-8e73-89f803c36c41", "sighting--0a6942df-670f-48a8-9fbf-c03543b5f3d7", "sighting--7ff9f708-392a-471f-8944-d2e4ea386eeb", "sighting--068e1820-2faa-4c01-bef5-857bb6ace70d", "sighting--53d6870b-f1a5-466f-8765-2a116c506fe0", "sighting--dea2729f-6a11-40c2-8d02-f4b7f0bebfbb", "sighting--571edd0b-cc4b-4448-b6e1-6e495272fd4d", "sighting--b42a0e4f-8470-40d2-8f86-e244fe1db4f2", "sighting--4abbf69c-ea23-4189-b1a4-18f992c941c8", "sighting--6696f5af-424d-477d-a8a0-fe76f5fd14bf", "sighting--43415129-6e97-43f7-943b-167b3a68c7c3", "sighting--5a680f86-3d50-4afb-8aed-ad4bd7991025", "sighting--bd6ec52d-5066-4022-88b5-a81bb1dfd2a0", "sighting--ba4bf80e-fcfb-4582-8d73-390da247496e", "sighting--a49a5cd6-ed20-478a-8efe-cf9814fc7211", "sighting--954a213d-e8ef-414c-90e6-421cde86c63f", "sighting--b2fd7672-6aa3-4f26-98da-b427aedb73ae", "sighting--328dd1e9-65d5-4fb8-9d4b-a3dd6c7a8400", "sighting--cb88f85c-7433-4996-87ff-0ee599d8f0f4", "sighting--2259974a-c0b5-462d-99d6-26a89c3b3d12", "sighting--dc52c6ea-4f2d-4f8c-abc0-ce92fca03530", "sighting--ba7ddd41-fd03-4e07-a7ad-f7911808276d", "sighting--fff2f543-3b83-4bea-87a8-a4396f0cb356", "sighting--e6817eb9-d7a4-4586-9a21-c79536ef55cb", "sighting--bbde26a9-3043-432e-b44d-37d1f99fa1a2", "sighting--1adf0298-5250-4d4a-85ee-3a9ede9bfe36", "sighting--28d7a731-9818-4f84-8eee-f9da3c92989c", "sighting--57cb8225-c3e1-42b8-89da-1d170564b3b7", "sighting--f6780850-3b21-4777-b46b-c7b3cd006ca5", "sighting--a6aea4da-5a42-42d7-9ffc-9b248060e5dd", "sighting--f3510351-5e63-4f4f-aa42-2d1e9e31025a", "sighting--53ccc7ae-5bf7-4c7b-be2b-7bb5a5b79987", "sighting--67599d3e-1dca-469b-a955-555f4e2cd6c2", "sighting--b890f638-6a84-4a62-a09e-963487ed6ba8", "sighting--e208b7e4-9086-4b93-b732-babed729f144", "sighting--973305c6-a432-4796-8a4f-4e3c95645b9d", "sighting--9f42214f-f242-46ac-a6ea-2b0ac5eb37d5", "sighting--54affae4-0f93-4d66-82c8-7f230846942c", "sighting--2a67e261-5ae1-42c4-93b3-999b4e78d152", "sighting--0b4edb9b-e2fb-439e-859e-d2057bd017ba", "sighting--796defad-a552-4d95-8266-bb36008db77a", "sighting--2a887ae9-d0b3-44c5-8626-98327d6f09fe", "sighting--dd66e985-60e3-4e7f-8ec1-8f918650f77a", "sighting--692f2deb-8371-4ff7-861e-f3eb4e497613", "sighting--0e1f2ba3-5f64-48e9-a222-80335e94834d", "sighting--db14bbb3-efa1-44e0-a170-da34f60e689d", "sighting--459fb78f-3f55-49d0-a488-526437d8ca00", "sighting--df0a7d23-38cc-4af9-a9e8-10166cf7d4b0", "sighting--72a91906-68a2-415f-b923-8043a39a16d9", "sighting--d3533e4e-b8c7-457e-a54b-0011d47e4ea4", "sighting--8605368a-f82c-4a2d-a951-d1ae4de14ce7", "sighting--cd0a3f6b-c4fa-4fd4-bd1d-7c301b2ceb28", "sighting--6a1d6c4c-6ec4-4998-89c9-66b0f00724c8", "sighting--27f0de04-251b-48f4-9ba9-58afd4fa3fa3", "sighting--585b8880-93f4-4d61-9951-f888bd7370d7", "sighting--3a26d18d-612a-425e-9d85-2bc7ec0b3ac9", "sighting--ffd0dc86-7839-4c0c-b819-d4537b6192e7", "sighting--c1eefe01-8196-4b48-965b-227dd896a65e", "sighting--c5f37672-e539-4d84-8039-52a6579683dc", "sighting--647303a6-92d4-46ac-80d9-9f8a65ce719e", "sighting--25250522-01af-45cd-b76f-d9bbb372718a", "sighting--d8eaf674-89d6-4c38-81fd-cab8ff2ff500", "sighting--d4f080a0-9041-46d9-bf10-419fff61d409", "sighting--91c146b9-ec60-4478-93d9-6b06389748bb", "sighting--a6dc3210-f311-4f2d-8bd2-6ecf21938b89", "sighting--4ef7da69-56ef-42c7-b351-ccfc7e2ec293", "sighting--bf93e879-7993-48e9-bcc0-0e511cf53632", "sighting--2a742bb6-cf61-49b5-95ef-e3b088b9d2d4", "sighting--0bdbdd83-f946-4847-8722-a4089bb57aea", "sighting--dec95aac-1182-4783-abf2-1715e534df82", "sighting--3e4b9d5d-f966-4ba2-a862-a1f61eab6449", "sighting--2670f785-5d31-4eba-a084-0071e7ccc501", "sighting--574d5ac4-bd29-4aaf-92f2-be71d8e3e993", "sighting--5878dd2e-69b7-40ae-b4f9-dada60f92ec2", "sighting--4f0794c4-2aab-4651-b433-7b80253c1354", "sighting--14896460-9035-4237-955a-0ddfb5fdb122", "sighting--31009ce3-47b5-4d4a-9145-674406592f56", "sighting--7e650b8b-bbf4-48d5-bf7b-6dc05a647ea7", "sighting--2eb7eff8-2f27-4d83-beae-136dc89a31a9", "sighting--96489c81-44fb-493d-b948-1c3562ed3ec0", "sighting--27a3ae2a-285a-425a-adb3-2b817dcc5e34", "sighting--ec82c688-2ce1-4d03-81e8-7fd1aaff44e6", "sighting--c50d97f2-335f-48b2-97f2-ddfe7e5e055c", "sighting--defccd58-436f-453d-9f5f-23809f15d0d3", "sighting--51791a25-864f-4b70-a1ed-232097743ef9", "sighting--3fc4fc87-f427-4055-a0db-dedf4e9e0195", "sighting--63592685-83b0-4384-8371-ce0a3ecf27b2", "sighting--8a015b32-abb2-4d12-8771-aa6671770189", "sighting--0c688019-ed74-4d3f-a7a8-29c9e30b8899", "sighting--b171ffb6-70ea-4d7c-9605-7b13a00d3273", "sighting--bc5fde4f-e710-4fef-8ef5-77fda38c6a55", "sighting--d6f06383-826e-4fdc-a9b3-c7044b9cded4", "sighting--7f36d222-9db8-483d-9706-bc13cbee346c", "sighting--09c23ac4-98e2-4273-9ca5-0d09c48477a4", "sighting--86d2a669-5c28-4388-8bde-aa2e3efb7928", "sighting--2b1ed7c5-bee7-40ce-991c-21b3b5d72e32", "sighting--8622b437-7ee2-4605-adca-9e93059f74d6", "sighting--00aaf8d8-4572-4635-9ee1-bce2bcac85d2", "sighting--1c2200c2-dc3d-4aa4-bafc-5dc903e08d02", "sighting--8ba61f2d-ec43-4445-8b4c-5ff33780e1a2", "sighting--a669b8e7-0047-4758-8e68-f6a8569201ae", "sighting--12cb62d2-6f20-48af-87d2-fe3ea00d19d3", "sighting--c2dd8762-9732-4a7b-81b0-fe2fb868f19e", "sighting--7397cfd3-eaa8-4798-bdac-cd523c5b30ac", "sighting--719cbd59-8d35-485f-b25c-ea2d2dd1a380", "sighting--facb0a41-da85-4aea-b529-e6a826e17139", "sighting--e53f74fe-8069-4cbd-814a-1b4f0ad968c6", "sighting--c7b73567-edb7-4ad5-a07d-09bf5d33a0cf", "sighting--6840fecc-33fe-49e2-8eae-25e518af5c73", "sighting--3410d854-8aa4-4a0c-b78f-2f3c5b65b2d2", "sighting--207c9e11-a7a6-43a3-ba15-fbded30447dd", "sighting--abcaee1c-66aa-4261-94e2-7c76898faa8f", "sighting--68acc6f8-17d3-46c1-a098-3dca9b77d17c", "sighting--2ffef71b-bcf2-4f1f-8620-7deb3c40c377", "sighting--bdaedbd4-9ed9-45d6-9c40-48f6da2617f2", "sighting--945f5bbc-d057-4a51-994c-0d07e1c54c2f", "sighting--86d12afc-3803-4e41-8152-f392b02e7707", "sighting--e4ac4415-9471-41a4-89bb-472b0f756894", "sighting--3a7a5238-043b-45b1-8024-b47d092ffad7", "sighting--d0e9a6fa-51ac-4ec2-8e08-632c425535c9", "sighting--1421b711-576f-41c0-9bd3-8bdf9964f645", "sighting--d3e7c6fe-548f-4080-8be2-7d0e649b75aa", "sighting--77b0fb0f-2bb9-4437-8d13-68f5f28ef7a9", "sighting--19ac0852-9c88-491a-a49b-c7f2a16c3c8d", "sighting--1429c433-db5e-4a74-a9cf-49d9dbe40dc3", "sighting--a9a32ae9-f9e9-4ab9-a954-a171f3a80fa1", "sighting--acc6ffdd-cfb1-4558-8aa0-b74f52965d93", "sighting--84fc1f0e-1144-494a-aaac-fa9eb1bbbb0a", "sighting--ab9c78a5-e317-4d85-b4aa-5c69dda7b08f", "sighting--02df90d8-b9ec-4fd8-bfd1-03841ee9c2a8", "sighting--5f4fbe0f-9386-4d00-bd63-c95fa2764ea4", "sighting--0a66370e-89f5-403f-9526-603e269c84d3", "sighting--513311e0-94b5-47d8-a5d1-33b0ed165585", "sighting--ec577da3-ef0e-4f16-9ea6-04592860a2c0", "sighting--d973da7f-7c5a-466a-9a2e-f7b857a3ec0d", "sighting--3ee460e4-4e71-4a6f-bc2a-ea7c01ecbf26", "sighting--74036467-aa8b-4925-bddf-cfb9cb9e150e", "sighting--5383e09e-d078-420c-aca3-0e165843f21a", "sighting--0383f17b-9028-4964-bb27-11afdf14c844", "sighting--b74883ec-df33-4660-9452-be8acf1d3ec4", "sighting--0ed2e13b-608c-4944-9c82-57cbdba8ad6d", "sighting--ea4de900-4da0-422e-b81d-da20eb1568c2", "sighting--a1fb30c4-1e61-4b3c-8191-508206433711", "sighting--08f1b0e0-3b82-45e0-a09b-a7763262ed5f", "sighting--5890c798-46aa-40cb-9e40-3db2f6c433c5", "sighting--064d1909-6369-4d64-ab34-8ea458218ee0", "sighting--39bdadd6-4775-48f9-ad47-6f47abfda717", "sighting--5e361b8a-c87e-4ccc-8a16-ae6e01793abc", "sighting--0f6669b7-7762-4e35-b4a5-8e4f62e435bf", "sighting--d7aad87c-14b4-4a77-b45f-93128bd2c1c4", "sighting--064bb2c4-5ab2-40f7-87b7-086401345b05", "sighting--bf7509b8-637b-402b-8cc5-d866d6adef55", "sighting--06c957db-c754-4b4d-9f77-e5b5fe62c60c", "sighting--0cb4c586-64ef-49c3-a078-0ad98ac52b97", "sighting--50e96e98-c81f-4d4b-aa69-c9ed71b45085", "sighting--1c4471dd-9944-47d2-9446-65fb030a987b", "sighting--73976713-b4a0-4527-99c1-018120a0855c", "sighting--4061e5d8-c82f-4085-8fc4-8d5fe08dd147", "sighting--5accbef8-1a99-4761-9fd2-e60fc3e8c29c", "sighting--50e7bb77-bc7f-4117-88a4-76e81f94beb2", "sighting--c661cfd6-05bd-4eaf-8911-9f9ac8c796c8", "sighting--65be5363-facb-4570-863f-608547fffbc1", "sighting--3efd94a6-c8f9-482a-b904-2dbaea58da83", "sighting--6ee1a657-06e5-469e-ba4b-dc2fe877e089", "sighting--f8bee268-df5a-4464-8965-ac9ad3ce3c4b", "sighting--d8977d9d-a58c-4bd7-8d2d-8ebc112f97b4", "sighting--35a0820f-ff03-4dbc-9695-808b9fb17ae2", "sighting--ed7a10f8-96d6-4548-9fee-274493777bb4", "sighting--e8e79b44-9515-408a-8fe3-3d4469d8e1c9", "sighting--874f2144-e863-4ce8-8803-ba6816c36320", "sighting--81290a93-4138-4025-9a06-aef87f62000d", "sighting--384fb57a-cc38-4234-9fc7-2307064b2a10", "sighting--8e928333-e148-4977-ad99-4c0e125519ea", "sighting--e0b19994-394b-47d0-bcaa-7f4317210e9f", "sighting--e97075f5-bbe2-4fd0-af1c-ac8d547efb3a", "sighting--8fe7df33-a1e3-4e4b-8ab5-a628e99a903f", "sighting--5c41aa43-5e53-4201-9add-a6540f19ef77", "sighting--b8ec5e96-fd90-4e90-bce8-1d01882ab1d9", "sighting--0d1993a9-28a7-4342-9d6d-fe7f1686d55d", "sighting--7f348abf-4daa-4e4b-9f26-8916516fbe85", "sighting--300f1fce-9e9a-476a-b165-6134f415cf29", "sighting--efdf6275-c8f2-4a00-b012-b1048bfca257", "sighting--e89f08c5-e3d9-4879-9ce5-e1fc6e42f51e", "sighting--05beea2a-671f-4aaf-9541-cc02624c39b3", "sighting--5659f680-0b67-4d58-b7ce-8463abd20f99", "sighting--0c208169-8fc4-49e0-a9d7-84bfa62d287a", "sighting--9a75d166-470b-4ed4-891f-42137db3572f", "sighting--fdb6d62d-51e8-4cac-9c68-8fd461401968", "sighting--6b700529-3730-4467-ad61-5d4ebc899f95", "sighting--97f5da22-201f-4da5-8c92-49198ec452e7", "sighting--2491472f-e4b5-4b20-841b-0087dbdd9f90", "sighting--0a3f5917-6248-4d7e-9f1f-7a3acac22e77", "sighting--89e8507b-b8b7-45ea-8f56-426d3abd38fa", "sighting--55d5280a-30d5-4fce-9ec9-ac7d07160b17", "sighting--6a5ead95-2f1c-4393-9d68-add0ab868495", "sighting--55b8a3b2-d1b4-4022-878e-0b03f05814f7", "sighting--74deaa70-6aab-425e-ae2a-ac8176dddf10", "sighting--14ed1d86-ca10-450a-8a70-eef63a436530", "sighting--82f034af-ef1b-4387-a35c-973c66a81703", "sighting--90a777b2-2bb9-4722-b99b-2c0f9c40fa25", "sighting--3553901c-650d-449d-9162-14946cd91ec4", "sighting--a3d828e1-5494-48bd-92ec-c5ebd27b212a", "sighting--c01124b8-12a0-41cc-80e0-dadad1b5ee09", "sighting--a329f1de-e8c9-48d7-b4ab-cd08feb23fa9", "sighting--0cfc0c92-9628-494d-80e9-f6bc808650d8", "sighting--a7fb4b0c-a54c-433d-9432-713c19367005", "sighting--0d32f491-2939-4dea-96d9-4fe465672d84", "sighting--20a5342f-2ef4-4bcd-b1cc-990fe31c74fb", "sighting--a8a7cf41-bdcf-454b-823b-eeef81fd7f21", "sighting--c7aa130d-3afc-4fcc-a596-6c9c18262c8f", "sighting--4aa2f212-a208-4e15-a8a9-241f0cdab13f", "sighting--9b7b62ac-fef9-4ad1-a21f-0989fd0c0255", "sighting--106a0e4b-20fb-44f2-9aef-fc711734619e", "sighting--99ffd8c8-e096-443e-8f52-e9d93288c351", "sighting--43d69e98-465c-4104-ac42-5fa340fbf582", "sighting--caee95f3-aa8c-4e11-bba9-d455877726c9", "sighting--030cc71c-7a69-4533-b5e0-cd6ce6622e8b", "sighting--8400009f-64fd-477e-9b38-2193cbb0085b", "sighting--e0b3904c-4193-47b6-847f-8528385baf07", "sighting--bfe3ce28-2761-4f3d-a40d-b1e899c93225", "sighting--2f74f0f5-2514-41ab-bced-2113c3666c41", "sighting--fc9fc362-4e6d-40b1-97bd-f0ef0e11ee66", "sighting--1b125fcf-6ef6-45fb-a221-14489ae37ff9", "sighting--a0e77515-97bb-4a7b-a616-fac552b44724", "sighting--e3bc905e-3658-4f6e-80ae-abc2fc90b2d4", "sighting--c3d2e436-bb53-4da8-a2ba-3ba244d99102", "sighting--f48f843d-f2d4-48f7-b25d-b72b7e89528f", "sighting--669f2dd2-5166-48fa-945d-87bbd8c8ca55", "sighting--eb444e89-134e-4f45-a535-a682580496fc", "sighting--6842c1ed-3094-415c-ab1c-30d59cb2bc68", "sighting--8f426097-ef1f-4874-89ae-53d13cfcb1b5", "sighting--8ea5ee93-8d7d-4d02-8b3b-e9df772ac6de", "sighting--7583b806-af75-4832-8807-f19052c41f36", "sighting--011ef53e-f1f2-4bf3-a5c9-2041a56329a6", "sighting--5653ece5-47c4-4934-9009-ca6a8d95a211", "sighting--9d831913-3d18-4252-acbd-1cea67fc14e9", "sighting--266980f4-d0da-4339-aed9-178b297b73d0", "sighting--73226a43-2c22-4e72-be09-3389061ff2a1", "sighting--23b11ee7-6da4-4282-8eac-a6c2d15c546d", "sighting--fc34e71b-5132-4f2b-a881-86c3537aedb5", "sighting--c690084c-52ac-43ee-9e8a-438766414904", "sighting--c987b117-3995-4568-be92-1a93a702cf1b", "sighting--6e6be4ae-0caf-4864-9a01-be78dbfe333c", "sighting--bf892a24-8e17-44f5-9006-882b1e48496f", "sighting--7a123ba8-b2f7-4a26-9154-1c3a7d81152a", "sighting--84a563aa-d404-4b3a-aa18-ff312831e7e0", "sighting--5a5b65a6-555a-4b1e-9c56-19ff427b5854", "sighting--bf12b8e9-f0c0-4eb9-8ad6-83d70df32159", "sighting--a461a91a-59b8-4cd1-a6f6-072cbf6b143a", "sighting--606bd977-8fd9-4e92-ab24-140ba9b09874", "sighting--7c8c7557-1412-46db-a7ed-438e52c01489", "sighting--dc781f12-2d18-4c7f-b140-12c2baa8be7a", "sighting--f3985be0-5e79-4c7b-8adf-f1895d80c0ab", "sighting--1b35428a-ac66-43df-89ba-660a709843a0", "sighting--d18fae23-2ac1-41f5-b3e8-b582e8e151e4", "sighting--370081cf-d3c6-4786-b393-c61c3f61d3f8", "sighting--6a9b131e-deb1-4e0d-82b7-5d6a20d67f12", "sighting--2132f7a3-5d7a-41d4-9d6b-4f3518cc6e7c", "sighting--04100187-6584-42ee-acd5-0a2d035b01d1", "sighting--adab3e06-2e60-413f-8d62-f04dbb4aa5dd", "sighting--23d32eb0-b1cd-4b20-b4ee-9c5850a8b6ac", "sighting--3d5405cd-563f-43f5-9491-9126b122581c", "sighting--a28ff604-ae02-481a-bc55-91253939845e", "sighting--b39dadcb-6ff5-401b-b2b4-ec60e932d205", "sighting--71672899-4eef-41e6-8331-17e6d4f79df9", "sighting--93f3dbb7-96a7-4dc8-be19-6bc784caabd1", "sighting--0c7c5790-60f5-4277-a48e-7229ea0203dd", "sighting--0f8e2316-f008-403c-95b8-e9b5d3cff0fc", "sighting--c159fb3f-6a0b-48b7-9c4a-4059f843d490", "sighting--1006c494-0e80-439c-b0fd-0e8a40e9b6df", "sighting--37fec7d4-c162-4113-9c09-9fafd5280b35", "sighting--e2347751-ad74-4755-b097-a61e6423321d", "sighting--07d0df94-b162-46db-8697-3f138ca4c428", "sighting--f537273d-9c21-43d6-8071-c1677bb52c2a", "sighting--a4f634e1-93f1-4c19-9458-0a881fd7f1ff", "sighting--3ffaf9e4-13ef-46c1-af26-85aaab7b0365", "sighting--d26b8755-cca0-44de-9e9f-8123688f17e6", "sighting--1c906d70-be22-411a-9454-e1e6f3926e1e", "sighting--d20ef88c-f67f-472c-9ca7-c0a1bb42ac2f", "sighting--2a90a4a6-b796-4108-bbaa-87ccbadf3c67", "sighting--fcabf187-c7a2-44ae-bc77-a971126fe788", "sighting--88c5fffa-8d6a-4456-994f-65af7d5680ae", "sighting--e1337b01-7449-4901-967a-0f88b1b31e9e", "sighting--ff8c398e-1755-4ff7-999a-6a46e7e539da", "sighting--6bee75e7-45e9-48c3-8625-7e78f072be61", "sighting--704589bd-c7b3-4651-b78c-e573842c8e3f", "sighting--cd22203c-e4e0-46bc-bb22-18946b3c5e07", "sighting--77959c4c-9a4f-43e0-b50e-ca7dda3727df", "sighting--ce7d562a-d7e6-4a2d-89c7-bbfd14d2a353", "sighting--5843df03-0bab-4f67-8080-e692bb917a37", "sighting--6b14706a-ae91-41ce-8f4d-7c229adb4546", "sighting--8d2771f6-7e16-4d80-b240-542a59b52f54", "sighting--13d27a35-2946-4c2b-bcde-01acad0c0e25", "sighting--e6b1bd69-f15b-4c36-b72f-2c5234900c61", "sighting--a31bc971-2df9-4bd5-b5a0-ba4d988f4565", "sighting--7eba8a82-b552-43d8-afec-f9f5f6b7a375", "sighting--44e2658b-ab50-44bd-b033-a59a4131e270", "sighting--1c70f159-fe14-4d02-9762-c3059df2f2da", "sighting--75e1ef7f-2f56-45c1-bf33-210b90ece718", "sighting--ccd8d20c-689d-4bd5-9fdf-c3e4d3cc17f5", "sighting--b50e14b6-9e7f-422c-b2a7-558af71eb6bf", "sighting--04b2da6d-ae3b-4efa-812a-79d65093d299", "sighting--83176d50-5c2c-4cbf-a7be-4f1e4c00d313", "sighting--97b58a7e-82ba-4a57-8730-e651e0e6b708", "sighting--7f3f8bcd-0aac-47b9-a35e-5f8740486275", "sighting--9af17b1e-b8a6-4297-bf1a-57860bd071bc", "sighting--39c9b8e2-2c1b-4db5-9b05-a63f8bd8d85c", "sighting--310fc142-76aa-4594-8231-63d7bcc79b8d", "sighting--8d33d892-df65-43c9-bea4-76b32b9f4cff", "sighting--8af7372a-d433-4656-805b-ad99d33e0d1b", "sighting--0dddeff7-d769-4e2c-88dd-82c3b09eddad", "sighting--43c51379-6f7e-4c90-84a1-85f2d7bcbec6", "sighting--0b8736fe-468c-4dbf-9eb5-9a165f105eb1", "sighting--8c8498d0-bdac-4cc7-9860-dbd24922e102", "sighting--31a0f6c9-1aa7-4085-828d-0cc7b87b9524", "sighting--127a7ee1-f4d4-49e7-ba10-da9dbf96e4ce", "sighting--3e56dc32-a98b-4594-85ea-94a7719a5437", "sighting--12ad1bae-4938-482a-87ee-d1fad3f07f90", "sighting--018fda27-7c9e-4d78-870e-e0f56d80bfde", "sighting--4f10888c-0f14-4583-9427-fe9ac512dcb2", "sighting--387196da-7e34-4007-bc0f-4c21d89c00ee", "sighting--7ceff117-4870-43b9-b152-12ed4580385a", "sighting--7d33daf4-116e-426f-97e2-4005230bd6cf", "sighting--a1b07017-d42b-475b-a76d-6908af984ca0", "sighting--4300f5b5-8d96-4cee-a54a-8ff6ea775abb", "sighting--1def6b6c-c1f9-4faa-b636-8c52c8749267", "sighting--e6a1df17-f8b9-4967-8911-b9ec8a0ce63b", "sighting--40ce2574-3931-4c1a-9d64-dd4fd871b022", "sighting--eae1f99d-c978-4b04-841c-5ae2105b51f2", "sighting--d1c9a4c0-360a-455a-9712-a4bfa67aebfd", "sighting--03276c00-d760-4b81-b301-ff9648dec1df", "sighting--0ab784ef-693a-4c22-bdce-1c919330da9d", "sighting--78bc2fd2-54e3-4f12-9c1c-b78d80b14058", "sighting--4b590f0b-4d1a-4f5a-9113-336c29765d72", "sighting--06c075a1-2958-4a9d-89a7-a667190c251d", "sighting--b8d850a1-a206-4b39-b6f4-d9c11e30d6b3", "sighting--7197f990-5ea8-48bb-a713-f75dff3cfdad", "sighting--5d8616b1-bf54-4471-9758-58d33c063a8e", "sighting--5a5a7876-00a3-4705-ab9b-698bfa061b4a", "sighting--c5f989ea-743f-4ed9-9cfa-7a04a1c730cf", "sighting--199ee338-8962-4d8b-9330-a16003f9a250", "sighting--9d70d02f-1740-4fcb-80c6-5be4a6f5395b", "sighting--bef2850e-5d27-4de8-b114-f3e28b2b682a", "sighting--ead244ac-6838-41fd-ac96-3d60f0be77e4", "sighting--ceaf8094-1fe7-4fc9-b476-82c713ece1ea", "sighting--c74475c7-64db-45e5-8ef6-357e0962960f", "sighting--d2c0f430-9d16-4b86-aa7b-8ef97fb6984c", "sighting--e0ea9801-7bd8-4e6f-8d24-016cd59f228e", "sighting--700ebb65-55a4-4b7d-8d4c-b28a88ed5ae3", "sighting--ed98fa07-2d6a-45e9-9b8a-cd3e0ee118f2", "sighting--bc05432f-0814-4317-825b-ab479fc27252", "sighting--10c948ce-ca38-4f1a-9199-81122a6b21b0", "sighting--59c81c48-08a5-4da9-ae54-5b2a0dc05094", "sighting--03645d75-5e7d-4765-9c05-02af127517d1", "sighting--34fc127d-5b01-4a76-b9ce-584bf662bdd2", "sighting--379c6d08-2c17-4f53-ab7b-81a0a611bf62", "sighting--3bf76918-1f57-4266-9ac5-9a419ca0841b", "sighting--a5866cc4-eb34-4629-a0cf-786eee567736", "sighting--bbc12c99-39e6-431f-9348-d8c09bed8aa1", "sighting--67eea933-cc5b-46f8-8eab-4b904ae1a315", "sighting--d970366c-ed75-4010-bff2-a92e7569ea0c", "sighting--dc4e2520-432c-4957-9dc7-7b03ea8e50d0", "sighting--95981432-d027-455c-87a5-eb4c8782a6f8", "sighting--c48aa9f4-c9c9-4859-bb78-3da04aac631a", "sighting--d2025905-099b-4a8d-80b0-260d1a40381b", "sighting--ce51eb82-6070-4b7c-88ba-0c47801c5e3c", "sighting--20fe2d6d-07f2-43fe-8381-5bb7455f0e4d", "sighting--6a5d81b0-089f-4e7a-8e26-91596d9e4bc3", "sighting--b4eecda3-8fc7-44de-99c5-8f1f0592095e", "sighting--49c02087-3905-4919-996b-686292e1bf57", "sighting--d9ed10e8-9174-4509-8625-caceb957852c", "sighting--258b5f5b-83c8-49cb-8a88-d6f8459a9ea5", "sighting--f8859e98-d3bf-4a85-a1d4-7edeb49469e4", "sighting--bc69b927-c707-4b7b-b212-9b7500b4c749", "sighting--883d728f-358a-46b0-ba31-5fce2a5606cf", "sighting--35508da7-ac45-473c-821a-eb4703bb2f40", "sighting--d75f71f3-5c69-4357-997f-5660cb466fa2", "sighting--09d8378f-f0a5-451d-96ae-6beba1588f8e", "sighting--05729bf5-d5bb-4c58-a446-ae3daa3ed738", "sighting--7b23376e-8c7a-467f-8bf5-31597a0efbf7", "sighting--8996bd70-f28d-424c-9d28-75f42f3419a0", "sighting--a39cf7ae-e9a5-4078-953c-304b92c82273", "sighting--ba001d9e-e518-47a2-a6b5-4bbe7a26c1a0", "sighting--0cfbb2d8-bd35-43a1-9146-dfe04de3cf9e", "sighting--919cf718-e102-4f25-aa70-b9ca1fa5506d", "sighting--bf098f72-252f-4db6-a60c-a754acedca3c", "sighting--a0e20c09-1726-4cad-9768-a7155fb2a263", "sighting--810aa2c2-3dde-4aa2-bf98-cdc68d6130f8", "sighting--e44335d9-2e3d-4020-a240-88639e461e0b", "sighting--fa9c8df7-4a83-4198-a2d9-7b8068286a3a", "sighting--75481e9e-d60e-4d5c-9eb5-37f757ff1639", "sighting--65b1361d-4c03-4b40-900d-7a16e8e14280", "sighting--5cdaa0dd-3fe0-4edd-8969-209a17ab3b1d", "sighting--7c674f9c-fc78-4df9-949e-7ede6727e589", "sighting--2e22aee1-45e2-454a-a6fe-d1ba02f8ee5b", "sighting--a8b6703d-ad23-4a00-9b55-8be09aa27bd2", "sighting--53beb0fa-990e-4311-93fd-ac58e70d9858", "sighting--091b22d2-9e8c-4bc1-9ce2-ed1714c6992e", "sighting--a261f792-d59d-405f-a9e9-1ea7996a1c88", "sighting--ab6345b5-f612-43bf-b25e-c1376cf4d9f6", "sighting--f82145bd-9cb4-4496-8720-b79d7e1dbe90", "sighting--28b705a7-20d7-4d01-ac47-740651473742", "sighting--c3ec4d04-73f0-4451-9252-2486396d8158", "sighting--a4566839-7922-40b8-894b-fddaa17dacae", "sighting--1310941d-4758-4553-b4fa-0e7855c81125", "sighting--9ccf79d5-6867-43e5-8ef3-cff86e610f72", "sighting--9754e088-8497-4fce-88a2-ac7643b20865", "sighting--84cfeaba-fcfd-47c8-962d-41472606ccec", "sighting--24083d26-fad3-4896-96ee-7273180bdd42", "sighting--66f0c6dc-7e1f-497c-9505-709ff7f56bae", "sighting--f4153f04-cc43-45b7-8080-0d4bdef6ff66", "sighting--75534411-0605-439d-b491-6d8a2a278fd8", "sighting--f332b5b8-2542-4b4d-b9ac-f6c70405d67e", "sighting--73237b62-ca9b-4cd3-bfaa-bbfef8ed2bb9", "sighting--adb8c8dc-949d-4e01-bf8f-09f2ea8c0262", "sighting--bdce3865-42e6-46aa-8337-74f932bef9b6", "sighting--290de602-d6ca-46da-b9ae-626bef08461a", "sighting--74baadeb-6ceb-44cd-bf59-960b8b11779d", "sighting--8902cea1-a3b3-4471-b07c-b661a8273b98", "sighting--42658c48-29ba-4cba-902e-bd423cfc3e7b", "sighting--1e661dcb-faeb-4e03-8de2-06c8ae70e355", "sighting--0ba4ecc7-a3e5-4b93-af20-dea72057e08c", "sighting--b0bd4179-c1c2-465f-9815-bc031ff1b494", "sighting--f19f55d2-86eb-421c-9c18-5eb78b3c4255", "sighting--9d515334-9b10-4edb-be31-f53d59ef1dda", "sighting--f696ac18-3649-4a65-87d8-c7cd34583be3", "sighting--655e930b-9541-49af-ab2c-470cd44940c7", "sighting--00002c59-15ee-41c0-b07c-557bf0cbc044", "sighting--a22c8f99-7967-4a2e-b140-35538be0b26b", "sighting--a8f10698-e0a1-4d17-be04-5c7c22f4ebc2", "sighting--421e6d16-8c18-4eea-861e-72063d3d5c9c", "sighting--6c57e05e-8127-4b87-badd-081df9de6381", "sighting--a452c327-4ccb-4e6b-9008-2e20f32d4f8d", "sighting--a6f76ef6-240d-4332-940e-829aa82089a9", "sighting--0549325b-701e-4f75-b670-9e18aac8d8df", "sighting--ce1822e7-8c76-4311-ab6c-9eff6d94ac94", "sighting--1e4dd64d-6f7a-4507-b8b5-6a479a7b3b0b", "sighting--2ed7b24d-1789-4d5c-9891-0dca12df790b", "sighting--e0a7160d-c4f9-44ed-aae2-574227ead7f4", "sighting--2c1bf1e1-f0a9-4760-a776-5270276f7c59", "sighting--8dd7057b-6ff9-448d-8654-d5aeea16068f", "sighting--6cf96a8f-6ee6-435b-b4ca-7dc4e76f91be", "sighting--36f7774d-b10a-4dd1-9dd2-06837329e65c", "sighting--ecccefba-c979-43b1-af57-fc54b80cc341", "sighting--b22f925b-be59-4ce3-b1db-5dbe23c65138", "sighting--50fe52b2-c80e-48c5-86e1-1bb942ab89f1", "sighting--e04d1226-7b5b-4b45-8c33-025489709735", "sighting--fa54b124-9f36-4490-8009-9f145b5610aa", "sighting--b9fde8be-aff9-4302-ac39-3e9f19deecb3", "sighting--4c7cff41-bf9d-428a-9394-96abad1db142", "sighting--e0e03e74-8ffe-4936-a3fb-80752f49634e", "sighting--b33af57d-37ec-4d92-b21d-babfb4116191", "sighting--44303562-c34f-4c16-a6a0-c98984f20566", "sighting--72cd53dd-e9f7-4987-8ba4-9a8c5ddb16eb", "sighting--524880b0-83fd-4c5b-a9ee-0bbb8bb0d10c", "sighting--2831510a-4c73-4158-a644-e81b64169b1e", "sighting--8f92bee1-eeb0-4fbd-af1e-58d2044123f0", "sighting--e11b127e-7b15-49a1-9cdd-57c9af53b45d", "sighting--aeb72d22-290d-49ff-b98b-d7bd950e32be", "sighting--514e4ba8-7071-4bba-bbaf-5187e36b7eb4", "sighting--f1871bfa-77a8-4085-8891-9fb7222435d7", "sighting--a9e91f6a-5d3e-4f4b-856f-d4e490be044c", "sighting--00f7a395-9d39-4a66-8cb9-060fd292a3cb", "sighting--7018f821-9fda-44e2-8dd3-b5391525a765", "sighting--42ee3f17-2a9b-4d07-a51a-2c5b69f31d1c", "sighting--de60a150-f01d-4cba-9c9f-a7b1053e717b", "sighting--a732b525-0b4d-48bc-9ad4-5a00f1ddb3de", "sighting--6b7d9775-a4db-4f61-ae40-06805882115c", "sighting--7af474f7-ae5b-47dd-a318-22052733ac81", "sighting--acc2e1b4-63eb-4a8b-86f4-9d81a9bb9256", "sighting--f32acb3e-ea5b-47b9-87b9-a85ab3681eb1", "sighting--b1a25614-6107-428b-bb3b-de0a2c231588", "sighting--04c247f8-dd25-45bf-82ce-045a4c6716c8", "sighting--9f4a868f-9269-4225-89f1-91ff46b9b87a", "sighting--a2d93059-2ef4-4953-9bee-ba470ac7dabc", "sighting--40c36413-9a49-4ba5-b837-d6e43b8e917a", "sighting--2e23dcee-ea07-4112-bb17-f10076cd273e", "sighting--4eb486e8-e139-48e6-b688-533db240e6bf", "sighting--a83a0c28-1b00-45e7-88ea-923d9dd15793", "sighting--63193ad0-6dcc-4745-88e4-23b1bbe34bc4", "sighting--4d15202c-7155-40e7-bb27-44a5eb906e93", "sighting--62f66131-6acc-4b3d-82a7-2060db87685d", "sighting--595311f3-02a7-438c-b8aa-89dbb5b936cc", "sighting--3169bb36-ea52-4157-ac0d-134167856445", "sighting--85c62b4e-fcc6-4822-9eaa-5f8289c07055", "sighting--83083b35-3efd-4f01-b255-6bc1ff1d6a1a", "sighting--36864d80-ebd0-4bfe-a448-309b5e9ce417", "sighting--fefee7e1-60f5-44dc-989a-29d97dc462b9", "sighting--a6841a45-bd6b-4561-83e1-3d514b526c8b", "sighting--6f3daa75-056a-4787-b094-e487c6c1a8ed", "sighting--ce431c34-bbf3-4040-827f-973f32678b26", "sighting--0f5fd01a-7770-4a35-a53a-aecb1a744df1", "sighting--065a9d6d-5f33-48a7-8994-3c26429e27d5", "sighting--ae2e272f-ae61-4bba-99b1-e5a41f848253", "sighting--c4d1077c-8abf-4fe9-8c47-5770562931fb", "sighting--5312dfbe-12e5-4ebe-839b-b09c5ca9ec49", "sighting--2c14cf4c-1e94-4d92-a750-e1ae29befc42", "sighting--559a3c72-5ffb-4972-8c5d-f021ebc4a6a4", "sighting--8ce56e0e-62c8-4505-9332-388640da40f1", "sighting--d194e41c-b14f-4412-8dfc-a0239ada2280", "sighting--29e8000f-60e7-4c33-a0c3-6a4eed285151", "sighting--2cec734b-a000-4d77-bc67-248f21272fa5", "sighting--574cbe8e-afe5-484c-bdbf-8dd27c3bf0a7", "sighting--83ad5384-89c1-47ca-8fcd-d956a24887b6", "sighting--404917f2-77ad-4ec0-955c-596e450d28ed", "sighting--5d5c31be-dda0-4432-99d1-548fd35e8b32", "sighting--48596ead-79d7-4a40-a27f-93fbdd8b3264", "sighting--80307bb5-44d7-40e3-9746-5c8924e4e3c4", "sighting--48b42782-f7cd-4496-9098-7d882a02607f", "sighting--ad7ac0a6-95d2-4733-ad2b-47da7c7d437f", "sighting--4be8c2fc-5695-4365-af28-22d3f8b50b93", "sighting--118aa5a1-4ad6-4b5f-b92f-0f04a59955d8", "sighting--cfb5e8e5-722a-44d4-bec8-9ddcada8e53b", "sighting--f1051da7-83af-41b4-933c-effca5ddec31", "sighting--0fb978b1-1c6f-4c62-80af-55b26b8ae269", "sighting--1830c7c1-a28b-44e7-8aca-3888496c3862", "sighting--96dec8f4-bb35-43db-8bef-2981482d3de9", "sighting--36d9dbe9-cd94-4a77-a7be-3a2fce81b1ed", "sighting--a96085c6-c6c9-4070-967f-5e8e9fd93b6c", "sighting--25060693-b7cc-4b9f-ad89-ab2cc1ff637c", "sighting--819968c9-899e-4371-9da6-0109e55d8bbd", "sighting--59effe21-6d83-429e-8422-ad86d8f4e407", "sighting--ef42b710-9cc6-4c2f-8f87-b08a463c7168", "sighting--19e46701-cabc-4ce6-8bb9-85113f2fa28a", "sighting--8768f381-a86c-4584-9dd4-4dd3ddef70bb", "sighting--8b1f0ada-043c-4ea4-a507-57b8db22c319", "sighting--b4905bab-033b-4daf-8264-8b19231e0ee0", "sighting--817876a1-3050-4ae6-8682-53727ae27609", "sighting--756d73ed-8326-4314-a1b9-7b39b3ffe259", "sighting--75f5c9a4-1e92-41c2-84fd-147be5a14825", "sighting--b1826570-9247-46a8-b26a-2808323ca419", "sighting--30463af7-ef8b-4f32-950f-024ceb357123", "sighting--fd5bbe4c-d64e-42ec-8d03-6f709b69e5ff", "sighting--acd17fad-836a-4adf-ab02-aca5ba62f40a", "sighting--fbea9b58-8751-4ba9-9183-12d9fb730ad8", "sighting--70fdaee3-e3d5-4d15-91f0-8095c38f7771", "sighting--b0e64fdd-3436-4ed1-96bb-a09051b60b38", "sighting--42854821-52d9-4591-b0f4-18ef3b51cd0b", "sighting--a9fbab08-4ccd-478d-abc3-c590e6365e93", "sighting--13d7e051-2671-4ebb-9a64-1014d20213c4", "sighting--786103a8-04be-4839-bd5b-4cdd98a07cb8", "sighting--01cabfd7-1a78-45a5-8c4b-3f2de9afc682", "sighting--81378e25-07da-4b8c-9b49-5b85aa74880f", "sighting--aadd3bf9-67db-4ce3-8e81-391a07115c34", "sighting--db2906fe-1637-4307-891f-df92e44ac49e", "sighting--e3e74657-46e7-45f4-a409-40d5ef0f858a", "sighting--9dca16ea-b18e-46da-b8f6-da5b385ac51c", "sighting--ca099c12-b52d-4976-add2-7146fe6071c4", "sighting--2150678e-06fc-4041-a880-4f7df4428da3", "sighting--29288cee-4785-43b9-882b-ae5944e773ef", "sighting--975ff9b1-d1eb-4700-9f65-a34f5e58f36b", "sighting--305dd6c5-aeee-4dc3-9902-f777bbe4a2be", "sighting--b0521cde-4675-4271-97a2-e17edcc40433", "sighting--29c69461-6b4a-4887-8a9c-6a35187177e2", "sighting--f94ff9bd-65be-4b71-8ba6-b167331732ea", "sighting--0e55eeff-9730-48a3-91ab-749ff1cfb3e9", "sighting--f7d2f87f-cab0-4568-b058-595fcfbcb267", "sighting--dc44d235-eecc-471c-a76e-4ba0926724db", "sighting--9a081156-6938-4fc2-94e7-abd5daec7bc6", "sighting--380cce1b-4e58-4e3b-a670-497566e9f2e5", "sighting--cebf5de5-3c50-4c01-9cfb-87ac78ecb597", "sighting--a52088ff-d47b-4e8c-b842-43f8035df9ec", "sighting--fcecd640-b13b-4bd6-8539-6d3ef366c938", "sighting--9e338d47-74b3-48fe-b348-4101932f4e41", "sighting--181bd4f9-88b9-42df-a9f8-b601f8f39cdf"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-25T11:00:02.083Z", "modified": "2026-05-25T11:00:02.083Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": {"tlp": "white"}}]}